Fix staging IAM validation

Fix staging IAM validation

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified ops/staging/validate-isolation.sh

Diff

1 file changed, +3 -2


for slot in openagents-staging-scv-codex-operator-1 openagents-staging-scv-codex-operator-2; do
  jq -e --arg web "$web_member" --arg fleet "$fleet_member" '
    . as $policy |
    all([$web, $fleet][]; . as $member |
      any(.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members | index($member))) and
      any(.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members | index($member)))
      any($policy.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members | index($member))) and
      any($policy.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members | index($member)))
    )
  ' "$run_root/$slot-iam.json" >/dev/null
done

136	136
137	137		`for slot in openagents-staging-scv-codex-operator-1 openagents-staging-scv-codex-operator-2; do`
138	138		`jq -e --arg web "$web_member" --arg fleet "$fleet_member" '`
	139	+	`. as $policy \|`
139	140		`all([$web, $fleet][]; . as $member \|`
140		-	`any(.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members \| index($member))) and`
141		-	`any(.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members \| index($member)))`
	141	+	`any($policy.bindings[]?; .role == "roles/secretmanager.secretVersionAdder" and (.members \| index($member))) and`
	142	+	`any($policy.bindings[]?; .role == "roles/secretmanager.secretAccessor" and (.members \| index($member)))`
142	143		`)`
143	144		`' "$run_root/$slot-iam.json" >/dev/null`
144	145		`done`