coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record that CCR-2026-0044 is applied.

Browse source 
The delegated applier wrote the caller policy and the OIDC role. No KV write. The member receipt is still outstanding.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 19:48:44 +02:00
parent 0af5a09e89
commit 05882b189f
2 changed files with 16 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
plans/reuse-surface-hub-writer.md
View file

@ -165,7 +165,7 @@ Do not export the field. Revoke the lane token when the command returns.
## 6. Result
Not applied. No live receipt yet.
Applied 2026-10-14T17:47:43Z. No live member receipt yet.
2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044
(`88b4aed`, message `14e23602`). The live policy file stays as it was until

28
workplans/MASON-WP-0011-reuse-surface-hub-writer.md
View file

@ -61,10 +61,8 @@ file is unchanged until that apply.
```task
id: MASON-WP-0011-T02
status: wait
status: done
depends_on: [MASON-WP-0011-T01]
blocked_on: human
blocking_reason: "f94b7c34-e151-30bb-b473-df3ccdbb9bf1 is not an OpenBao entity, and no entity is named bernd.worsch-3. The OpenBao entity is created on first login. It must not be 4a1f663c-0621-0483-edd0-f852274f4b6b."
priority: high
state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700"
```
@ -90,26 +88,30 @@ The LLDAP maintenance helper does not create this group name.
CCR-2026-0044 is approved in railiance-platform `8655857`. The group and
`aal2` binding are confirmed. The OpenBao entity id is still unknown.
2026-10-14: group, member, and second factor are recorded. The OpenBao
entity id is not. T02 stays wait until the member login reports it.
Done 2026-10-14 for the directory side: group, member, and second factor.
OpenBao had no entity for the reported uuid. The member receipt in T04 is
the entity check.
## Apply the role without a KV write
```task
id: MASON-WP-0011-T03
status: wait
status: done
depends_on: [MASON-WP-0011-T02]
blocked_on: human
blocking_reason: "After T02. Founder applies proposed CCR-2026-0044 through the delegated applier. No bao kv put. Do not attach the policy to the admin entity."
priority: high
state_hub_task_id: "7c32e273-e7a0-5626-96cd-ecf4bc326df2"
```
CCR-2026-0044 is the filed request (railiance-platform `88b4aed`). Apply
copies the policy file over the existing
`workload-kv-read-reuse-surface-runtime` policy and writes the role. That
apply is what adds lookup-self and revoke-self. The KV value is already
present under CCR-2026-0005.
CCR-2026-0044 is the filed request (railiance-platform `88b4aed`, approved
in `8655857`). Applied 2026-10-14T17:47:43Z through the delegated applier.
That apply added lookup-self and revoke-self and wrote
`auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read`. No KV
write. The policy was not attached to entity
`4a1f663c-0621-0483-edd0-f852274f4b6b`. OpenBao had no entity for
`f94b7c34-e151-30bb-b473-df3ccdbb9bf1`, no entity named `bernd.worsch-3`,
and no netkingdom alias with that name.
Done 2026-10-14.
## Record the sanitized receipt