coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind native OpenRouter approval to custody and delivery inputs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:54:55 +02:00
parent 0783b50216
commit 7ba1b6223e
16 changed files with 656 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tools/exercise_approval_identity.py
View file

@ -430,6 +430,21 @@ def exercise(args):
assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
else:
raise AssertionError("substitute recipient accepted")
from dataclasses import replace
for name, changed_entry in {
"path": replace(owner_entry, path=owner_entry.path + "-unrelated"),
"mount": replace(owner_entry, mount=owner_entry.mount + "-unrelated"),
"owner": replace(owner_entry, repo=owner_entry.repo + "-unrelated"),
"limits": replace(owner_entry, delivery_auth={**owner_entry.delivery_auth, "token_max_ttl": "24h"}),
}.items():
with patch.object(cli, "get_entry", return_value=changed_entry):
try:
cli.cmd_exec(cfg, cli_args)
except DecisionError:
assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
else:
raise AssertionError("changed catalog target replay accepted: " + name)
receipt["checks"]["catalog_" + name + "_change_refused_before_consume_backend"] = True
original_env = raw["delivery_config"]["exec_owner"]["environment"]["LANG"]
raw["delivery_config"]["exec_owner"]["environment"]["LANG"] = "C"
try: