Complete NK-WP-0051 with attended member and refusal evidence
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
c19eabc4ae
commit
9442858535
6 changed files with 189 additions and 16 deletions
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"workplan": "NK-WP-0051",
|
||||
"date": "2026-10-15",
|
||||
"result": "pass",
|
||||
"source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
|
||||
"admin": {
|
||||
"uid": "platform-root",
|
||||
"groups": [
|
||||
"activity-core-operators",
|
||||
"net-kingdom-admins",
|
||||
"net-kingdom-users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"contained_session_exit": 0,
|
||||
"ccr": "CCR-2026-0045",
|
||||
"ccr_status": "applied"
|
||||
},
|
||||
"member": {
|
||||
"uid": "bernd.worsch-3",
|
||||
"groups": [
|
||||
"reuse-surface-hub-writers",
|
||||
"tenant:trial:demo-company:users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "accepted",
|
||||
"revoked": true
|
||||
},
|
||||
"non_member": {
|
||||
"uid": "tegwick",
|
||||
"groups": [
|
||||
"railiance-admins"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "refused",
|
||||
"openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
|
||||
},
|
||||
"overlay": {
|
||||
"apply": "passed",
|
||||
"verify": "passed after transient connection reset during gateway rollout",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
|
||||
},
|
||||
"verification": {
|
||||
"directory_helper": "68 passed",
|
||||
"platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
|
||||
"ccr_0045_validate": "passed",
|
||||
"ccr_0045_dry_run": "passed; no warnings"
|
||||
},
|
||||
"limits": [
|
||||
"No KV secret values read",
|
||||
"User diagnosis values are founder observations, not independently captured browser evidence",
|
||||
"No independent live platform-admin entity-policy inventory performed",
|
||||
"No changes to directory memberships, admin entity policy, or ops-mason-survey"
|
||||
],
|
||||
"receipts": {
|
||||
"reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
|
||||
"reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=member
|
||||
at=2026-10-15T17:16:54Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=bernd.worsch-3
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=ok
|
||||
openbao_error=
|
||||
entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
|
||||
policies=workload-kv-read-reuse-surface-runtime
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/data/workloads/reuse/reuse-surface: deny
|
||||
platform/metadata/workloads/reuse/reuse-surface: deny
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
|
||||
revoked=yes
|
||||
result=pass
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=non-member
|
||||
at=2026-10-15T17:20:11Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=tegwick
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=refused
|
||||
openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
|
||||
entity_id=
|
||||
policies=
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/data/workloads/reuse/reuse-surface: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface: not-run
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
|
||||
revoked=n/a
|
||||
result=pass
|
||||
|
|
@ -51,15 +51,21 @@ Matching `groups` to an OpenBao role stays a metadata read in ops-mason.
|
|||
|
||||
## Negative-login fixture
|
||||
|
||||
Fixture uid: `signin-probe-negative`.
|
||||
Fixture uid: `tegwick` (selected by the founder on 2026-10-15).
|
||||
Founder confirmed existing MFA enrollment and directory membership of
|
||||
`railiance-admins` only. The attended diagnosis independently of the directory
|
||||
preview showed that same group list and `aal2` before OpenBao refused the
|
||||
workload login. This replaces the original
|
||||
proposed fixture `signin-probe-negative`.
|
||||
|
||||
- not a member of `reuse-surface-hub-writers`
|
||||
- not a platform admin (`net-kingdom-admins`)
|
||||
- holds a one-time password (enrolled by the founder in NK-WP-0051-T05 at
|
||||
`https://pink-account.coulomb.social/`, realm `coulomb`)
|
||||
- holds a one-time password (existing MFA confirmed by the founder for
|
||||
NK-WP-0051-T05; factor management at `https://pink-account.coulomb.social/`,
|
||||
realm `coulomb`)
|
||||
|
||||
The user is never created or described with credentials in git. A
|
||||
successful diagnosis of this fixture shows `uid=signin-probe-negative`,
|
||||
successful diagnosis of this fixture shows `uid=tegwick`,
|
||||
groups without `reuse-surface-hub-writers`, `assurance=aal2`, and then the
|
||||
OpenBao groups refusal.
|
||||
|
||||
|
|
@ -69,5 +75,30 @@ OpenBao groups refusal.
|
|||
| --- | --- |
|
||||
| key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 → 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed |
|
||||
| user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root · aal2` and Authelia `platform-root` |
|
||||
| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
|
||||
| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |
|
||||
| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); both attended proofs passed 2026-10-15, member token revoked. [Receipts](evidence/2026-10-15-sign-in-diagnosis/acceptance.json) |
|
||||
| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approved by founder for both requested roles and applied through contained admin session (exit 0). Overlay deployed and `make openbao-verify-login-overlay` passed. Separate UI button clickthrough remains RPF-WP-0057-T04 |
|
||||
|
||||
## Attended acceptance — 2026-10-15
|
||||
|
||||
Both native verifier receipts passed. The founder observed the diagnosis
|
||||
before continuing each login and confirmed the resulting OpenBao response:
|
||||
|
||||
| Login | Diagnosis | OpenBao result |
|
||||
| --- | --- | --- |
|
||||
| Admin apply | `platform-root`, includes `net-kingdom-admins`, `aal2` | Accepted; CCR-2026-0045 applied; contained session exited 0 |
|
||||
| Member proof | `bernd.worsch-3`, includes `reuse-surface-hub-writers`, `aal2` | Accepted; exact workload policy, intended reads, parent/sibling denials, token revoked |
|
||||
| Negative proof | `tegwick`, `railiance-admins` only, `aal2` | Refused: `claim "groups" does not match any associated bound claim values` |
|
||||
|
||||
[Acceptance record and receipt digests](evidence/2026-10-15-sign-in-diagnosis/acceptance.json),
|
||||
[member receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt),
|
||||
[negative receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt).
|
||||
The receipts contain no token or KV value; callback codes are redacted.
|
||||
The negative receipt names `tegwick` and preserves OpenBao's refusal text.
|
||||
The uid and assurance receipt inputs are corroborated by the founder's
|
||||
observations for those exact requests; CLI arguments alone are not evidence.
|
||||
|
||||
The approved login overlay is deployed and its HTTP verification passes.
|
||||
Direct browser exercise of its role-selection controls remains in the existing
|
||||
owner task RPF-WP-0057-T04; native attended OIDC logins exercised both roles.
|
||||
NK-WP-0051's attended diagnosis/refusal goal is met. No group memberships,
|
||||
admin entity policies or survey grant were changed; no KV values were read.
|
||||
|
|
|
|||
|
|
@ -76,7 +76,7 @@ To see which directory groups a login will carry (NK-WP-0051,
|
|||
[`docs/sign-in-diagnosis.md`](../../../docs/sign-in-diagnosis.md)):
|
||||
|
||||
```bash
|
||||
python3 lldap_admin.py groups --user signin-probe-negative \
|
||||
python3 lldap_admin.py groups --user tegwick \
|
||||
--root /absolute/private/custody
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Show who a workload sign-in actually is"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -57,6 +57,33 @@ Out of scope: widening `ops-mason-survey`, attaching
|
|||
of a token, authorization code, email address, or one-time password.
|
||||
Group display names and the uid are the diagnosis. They are not secret.
|
||||
|
||||
### Completion review — 2026-10-15
|
||||
|
||||
All six tasks are done. The founder selected existing MFA-enrolled `tegwick`
|
||||
for the negative fixture and confirmed its sole directory group is
|
||||
`railiance-admins`. Its attended diagnosis showed that uid/group and `aal2`
|
||||
before the workload role refused the groups claim; the native verifier receipt
|
||||
names the same uid and preserves the error. The member proof as `bernd.worsch-3`
|
||||
passed all capability checks and revoked its token.
