coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/scripts
History
codex d217c806ca
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Add the two publisher prefixes to the backup bucket policy. 
The live policy keeps the original backup application. Each new key can abort only inside its own prefix.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2026-10-08 23:42:25 +02:00
..
native_factory_probe Exercise fsGroup startup through the corrected producer helper 2026-09-11 12:41:50 +02:00
operator-browser Restore contained attended browser launch on WSL without xdg-utils 2026-09-06 00:44:08 +02:00
activate_forgejo_primary_backup.py Define scoped Forgejo native backup on the Scaleway primary 2026-09-06 00:48:25 +02:00
agent_high_risk_boundary.py Finish coding-agent high-risk boundary coverage 2026-08-22 10:03:54 +02:00
application_archive_retention_plan.py Prepare immutable application archive transfer and retention admission 2026-10-07 23:23:33 +02:00
application_backup_credentials.py Commit the prepared backup reader for both archive pairs. 2026-10-08 22:12:34 +02:00
application_backup_pair_custody.py Admit and install the backup pair writer. 2026-10-08 22:41:20 +02:00
apply-backup-publisher-bucket-policy.py Add the two publisher prefixes to the backup bucket policy. 2026-10-08 23:42:25 +02:00
apply-ccr0019-binding.py Bind secrets-engine approval reader to confirmed operator group 2026-09-14 01:30:23 +02:00
approval-client-delivery-check.py Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
approval-client-reader-preflight.py Verify scoped approval client delivery through attended reader session 2026-09-14 01:46:45 +02:00
audit-core-database-lease-recovery.py Harden WP-0024 recovery execution gates 2026-08-22 14:00:18 +02:00
audit-core-recovery-preflight.py Harden WP-0024 recovery execution gates 2026-08-22 14:00:18 +02:00
audit-core-whitehat-e2-credentials-02.py Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
audit-core-whitehat-e2-credentials.py Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
authelia_smtp_delivery.py Prepare attended scoped platform mailbox admission for Authelia 2026-10-06 19:30:59 +02:00
backup_retention_plan.py Verify full and essentials recovery and implement bounded retention tooling 2026-09-06 11:10:50 +02:00
capture-apps-pg-evidence.py Finish RAILIANCE-WP-0016 apps-pg resource evidence 2026-08-14 02:05:25 +02:00
capture-reef-deployables.py Close RAILIANCE-WP-0015-T02 platform rapp schema convergence 2026-08-14 00:39:06 +02:00
capture_forgejo_archive.py Bind essentials recovery to explicit manifest and verified offsite provenance 2026-09-06 09:25:26 +02:00
capture_service_observation.py RPF-WP-0046-T06: eso.token-renewal assurance signal; plan finished 2026-09-24 00:48:24 +02:00
catalog_lane_scaffold.py Implement offline catalog lane scaffold generation 2026-10-04 02:24:40 +02:00
cleanup_nextcloud_recovery_fixture.py Bound rejected backup fixture cleanup to successful replacement recovery 2026-09-06 01:05:27 +02:00
consumption_mode.py Finish RAILIANCE-WP-0017 consumption-mode enforcement 2026-08-15 14:56:02 +02:00
create-metered-approval-requests.py Prepare exact metered requester extension with scope refusal tests 2026-09-27 20:34:52 +02:00
create-metered-approval-requests.sh Record approved metered requester extension and six native creates 2026-09-27 21:08:43 +02:00
create-t03-approval-requests.py Repoint live flex-auth repository path to access-engine (FLEX-WP-0020) 2026-09-30 18:52:08 +02:00
credential-change.py Silence applier-apply under --quiet and drop the retired bao callback default 2026-10-07 09:16:58 +02:00
credential-grants-validate.py Close RAILIANCE-WP-0015-T06 rapp credential-lane binding 2026-08-14 00:47:28 +02:00
credential.py Adopt canonical flex-auth credential checks 2026-08-23 14:03:40 +02:00
custody-projection.py Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
custody_contract.py Add versioned ephemeral custody lifecycle 2026-08-22 21:56:42 +02:00
decrypt_primary_forgejo_archive.py Record archive recovery lifecycle and validate receipt provenance 2026-09-06 14:53:15 +02:00
