From 9442858535429798a4d211806c36438208f4547e Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 15 Oct 2026 19:23:19 +0200 Subject: [PATCH] Complete NK-WP-0051 with attended member and refusal evidence Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- .../acceptance.json | 64 +++++++++++++++++++ .../reuse-surface-hub-writer-member.txt | 21 ++++++ .../reuse-surface-hub-writer-non-member.txt | 21 ++++++ docs/sign-in-diagnosis.md | 43 +++++++++++-- sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md | 2 +- workplans/NK-WP-0051-sign-in-diagnosis.md | 54 +++++++++++++--- 6 files changed, 189 insertions(+), 16 deletions(-) create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json new file mode 100644 index 0000000..886fa08 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json @@ -0,0 +1,64 @@ +{ + "workplan": "NK-WP-0051", + "date": "2026-10-15", + "result": "pass", + "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks", + "admin": { + "uid": "platform-root", + "groups": [ + "activity-core-operators", + "net-kingdom-admins", + "net-kingdom-users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "contained_session_exit": 0, + "ccr": "CCR-2026-0045", + "ccr_status": "applied" + }, + "member": { + "uid": "bernd.worsch-3", + "groups": [ + "reuse-surface-hub-writers", + "tenant:trial:demo-company:users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "accepted", + "revoked": true + }, + "non_member": { + "uid": "tegwick", + "groups": [ + "railiance-admins" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "refused", + "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values" + }, + "overlay": { + "apply": "passed", + "verify": "passed after transient connection reset during gateway rollout", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes." + }, + "verification": { + "directory_helper": "68 passed", + "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation", + "ccr_0045_validate": "passed", + "ccr_0045_dry_run": "passed; no warnings" + }, + "limits": [ + "No KV secret values read", + "User diagnosis values are founder observations, not independently captured browser evidence", + "No independent live platform-admin entity-policy inventory performed", + "No changes to directory memberships, admin entity policy, or ops-mason-survey" + ], + "receipts": { + "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328", + "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322" + } +} diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt new file mode 100644 index 0000000..d0cb1b0 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt @@ -0,0 +1,21 @@ +mode=member +at=2026-10-15T17:16:54Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=bernd.worsch-3 +uid_source=operator +assurance=aal2 +assurance_source=operator +login=ok +openbao_error= +entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94 +policies=workload-kv-read-reuse-surface-runtime +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: read +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read +platform/data/workloads/reuse/reuse-surface: deny +platform/metadata/workloads/reuse/reuse-surface: deny +platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny +revoked=yes +result=pass diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt new file mode 100644 index 0000000..44ce20f --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt @@ -0,0 +1,21 @@ +mode=non-member +at=2026-10-15T17:20:11Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=tegwick +uid_source=operator +assurance=aal2 +assurance_source=operator +login=refused +openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values +entity_id= +policies= +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/data/workloads/reuse/reuse-surface: not-run +platform/metadata/workloads/reuse/reuse-surface: not-run +platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run +revoked=n/a +result=pass diff --git a/docs/sign-in-diagnosis.md b/docs/sign-in-diagnosis.md index e5413cc..5716e18 100644 --- a/docs/sign-in-diagnosis.md +++ b/docs/sign-in-diagnosis.md @@ -51,15 +51,21 @@ Matching `groups` to an OpenBao role stays a metadata read in ops-mason. ## Negative-login fixture -Fixture uid: `signin-probe-negative`. +Fixture uid: `tegwick` (selected by the founder on 2026-10-15). +Founder confirmed existing MFA enrollment and directory membership of +`railiance-admins` only. The attended diagnosis independently of the directory +preview showed that same group list and `aal2` before OpenBao refused the +workload login. This replaces the original +proposed fixture `signin-probe-negative`. - not a member of `reuse-surface-hub-writers` - not a platform admin (`net-kingdom-admins`) -- holds a one-time password (enrolled by the founder in NK-WP-0051-T05 at - `https://pink-account.coulomb.social/`, realm `coulomb`) +- holds a one-time password (existing MFA confirmed by the founder for + NK-WP-0051-T05; factor management at `https://pink-account.coulomb.social/`, + realm `coulomb`) The user is never created or described with credentials in git. A -successful diagnosis of this fixture shows `uid=signin-probe-negative`, +successful diagnosis of this fixture shows `uid=tegwick`, groups without `reuse-surface-hub-writers`, `assurance=aal2`, and then the OpenBao groups refusal. @@ -69,5 +75,30 @@ OpenBao groups refusal. | --- | --- | | key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 โ†’ 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed | | user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root ยท aal2` and Authelia `platform-root` | -| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 | -| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 | +| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); both attended proofs passed 2026-10-15, member token revoked. [Receipts](evidence/2026-10-15-sign-in-diagnosis/acceptance.json) | +| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approved by founder for both requested roles and applied through contained admin session (exit 0). Overlay deployed and `make openbao-verify-login-overlay` passed. Separate UI button clickthrough remains RPF-WP-0057-T04 | + +## Attended acceptance โ€” 2026-10-15 + +Both native verifier receipts passed. The founder observed the diagnosis +before continuing each login and confirmed the resulting OpenBao response: + +| Login | Diagnosis | OpenBao result | +| --- | --- | --- | +| Admin apply | `platform-root`, includes `net-kingdom-admins`, `aal2` | Accepted; CCR-2026-0045 applied; contained session exited 0 | +| Member proof | `bernd.worsch-3`, includes `reuse-surface-hub-writers`, `aal2` | Accepted; exact workload policy, intended reads, parent/sibling denials, token revoked | +| Negative proof | `tegwick`, `railiance-admins` only, `aal2` | Refused: `claim "groups" does not match any associated bound claim values` | + +[Acceptance record and receipt digests](evidence/2026-10-15-sign-in-diagnosis/acceptance.json), +[member receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt), +[negative receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt). +The receipts contain no token or KV value; callback codes are redacted. +The negative receipt names `tegwick` and preserves OpenBao's refusal text. +The uid and assurance receipt inputs are corroborated by the founder's +observations for those exact requests; CLI arguments alone are not evidence. + +The approved login overlay is deployed and its HTTP verification passes. +Direct browser exercise of its role-selection controls remains in the existing +owner task RPF-WP-0057-T04; native attended OIDC logins exercised both roles. +NK-WP-0051's attended diagnosis/refusal goal is met. No group memberships, +admin entity policies or survey grant were changed; no KV values were read. diff --git a/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md b/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md index 5bb9be2..7698f99 100644 --- a/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md +++ b/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md @@ -76,7 +76,7 @@ To see which directory groups a login will carry (NK-WP-0051, [`docs/sign-in-diagnosis.md`](../../../docs/sign-in-diagnosis.md)): ```bash -python3 lldap_admin.py groups --user signin-probe-negative \ +python3 lldap_admin.py groups --user tegwick \ --root /absolute/private/custody ``` diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md index e22ab88..5844807 100644 --- a/workplans/NK-WP-0051-sign-in-diagnosis.md +++ b/workplans/NK-WP-0051-sign-in-diagnosis.md @@ -4,7 +4,7 @@ type: workplan title: "Show who a workload sign-in actually is" domain: infotech repo: net-kingdom -status: active +status: finished flavor: implementation owner: codex topic_slug: netkingdom @@ -57,6 +57,33 @@ Out of scope: widening `ops-mason-survey`, attaching of a token, authorization code, email address, or one-time password. Group display names and the uid are the diagnosis. They are not secret. +### Completion review โ€” 2026-10-15 + +All six tasks are done. The founder selected existing MFA-enrolled `tegwick` +for the negative fixture and confirmed its sole directory group is +`railiance-admins`. Its attended diagnosis showed that uid/group and `aal2` +before the workload role refused the groups claim; the native verifier receipt +names the same uid and preserves the error. The member proof as `bernd.worsch-3` +passed all capability checks and revoked its token. + +CCR-2026-0045 was approved by the founder in both requested roles and applied +through a contained `platform-root` OIDC/MFA session (exit 0). The approved +login overlay was deployed and its HTTP verification passed. The existing +owner task RPF-WP-0057-T04 retains separate UI role-selector clickthrough; +this does not block the completed native attended diagnosis/refusal goal. + +Evidence: [acceptance and sanitized receipts](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json). +Directory-helper verification: **68 passed**. Platform checks: **64 passed, +2 unrelated failures** (CCR-2026-0035 schema and core-hub resource-list +expectation); CCR-2026-0045 validates and its dry-run has no warnings. + +Security orientation: Emergent Knowledge **0.2.6**, package digest +`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`; +`start` and `identity` were **withheld / orientation-only** because sources +changed. Reviewed their source cards, current `SECURITY-COMPANION.md`, owner +declarations and the current owner procedures directly. Retrieval grants no +live authority. + ## Write the diagnosis contract ```task @@ -153,7 +180,7 @@ password, no one-time password. Tests extend the command. Matching those names to an OpenBao role stays a metadata read in ops-mason. -Name one negative-login fixture in the T01 document (`signin-probe-negative`): +Name one negative-login fixture in the T01 document (`tegwick`): a uid that is not in `reuse-surface-hub-writers`, is not a platform admin, and will hold a one-time password. Do not create that user in git. @@ -162,25 +189,27 @@ one-time password. Do not create that user in git. ```task id: NK-WP-0051-T05 -status: wait +status: done depends_on: [NK-WP-0051-T04] -blocked_on: human -blocking_reason: "After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb." priority: medium state_hub_task_id: "afb5816f-5657-5fc8-856f-00ce5b431939" ``` -The founder enrolls the factor. Enrollment is not `aal2`. A later login is +Founder confirmed in this session (2026-10-15) that the existing account +`tegwick` already has MFA set up, and selected it instead of creating +`signin-probe-negative`. T05 is done on that confirmation. Founder confirmed directory membership +is `railiance-admins` only; the attended negative-login diagnosis showed the +same group. No directory changes were made. + +Enrollment is not `aal2`. A later login is `aal2` only when that login asks for the one-time password. ## Hand the OpenBao proof back to its owners ```task id: NK-WP-0051-T06 -status: wait +status: done depends_on: [NK-WP-0051-T01] -blocked_on: message-from:ops-mason -blocking_reason: "Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof." priority: medium state_hub_task_id: "86fb4a6b-6655-57c2-b166-38c18e183eb0" ``` @@ -199,3 +228,10 @@ Ask ops-mason and railiance-platform to do four things, and no others: `ops-mason-survey` stays read-only. The workload policy stays off the admin entity. This task is done when both repos have accepted those four items, not when this repo edits them. + + +Accepted live 2026-10-15: CCR-2026-0045 applied, overlay deployed/verified, +and both MASON-WP-0012-T04 proofs passed. The [contract evidence](../docs/sign-in-diagnosis.md#attended-acceptance--2026-10-15) +records the attended principal, group and assurance observations and native +receipt references. The pre-existing RPF-WP-0057-T04 retains separate UI +control clickthrough; no such browser interaction is claimed here.