coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record bernd.worsch-3 and the group-ensure route.

Browse source 
The hub-writer group exists and its member has no second factor yet. Service-access groups are created by identity-provisioner POST /v1/groups/ensure; that pointer is now on the ops-mason reuse-surface capability.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 19:05:33 +02:00
parent 58fb21fa65
commit 100558696f
5 changed files with 92 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

47
docs/directory-group-binding.md Normal file
View file

@ -0,0 +1,47 @@
# Directory group binding for a construction plan
A construction plan that needs an LLDAP group does not create it in ops-mason,
and user-engine does not create it either. user-engine owns account journeys
and factor enrollment. The group writer is net-kingdom's identity-provisioner.
## The automatic path
`POST /v1/groups/ensure` on identity-provisioner
(`net-kingdom/identity-provisioner/provisioner.py`, `ensure_service_groups`).
The matching rollback is `POST /v1/groups/revoke`. Both require the
provisioner's own bearer token and are reached inside the provisioner pod.
ops-warden does not publish a caller route for this: `identity-provisioner-groups`
was dropped (WARDEN-WP-0044, R8) because that token is user-engine's runtime
token and the pod network only admits user-engine.
The request names `groups`, `members`, `idempotency_key` and `correlation_id`.
The call creates a missing service-access group and adds the listed users. It
does not remove other members, and it does not create users. A group name
matches `[a-z][a-z0-9-]{1,62}` and must not start with `tenant`,
`netkingdom-`, `net-kingdom-` or `lldap_`. A username must already exist and
match `[a-z][a-z0-9._-]{0,31}`. `reuse-surface-hub-writers` and
`bernd.worsch-3` fit those shapes.
The SecurityCaseType `oidc-browser-relying-party` calls this `ensure-groups`,
attended, in the register-client session. There is no `identity-provisioner
groups ensure` command in the provisioner tree; the workplan text names that
shape, and the code is the HTTP path above.
## What this path does not do
- It does not enroll a second factor. `aal2` is a KeyCape claim on one login
(`/assurance/level`), set only when that login verified MFA. Enrollment is
privacyIDEA self-service at `https://pink-account.coulomb.social/`, realm
`coulomb` (user-engine `docs/mfa-attended-run.md`).
- It does not choose the OpenBao entity. Entity policies such as
`platform-admin` still have to be checked on the login token.
- `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` is the narrower
bootstrap helper. It creates only `net-kingdom-users`, `net-kingdom-admins`
and `activity-core-operators`, and its membership command requires the group
to exist already.
## Reuse-surface
ops-mason records the pointer on `capability.security.structure-construction`.
The implementation owner is net-kingdom. A later owner entry can name
`POST /v1/groups/ensure` directly; until then this page is the consumer route.

12
docs/reuse-surface-hub-writer-attended.md
View file

@ -6,11 +6,13 @@ Plan: `plans/reuse-surface-hub-writer.md`. Filed request:
`builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`.
Run this only after CCR-2026-0044 is approved and applied, and after the
founder has created LLDAP group `reuse-surface-hub-writers` in the admin UI
at `lldap.coulomb.social`. key-cape does not create that group from the repo,
and `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` does not create it
either. The member must not be OpenBao entity
`4a1f663c-0621-0483-edd0-f852274f4b6b`.
founder has created LLDAP group `reuse-surface-hub-writers` with member
`bernd.worsch-3`. That user still has to enroll a second factor at
`https://pink-account.coulomb.social/` before `member` can pass: the role
requires `/assurance/level=aal2`. The member must not be OpenBao entity
`4a1f663c-0621-0483-edd0-f852274f4b6b`. Later groups of this shape go through
identity-provisioner `POST /v1/groups/ensure`; see
`docs/directory-group-binding.md`.
The script leaves `~/.vault-token` in place and uses it only to call
`sys/capabilities`. The lane token is not printed and is revoked before the

8
plans/reuse-surface-hub-writer.md
View file

@ -168,7 +168,7 @@ Not applied. No live receipt yet.
2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044
(`88b4aed`, message `14e23602`). The live policy file stays as it was until
apply. key-cape (message `b0ec5f8e`) has no group `reuse-surface-hub-writers`
and will not create it from the repo. The founder creates that group in the
LLDAP admin UI, then names the member entity id. `bound_claims_confirmed`
stays false.
apply. The founder created LLDAP group `reuse-surface-hub-writers` with
member `bernd.worsch-3`. That user has no second factor, so the `aal2` bound
claim cannot succeed yet. `tegwick` is not the member. The OpenBao entity id
is still unrecorded. `bound_claims_confirmed` stays false.