deploy_verified_backup_bundle.py Deliver validated backup capture to worker via immutable runtime bundle 2026-09-05 22:32:30 +02:00
execute_nextcloud_retention.py Verify full and essentials recovery and implement bounded retention tooling 2026-09-06 11:10:50 +02:00
factory_audit_custody.py Record live receiver gate and isolate readiness from attestation jobs 2026-09-11 07:26:16 +02:00
factory_audit_delivery.py feat: deliver approved factory audit sender custody 2026-09-11 09:38:27 +02:00
forgejo-admin-pat-provision.sh Apply CCR-2026-0006 Forgejo admin PAT lane metadata 2026-07-12 16:07:32 +02:00
forgejo_essentials_profile.py Bind essentials recovery to explicit manifest and verified offsite provenance 2026-09-06 09:25:26 +02:00
forgejo_package_prune.py Protect digest-pinned packages and refuse partial-inventory pruning 2026-09-27 16:00:51 +02:00
inbound_library_imap_entry.py Prepare password-free inbound-library IMAP entry for attended custody 2026-10-05 11:14:54 +02:00
informed_decision_requester_metadata.py Record native ESO result and prepare scoped self-token amendment 2026-10-04 23:21:55 +02:00
install-backup-pair-writer.sh Admit and install the backup pair writer. 2026-10-08 22:41:20 +02:00
keycape-approval-custody-preflight.py docs(custody): record attended KeyCape first-provision authority proof 2026-09-08 22:40:04 +02:00
keycape_approval_custody.py feat: verify live KeyCape custody and preserve versions on resume 2026-09-09 02:18:12 +02:00
keycape_factor_acceptance.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_activate.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_bootstrap.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_delivery_probe.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_eso_metadata.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_metadata.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_provider.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_recovery.py Implement audited lost-factor recovery and track remaining P04 acceptance 2026-09-13 17:28:45 +02:00
keycape_factor_renew.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_factor_renewal_metadata.py Establish scoped KeyCape factor custody and verified automatic renewal 2026-09-13 16:25:33 +02:00
keycape_secrets_engine_openbao_custody.py Revise KeyCape secrets-engine-openbao custody: OpenBao-only, operator reader CCR-2026-0034 (source only) 2026-10-06 14:26:42 +02:00
migrate_nextcloud_backup_account.py fix(backup): send required public DAV upload marker 2026-10-03 21:20:21 +02:00
native_factory_acceptance.py Exercise fsGroup startup through the corrected producer helper 2026-09-11 12:41:50 +02:00
openbao-apply-credential-change-appliers.py Add credential-change delegated applier flow 2026-07-01 20:07:26 +02:00
openbao-apply-external-secrets-issue-core.sh Add credential-change delegated applier flow 2026-07-01 20:07:26 +02:00
openbao-apply-initial-config.sh Add ESO OpenBao GitOps add-ons 2026-06-25 20:08:36 +02:00
openbao-apply-operator-loopback-callback.sh Advance blocked assurance and operator callback work 2026-09-06 14:16:49 +02:00
openbao-apply-policy-nexus-source-ccr.sh Add contained Policy Nexus CCR apply wrapper 2026-08-31 23:12:16 +02:00
openbao-apply-ssh-engine.sh fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers 2026-06-18 01:18:56 +02:00
openbao-apply-token-grants.py Unblock credential broker warden-sign pilot 2026-07-01 23:10:38 +02:00
openbao-apply-workload-kv-lanes.sh Correct whynot credential tenant path 2026-06-28 01:00:12 +02:00
openbao-attended-exec.py Add sitting-requester create-only token-exchange proof. 2026-09-15 20:38:47 +02:00
openbao-bootstrap-core-hub-source.sh CUST-WP-0075: dedicated core-hub Forgejo read identity CCR draft 2026-10-03 08:27:56 +02:00
openbao-bootstrap-policy-nexus-source.sh Add attended Policy Nexus source bootstrap 2026-08-31 23:24:05 +02:00
openbao-eso-db-token-periodic-attended.sh RPF-WP-0046: periodic ESO database tokens and a daily renewer 2026-09-23 19:53:12 +02:00
openbao-platform-admin-callback-prune.sh Add attended prune of retired bao.coulomb.social callbacks from platform-admin 2026-09-24 00:49:39 +02:00
openbao-platform-admin-check.sh Declare live platform-admin role and policies; add attended admin check 2026-09-23 19:27:25 +02:00
openbao-policy-sync.sh CCR-2026-0029/0030: activity-core ops_run worker token paths (proposed) 2026-09-23 20:00:40 +02:00
openbao-public-listener-transition.sh feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access 2026-08-23 12:50:23 +02:00
openbao-tenant-engine-audit-core-sender-eso-attended.sh RPF-IN-0002: declare tenant-engine audit-core sender ESO policy, role apply script, test 2026-10-03 00:16:49 +02:00
openbao-tune-auth-listing.sh Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
openbao-ui-overlay-apply.sh feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access 2026-08-23 12:50:23 +02:00
openbao-validate-emergency-drill-evidence.sh Reject placeholder OpenBao drill evidence 2026-06-02 02:02:09 +02:00
openbao-validate-restore-evidence.sh Reject placeholder OpenBao drill evidence 2026-06-02 02:02:09 +02:00
openbao-verify-authenticated.sh feat(openbao): enable bao.coulomb.social ingress and Traefik middlewares 2026-06-18 01:23:02 +02:00
openbao-verify-login-overlay.sh feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access 2026-08-23 12:50:23 +02:00
openbao-verify-ssh-engine.sh feat(openbao): add SSH engine automation for ops-warden signing 2026-06-18 01:06:43 +02:00
openbao-verify-token-grants.py Unblock credential broker warden-sign pilot 2026-07-01 23:10:38 +02:00
openbao-verify.sh Configure OpenBao file audit declaratively 2026-06-01 22:12:23 +02:00
openbao_open_questions_session.py Run the custody session through a Make target, and give the runner a shebang 2026-09-10 08:15:41 +02:00
openbao_operator_loopback_callback.py Preserve writable OIDC fields on the loopback callback update. 2026-09-15 02:23:22 +02:00
openbao_platform_admin_callback_prune.py Add attended prune of retired bao.coulomb.social callbacks from platform-admin 2026-09-24 00:49:39 +02:00
openbao_platform_admin_check.py Declare live platform-admin role and policies; add attended admin check 2026-09-23 19:27:25 +02:00
openbao_policy_sync.py CCR-2026-0029/0030: activity-core ops_run worker token paths (proposed) 2026-09-23 20:00:40 +02:00
prepare-backup-pair-slots.py Prepare empty OpenBao slots for the two backup publisher pairs. 2026-10-08 23:13:17 +02:00
prepare-glas-anthropic.py feat: verify Anthropic custody through metadata only 2026-09-05 21:15:14 +02:00
primary_application_archive.py Prepare immutable application archive transfer and retention admission 2026-10-07 23:23:33 +02:00
prove-backup-publisher-prefixes.py Add the two publisher prefixes to the backup bucket policy. 2026-10-08 23:42:25 +02:00
prove-sitting-requester-exchange.py Classify sitting-requester exchange failures and retry failed receipts. 2026-09-15 20:51:28 +02:00
prove-sitting-requester-exchange.sh Add sitting-requester create-only token-exchange proof. 2026-09-15 20:38:47 +02:00
prove_secret_annotation_guard.py fix(security): hold annotation enforcement until ESO metadata is explicit 2026-09-28 15:08:00 +02:00
provision-core-hub-forgejo-source.py CCR-2026-0031: choose the private probe repo with the admin token 2026-10-03 10:07:54 +02:00
provision-policy-nexus-forgejo-source.py Activate Policy Nexus source credential lane 2026-09-01 01:35:48 +02:00
provision-sitting-requester.py Approve sitting-requester CCRs and add the attended provisioner. 2026-09-15 20:08:02 +02:00
provision-sitting-requester.sh Approve sitting-requester CCRs and add the attended provisioner. 2026-09-15 20:08:02 +02:00
provision-t03-requester.py Provision scoped T03 requester custody and native requests 2026-09-14 02:47:32 +02:00
provisioning_window.py Prepare offline attended provisioning checklists and route remaining custody gates 2026-10-04 00:27:00 +02:00
railiance_clock_custody.py Implement attended Railiance Clock host key delivery 2026-09-15 23:00:20 +02:00
recovery_evidence.py Close verified incident task and finish local workplan loose ends 2026-09-27 19:04:54 +02:00
refresh_live_images.py Add failure-safe cluster image capture hook 2026-09-05 10:04:38 +02:00