|
||||
|
||||
CCR-2026-0045 was approved by the founder in both requested roles and applied
|
||||
through a contained `platform-root` OIDC/MFA session (exit 0). The approved
|
||||
login overlay was deployed and its HTTP verification passed. The existing
|
||||
owner task RPF-WP-0057-T04 retains separate UI role-selector clickthrough;
|
||||
this does not block the completed native attended diagnosis/refusal goal.
|
||||
|
||||
Evidence: [acceptance and sanitized receipts](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json).
|
||||
Directory-helper verification: **68 passed**. Platform checks: **64 passed,
|
||||
2 unrelated failures** (CCR-2026-0035 schema and core-hub resource-list
|
||||
expectation); CCR-2026-0045 validates and its dry-run has no warnings.
|
||||
|
||||
Security orientation: Emergent Knowledge **0.2.6**, package digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`;
|
||||
`start` and `identity` were **withheld / orientation-only** because sources
|
||||
changed. Reviewed their source cards, current `SECURITY-COMPANION.md`, owner
|
||||
declarations and the current owner procedures directly. Retrieval grants no
|
||||
live authority.
|
||||
|
||||
## Write the diagnosis contract
|
||||
|
||||
```task
|
||||
|
|
@ -153,7 +180,7 @@ password, no one-time password. Tests extend
|
|||
the command. Matching those names to an OpenBao role stays a metadata read
|
||||
in ops-mason.
|
||||
|
||||
Name one negative-login fixture in the T01 document (`signin-probe-negative`):
|
||||
Name one negative-login fixture in the T01 document (`tegwick`):
|
||||
a uid that is not in
|
||||
`reuse-surface-hub-writers`, is not a platform admin, and will hold a
|
||||
one-time password. Do not create that user in git.
|
||||
|
|
@ -162,25 +189,27 @@ one-time password. Do not create that user in git.
|
|||
|
||||
```task
|
||||
id: NK-WP-0051-T05
|
||||
status: wait
|
||||
status: done
|
||||
depends_on: [NK-WP-0051-T04]
|
||||
blocked_on: human
|
||||
blocking_reason: "After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb."
|
||||
priority: medium
|
||||
state_hub_task_id: "afb5816f-5657-5fc8-856f-00ce5b431939"
|
||||
```
|
||||
|
||||
The founder enrolls the factor. Enrollment is not `aal2`. A later login is
|
||||
Founder confirmed in this session (2026-10-15) that the existing account
|
||||
`tegwick` already has MFA set up, and selected it instead of creating
|
||||
`signin-probe-negative`. T05 is done on that confirmation. Founder confirmed directory membership
|
||||
is `railiance-admins` only; the attended negative-login diagnosis showed the
|
||||
same group. No directory changes were made.
|
||||
|
||||
Enrollment is not `aal2`. A later login is
|
||||
`aal2` only when that login asks for the one-time password.
|
||||
|
||||
## Hand the OpenBao proof back to its owners
|
||||
|
||||
```task
|
||||
id: NK-WP-0051-T06
|
||||
status: wait
|
||||
status: done
|
||||
depends_on: [NK-WP-0051-T01]
|
||||
blocked_on: message-from:ops-mason
|
||||
blocking_reason: "Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof."
|
||||
priority: medium
|
||||
state_hub_task_id: "86fb4a6b-6655-57c2-b166-38c18e183eb0"
|
||||
```
|
||||
|
|
@ -199,3 +228,10 @@ Ask ops-mason and railiance-platform to do four things, and no others:
|
|||
`ops-mason-survey` stays read-only. The workload policy stays off the
|
||||
admin entity. This task is done when both repos have accepted those four
|
||||
items, not when this repo edits them.
|
||||
|
||||
|
||||
Accepted live 2026-10-15: CCR-2026-0045 applied, overlay deployed/verified,
|
||||
and both MASON-WP-0012-T04 proofs passed. The [contract evidence](../docs/sign-in-diagnosis.md#attended-acceptance--2026-10-15)
|
||||
records the attended principal, group and assurance observations and native
|
||||
receipt references. The pre-existing RPF-WP-0057-T04 retains separate UI
|
||||
control clickthrough; no such browser interaction is claimed here.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue