bedab6f5ab
The warden openbao-platform-admin-login lane runs one silent child per login, fails closed on any output and self-revokes; the old runbook printed output and rolled back from a standing session that cannot exist. - scripts/openbao-platform-admin-aal2.sh (+ .py): prepare (backup + assurance claim mapping), apply (gated on this login's assurance_level=aal2, readback of bound_claims), verify, rollback from the backup receipt via a fresh lane login, rollback-body for the docs/openbao.md break-glass path. 0600 O_EXCL receipts, value-free; no stdout/stderr. - Role declaration maps /assurance/level to token metadata assurance_level. - tests/test_openbao_platform_admin_aal2.py: fake bao end-to-end. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
4 lines
219 B
Bash
Executable file
4 lines
219 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Silent child for the governed attended login (RPF-WP-0065-T04); results go to the receipt only.
|
|
set -euo pipefail
|
|
exec python3 "$(dirname "$0")/openbao_platform_admin_aal2.py" "$@" >/dev/null 2>&1
|