remote_exec.py Add versioned ephemeral custody lifecycle 2026-08-22 21:56:42 +02:00
render_backup_credential_contract.py Commit the prepared backup reader for both archive pairs. 2026-10-08 22:12:34 +02:00
repair_eso_kubernetes_auth.py Document recovered ESO lanes and recognize explicit invalid-token responses 2026-09-05 18:51:40 +02:00
restore_forgejo_offsite_locally.py Record archive recovery lifecycle and validate receipt provenance 2026-09-06 14:53:15 +02:00
restore_telemetry_essentials.py Verify telemetry essentials recovery from versioned Scaleway archive 2026-09-06 23:46:20 +02:00
root-custody-finish-attended.sh Diagnose attended custody finish failures with safe staged receipts 2026-10-03 21:08:56 +02:00
root-grant-attended.sh Implement attended root custody admission and crash-safe publisher 2026-10-03 19:44:22 +02:00
root_custody_finish.py feat(backup): repair reviewed upload share after history recovery proof 2026-10-03 21:50:19 +02:00
root_custody_finish_entry.py Diagnose attended custody finish failures with safe staged receipts 2026-10-03 21:08:56 +02:00
root_custody_restore_probe.py Prove isolated custody recovery and prepare governed offsite finish 2026-10-03 20:47:48 +02:00
root_grant_attended.py Implement attended root custody admission and crash-safe publisher 2026-10-03 19:44:22 +02:00
root_grant_publish.py Prepare conditional platform-root custody document producer 2026-10-03 18:51:26 +02:00
scaleway_forgejo_archive.py Close verified incident task and finish local workplan loose ends 2026-09-27 19:04:54 +02:00
secret_annotation_maintenance.py fix(security): hold annotation enforcement until ESO metadata is explicit 2026-09-28 15:08:00 +02:00
service_assurance.py Implement S3 service assurance and admission checks 2026-09-05 11:43:55 +02:00
state_hub_preflight_lane.py Allow bounded ESO token self-validation and cleanup 2026-09-05 16:47:26 +02:00
state_hub_signing_acceptance.py Require signature rejection in predecessor acceptance 2026-09-05 17:58:01 +02:00
survey-backup-iam.py Admit and install the backup pair writer. 2026-10-08 22:41:20 +02:00
survey-backup-pair-metadata.sh Admit and install the backup pair writer. 2026-10-08 22:41:20 +02:00
t03-attended-delivery.py Point the OpenRouter cycle at memo version 3. 2026-09-27 15:33:09 +02:00
t03-native-execution.py Point the OpenRouter cycle at memo version 3. 2026-09-27 15:33:09 +02:00
t03_request_time.py Renew T03 requests using Railiance time and bind native execution 2026-09-16 01:08:56 +02:00
telemetry_grafana_access.py Establish attended telemetry Grafana custody and record private activation 2026-09-06 22:36:09 +02:00
telemetry_grafana_custody.py Establish attended telemetry Grafana custody and record private activation 2026-09-06 22:36:09 +02:00
telemetry_primary_archive.py Verify telemetry essentials recovery from versioned Scaleway archive 2026-09-06 23:46:20 +02:00
telemetry_smtp_delivery.py Add attended SMTP verification and exact reader admission 2026-09-28 11:21:57 +02:00
telemetry_smtp_entry.py Prepare password-free telemetry SMTP entry for attended custody 2026-09-28 11:11:34 +02:00
tenant_engine_audit_core_sender_seed.py CUST-WP-0075: tenant-engine sender seed helper; re-qualify RPF-WP-0035-T02/T08 2026-10-03 08:28:32 +02:00
verify-backup-pair-versions.py Record that both backup publisher slots are at version 2. 2026-10-08 23:19:21 +02:00
verify_coding_agent_approle.py Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults 2026-09-22 22:47:42 +02:00
verify_informed_decision_requester.py Match native proof HTTPS egress to the service ingress peer 2026-10-04 23:44:47 +02:00
verify_nextcloud_offsite_restore.py Record archive recovery lifecycle and validate receipt provenance 2026-09-06 14:53:15 +02:00
verify_scaleway_primary_restore.py Extend isolated Scaleway recovery checks to Forgejo database metadata 2026-09-06 00:51:55 +02:00
wp0024-owner-review.py Report WP-0024 approvals by task 2026-08-22 14:57:52 +02:00
wp0024-t02-driver-candidate.py Add direct WP-0024 load driver handoff 2026-08-22 16:17:03 +02:00
wp0025-broker-readiness.py Adopt canonical flex-auth credential checks 2026-08-23 14:03:40 +02:00