18
registry/capabilities/capability.security.structure-construction.md
View file

@ -40,6 +40,9 @@ discovery:
- Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply
excludes:
- Founder plan gate is an explicit exception; not full PDP conformance
- Creating LLDAP groups or enrolling MFA. Service-access groups are
identity-provisioner POST /v1/groups/ensure. Second-factor enrollment is
user-engine / privacyIDEA.
use_cases:
- 'U01: Architect composes a security deployment from explicit owner contracts and
case types'
@ -53,6 +56,7 @@ availability:
current_artifacts:
- SCOPE.md
- docs/construction-plan-format.md
- docs/directory-group-binding.md
consumption_modes:
- CLI
- source
@ -61,10 +65,12 @@ relations:
- capability.security.credential-lifecycle
- capability.security.iam-tooling-suite
- capability.railiance.platform-services
- capability.identity.user-engine
evidence:
documentation:
- SCOPE.md
- docs/construction-plan-format.md
- docs/directory-group-binding.md
consumer_guidance:
recommended_for:
- Architect composes a security deployment from explicit owner contracts and case
@ -77,6 +83,7 @@ consumer_guidance:
- Founder plan gate is an explicit exception; not full PDP conformance
known_limitations:
- Founder plan gate is an explicit exception; not full PDP conformance
- Directory groups are not created here. See docs/directory-group-binding.md.
- 2026-10-14 architecture review estimates operational maturity separately; a registry
entry does not authorize execution or establish deployment.
---
@ -99,5 +106,16 @@ Founder plan gate is an explicit exception; not full PDP conformance.
- [SCOPE.md](../../SCOPE.md)
- [docs/construction-plan-format.md](../../docs/construction-plan-format.md)
- [docs/directory-group-binding.md](../../docs/directory-group-binding.md)
## Service-access groups
ops-mason names the group in the plan. net-kingdom identity-provisioner creates
it with `POST /v1/groups/ensure` inside the provisioner pod. user-engine does
not write LLDAP groups; it is the account and MFA journey, including TOTP
enrollment at `https://pink-account.coulomb.social/`. The call does not enroll
a factor and does not attach OpenBao policies. Reserved prefixes
`tenant`, `netkingdom-`, `net-kingdom-` and `lldap_` are refused. Details:
[docs/directory-group-binding.md](../../docs/directory-group-binding.md).
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

35
workplans/MASON-WP-0011-reuse-surface-hub-writer.md
View file

@ -64,31 +64,28 @@ id: MASON-WP-0011-T02
status: wait
depends_on: [MASON-WP-0011-T01]
blocked_on: human
blocking_reason: "Founder creates LLDAP group reuse-surface-hub-writers in the admin UI and names a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b with no platform-admin or operator-custody identity policy. key-cape b0ec5f8e: no directory record, and this path is not created from the repo."
blocking_reason: "Group reuse-surface-hub-writers exists; member is bernd.worsch-3. That user has no second factor, so the role's aal2 login cannot pass yet. OpenBao entity id is still unrecorded and must not be 4a1f663c-0621-0483-edd0-f852274f4b6b."
priority: high
state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700"
```
key-cape (message `b0ec5f8e`, 2026-10-14) has no directory record for
`reuse-surface-hub-writers` and did not create one. Live membership is an
attended directory change. The maintenance helper in
`net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` only creates
`net-kingdom-users`, `net-kingdom-admins` and `activity-core-operators`, and
its membership command refuses to create a group. The precedent is
`fluid-telegram-operators`: the founder creates the group in the LLDAP admin
UI at `lldap.coulomb.social`.
key-cape (message `b0ec5f8e`, 2026-10-14) had no directory record and did
not create one from the repo. The founder then created LLDAP group
`reuse-surface-hub-writers` and added `bernd.worsch-3`. `tegwick` is not the
member. `bernd.worsch-3` has no second factor yet, so a login cannot carry
`/assurance/level=aal2`. Enrollment is privacyIDEA self-service at
`https://pink-account.coulomb.social/`, realm `coulomb`. The OpenBao entity
id is still unrecorded. It must not be
`4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin`
or `operator-custody`.
Founder steps, with no secret in the reply:
The automatic group path is identity-provisioner `POST /v1/groups/ensure`,
not user-engine and not ops-mason. See `docs/directory-group-binding.md`.
The LLDAP maintenance helper does not create this group name.
1. Create group `reuse-surface-hub-writers`.
2. Add one member who can pass aal2. `tegwick` is the precedent for a
non-admin attended operator. The member's OpenBao entity must not be
`4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin`
or `operator-custody`.
3. Reply with the group name and the member entity id only.
`bound_claims_confirmed` stays false until that reply. CCR-2026-0044 stays
proposed until platform-operator and reuse-surface-owner approve.
`bound_claims_confirmed` stays false until the member entity is checked.
CCR-2026-0044 stays proposed until platform-operator and reuse-surface-owner
approve.
## Apply the role without a KV write