Complete NK-WP-0051 with attended member and refusal evidence

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json

@@ -0,0 +1,64 @@
+{
+  "workplan": "NK-WP-0051",
+  "date": "2026-10-15",
+  "result": "pass",
+  "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
+  "admin": {
+    "uid": "platform-root",
+    "groups": [
+      "activity-core-operators",
+      "net-kingdom-admins",
+      "net-kingdom-users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "contained_session_exit": 0,
+    "ccr": "CCR-2026-0045",
+    "ccr_status": "applied"
+  },
+  "member": {
+    "uid": "bernd.worsch-3",
+    "groups": [
+      "reuse-surface-hub-writers",
+      "tenant:trial:demo-company:users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "accepted",
+    "revoked": true
+  },
+  "non_member": {
+    "uid": "tegwick",
+    "groups": [
+      "railiance-admins"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "refused",
+    "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
+  },
+  "overlay": {
+    "apply": "passed",
+    "verify": "passed after transient connection reset during gateway rollout",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
+  },
+  "verification": {
+    "directory_helper": "68 passed",
+    "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
+    "ccr_0045_validate": "passed",
+    "ccr_0045_dry_run": "passed; no warnings"
+  },
+  "limits": [
+    "No KV secret values read",
+    "User diagnosis values are founder observations, not independently captured browser evidence",
+    "No independent live platform-admin entity-policy inventory performed",
+    "No changes to directory memberships, admin entity policy, or ops-mason-survey"
+  ],
+  "receipts": {
+    "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
+    "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
+  }
+}

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt

@@ -0,0 +1,21 @@
+mode=member
+at=2026-10-15T17:16:54Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=bernd.worsch-3
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=ok
+openbao_error=
+entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
+policies=workload-kv-read-reuse-surface-runtime
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/data/workloads/reuse/reuse-surface: deny
+platform/metadata/workloads/reuse/reuse-surface: deny
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
+revoked=yes
+result=pass

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt

@@ -0,0 +1,21 @@
+mode=non-member
+at=2026-10-15T17:20:11Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=tegwick
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=refused
+openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
+entity_id=
+policies=
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/data/workloads/reuse/reuse-surface: not-run
+platform/metadata/workloads/reuse/reuse-surface: not-run
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
+revoked=n/a
+result=pass

docs/sign-in-diagnosis.md

@@ -51,15 +51,21 @@ Matching `groups` to an OpenBao role stays a metadata read in ops-mason.
 
 ## Negative-login fixture
 
-Fixture uid: `signin-probe-negative`.
+Fixture uid: `tegwick` (selected by the founder on 2026-10-15).
+Founder confirmed existing MFA enrollment and directory membership of
+`railiance-admins` only. The attended diagnosis independently of the directory
+preview showed that same group list and `aal2` before OpenBao refused the
+workload login. This replaces the original
+proposed fixture `signin-probe-negative`.
 
 - not a member of `reuse-surface-hub-writers`
 - not a platform admin (`net-kingdom-admins`)
-- holds a one-time password (enrolled by the founder in NK-WP-0051-T05 at
+- holds a one-time password (existing MFA confirmed by the founder for
-  `https://pink-account.coulomb.social/`, realm `coulomb`)
+  NK-WP-0051-T05; factor management at `https://pink-account.coulomb.social/`,
+  realm `coulomb`)
 
 The user is never created or described with credentials in git. A
-successful diagnosis of this fixture shows `uid=signin-probe-negative`,
+successful diagnosis of this fixture shows `uid=tegwick`,
 groups without `reuse-surface-hub-writers`, `assurance=aal2`, and then the
 OpenBao groups refusal.
 
@@ -69,5 +75,30 @@ OpenBao groups refusal.
 | --- | --- |
 | key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 → 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed |
 | user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root · aal2` and Authelia `platform-root` |
-| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
+| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); both attended proofs passed 2026-10-15, member token revoked. [Receipts](evidence/2026-10-15-sign-in-diagnosis/acceptance.json) |
-| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |
+| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approved by founder for both requested roles and applied through contained admin session (exit 0). Overlay deployed and `make openbao-verify-login-overlay` passed. Separate UI button clickthrough remains RPF-WP-0057-T04 |
+
+## Attended acceptance — 2026-10-15
+
+Both native verifier receipts passed. The founder observed the diagnosis
+before continuing each login and confirmed the resulting OpenBao response:
+
+| Login | Diagnosis | OpenBao result |
+| --- | --- | --- |
+| Admin apply | `platform-root`, includes `net-kingdom-admins`, `aal2` | Accepted; CCR-2026-0045 applied; contained session exited 0 |
+| Member proof | `bernd.worsch-3`, includes `reuse-surface-hub-writers`, `aal2` | Accepted; exact workload policy, intended reads, parent/sibling denials, token revoked |
+| Negative proof | `tegwick`, `railiance-admins` only, `aal2` | Refused: `claim "groups" does not match any associated bound claim values` |
+
+[Acceptance record and receipt digests](evidence/2026-10-15-sign-in-diagnosis/acceptance.json),
+[member receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt),
+[negative receipt](evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt).
+The receipts contain no token or KV value; callback codes are redacted.
+The negative receipt names `tegwick` and preserves OpenBao's refusal text.
+The uid and assurance receipt inputs are corroborated by the founder's
+observations for those exact requests; CLI arguments alone are not evidence.
+
+The approved login overlay is deployed and its HTTP verification passes.
+Direct browser exercise of its role-selection controls remains in the existing
+owner task RPF-WP-0057-T04; native attended OIDC logins exercised both roles.
+NK-WP-0051's attended diagnosis/refusal goal is met. No group memberships,
+admin entity policies or survey grant were changed; no KV values were read.

sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md

@@ -76,7 +76,7 @@ To see which directory groups a login will carry (NK-WP-0051,
 [`docs/sign-in-diagnosis.md`](../../../docs/sign-in-diagnosis.md)):
 
 ```bash
-python3 lldap_admin.py groups --user signin-probe-negative \
+python3 lldap_admin.py groups --user tegwick \
   --root /absolute/private/custody
 ```
 

workplans/NK-WP-0051-sign-in-diagnosis.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Show who a workload sign-in actually is"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: codex
 topic_slug: netkingdom
@@ -57,6 +57,33 @@ Out of scope: widening `ops-mason-survey`, attaching
 of a token, authorization code, email address, or one-time password.
 Group display names and the uid are the diagnosis. They are not secret.
 
+### Completion review — 2026-10-15
+
+All six tasks are done. The founder selected existing MFA-enrolled `tegwick`
+for the negative fixture and confirmed its sole directory group is
+`railiance-admins`. Its attended diagnosis showed that uid/group and `aal2`
+before the workload role refused the groups claim; the native verifier receipt
+names the same uid and preserves the error. The member proof as `bernd.worsch-3`
+passed all capability checks and revoked its token.
+
+CCR-2026-0045 was approved by the founder in both requested roles and applied
+through a contained `platform-root` OIDC/MFA session (exit 0). The approved
+login overlay was deployed and its HTTP verification passed. The existing
+owner task RPF-WP-0057-T04 retains separate UI role-selector clickthrough;
+this does not block the completed native attended diagnosis/refusal goal.
+
+Evidence: [acceptance and sanitized receipts](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json).
+Directory-helper verification: **68 passed**. Platform checks: **64 passed,
+2 unrelated failures** (CCR-2026-0035 schema and core-hub resource-list
+expectation); CCR-2026-0045 validates and its dry-run has no warnings.
+
+Security orientation: Emergent Knowledge **0.2.6**, package digest
+`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`;
+`start` and `identity` were **withheld / orientation-only** because sources
+changed. Reviewed their source cards, current `SECURITY-COMPANION.md`, owner
+declarations and the current owner procedures directly. Retrieval grants no
+live authority.
+
 ## Write the diagnosis contract
 
 ```task
@@ -153,7 +180,7 @@ password, no one-time password. Tests extend
 the command. Matching those names to an OpenBao role stays a metadata read
 in ops-mason.
 
-Name one negative-login fixture in the T01 document (`signin-probe-negative`):
+Name one negative-login fixture in the T01 document (`tegwick`):
 a uid that is not in
 `reuse-surface-hub-writers`, is not a platform admin, and will hold a
 one-time password. Do not create that user in git.
@@ -162,25 +189,27 @@ one-time password. Do not create that user in git.
 
 ```task
 id: NK-WP-0051-T05
-status: wait
+status: done
 depends_on: [NK-WP-0051-T04]
-blocked_on: human
-blocking_reason: "After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb."
 priority: medium
 state_hub_task_id: "afb5816f-5657-5fc8-856f-00ce5b431939"
 ```
 
-The founder enrolls the factor. Enrollment is not `aal2`. A later login is
+Founder confirmed in this session (2026-10-15) that the existing account
+`tegwick` already has MFA set up, and selected it instead of creating
+`signin-probe-negative`. T05 is done on that confirmation. Founder confirmed directory membership
+is `railiance-admins` only; the attended negative-login diagnosis showed the
+same group. No directory changes were made.
+
+Enrollment is not `aal2`. A later login is
 `aal2` only when that login asks for the one-time password.
 
 ## Hand the OpenBao proof back to its owners
 
 ```task
 id: NK-WP-0051-T06
-status: wait
+status: done
 depends_on: [NK-WP-0051-T01]
-blocked_on: message-from:ops-mason
-blocking_reason: "Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof."
 priority: medium
 state_hub_task_id: "86fb4a6b-6655-57c2-b166-38c18e183eb0"
 ```
@@ -199,3 +228,10 @@ Ask ops-mason and railiance-platform to do four things, and no others:
 `ops-mason-survey` stays read-only. The workload policy stays off the
 admin entity. This task is done when both repos have accepted those four
 items, not when this repo edits them.
+
+
+Accepted live 2026-10-15: CCR-2026-0045 applied, overlay deployed/verified,
+and both MASON-WP-0012-T04 proofs passed. The [contract evidence](../docs/sign-in-diagnosis.md#attended-acceptance--2026-10-15)
+records the attended principal, group and assurance observations and native
+receipt references. The pre-existing RPF-WP-0057-T04 retains separate UI
+control clickthrough; no such browser interaction is claimed here.