fix(mosaic): bind delegated lifecycle evidence

2026-08-05 18:01:41 -05:00
parent b3d84662f9
commit b3a6959e46
7 changed files with 124 additions and 19 deletions
@@ -13,9 +13,11 @@ def refuse(message: str) -> None:
    raise SystemExit(1)


-if len(sys.argv) != 2:
-    refuse("expected token path")
-path = sys.argv[1]
+if len(sys.argv) != 3:
+    refuse("expected governed root and token path")
+root, path = sys.argv[1:]
+if os.path.abspath(os.path.dirname(path)) != os.path.abspath(root):
+    refuse("credential is not a direct child of the governed root")
 parent = os.path.dirname(path)
 try:
    parent_stat = os.stat(parent, follow_symlinks=False)