coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record CCR-2026-0044 and the founder group step.

Browse source 
railiance-platform filed the hub-writer caller as proposed and did not apply it. key-cape has no reuse-surface-hub-writers group; the founder creates it in the LLDAP admin UI before the role can be bound.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 18:44:56 +02:00
parent 8bd6b249d5
commit 772e906fad
5 changed files with 56 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

9
builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml
View file

@ -19,7 +19,14 @@ review:
required_approvers:
- platform-operator
- reuse-surface-owner
comments: []
comments:
- at: '2026-10-14T16:40:00Z'
reviewer: railiance-platform
decision: filed_proposed
comment: 'Filed as CCR-2026-0044 in railiance-platform 88b4aed. This file
remains the ops-mason source copy. Apply the platform CCR, not a second
write from this draft. bound_claims_confirmed stays false until the
founder creates LLDAP group reuse-surface-hub-writers (key-cape b0ec5f8e).'
target:
domain: financials
tenant: reuse

9
docs/reuse-surface-hub-writer-attended.md
View file

@ -3,9 +3,12 @@
Plan: `plans/reuse-surface-hub-writer.md`. Draft CCR:
`builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`.
Run this only after the founder has applied the role and key-cape has
confirmed group `reuse-surface-hub-writers`. The member must not be OpenBao
entity `4a1f663c-0621-0483-edd0-f852274f4b6b`.
Run this only after CCR-2026-0044 is approved and applied, and after the
founder has created LLDAP group `reuse-surface-hub-writers` in the admin UI
at `lldap.coulomb.social`. key-cape does not create that group from the repo,
and `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` does not create it
either. The member must not be OpenBao entity
`4a1f663c-0621-0483-edd0-f852274f4b6b`.
The script leaves `~/.vault-token` in place and uses it only to call
`sys/capabilities`. The lane token is not printed and is revoked before the

3
manifests/custody-descriptions.yaml
View file

@ -488,7 +488,8 @@ platform/workloads/reuse/reuse-surface/runtime-secrets:
sources:
- CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml
- ops-warden catalog reuse-surface-hub-write-token
- ops-mason plan reuse-surface-hub-writer (MASON-WP-0011; role not applied)
- ops-mason plan reuse-surface-hub-writer (MASON-WP-0011)
- CCR-2026-0044-reuse-surface-hub-writer-caller.yaml (proposed; role not applied)
used_by: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env; ClusterSecretStore
openbao-reuse uses private railiance01 OpenBao and exact reuse/reuse-surface-eso Kubernetes identity.
Caller-facing OIDC policy workload-kv-read-reuse-surface-runtime remains separately retained.

8
plans/reuse-surface-hub-writer.md
View file

@ -8,6 +8,7 @@ approved_by: null
approved_at: null
created: "2026-10-14"
updated: "2026-10-14"
filed_as: CCR-2026-0044
---
# Construction plan: dedicated reuse-surface hub-writer caller
@ -164,3 +165,10 @@ Do not export the field. Revoke the lane token when the command returns.
## 6. Result
Not applied. No live receipt yet.
2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044
(`88b4aed`, message `14e23602`). The live policy file stays as it was until
apply. key-cape (message `b0ec5f8e`) has no group `reuse-surface-hub-writers`
and will not create it from the repo. The founder creates that group in the
LLDAP admin UI, then names the member entity id. `bound_claims_confirmed`
stays false.

41
workplans/MASON-WP-0011-reuse-surface-hub-writer.md
View file

@ -53,21 +53,42 @@ Done 2026-10-14. Plan `plans/reuse-surface-hub-writer.md` (status draft).
Bundle `builds/reuse-surface-hub-writer/`. Verifier
`scripts/verify-reuse-surface-hub-writer.py`. No live login and no KV read.
2026-10-14: railiance-platform filed the bundle as proposed CCR-2026-0044
(`88b4aed`, message `14e23602`). Not approved and not applied. The live policy
file is unchanged until that apply.
## Confirm the group and the member entity
```task
id: MASON-WP-0011-T02
status: wait
depends_on: [MASON-WP-0011-T01]
blocked_on: message-from:key-cape
blocking_reason: "key-cape confirms group reuse-surface-hub-writers and a member entity that is not 4a1f663c-0621-0483-edd0-f852274f4b6b and has no platform-admin or operator-custody identity policy."
blocked_on: human
blocking_reason: "Founder creates LLDAP group reuse-surface-hub-writers in the admin UI and names a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b with no platform-admin or operator-custody identity policy. key-cape b0ec5f8e: no directory record, and this path is not created from the repo."
priority: high
state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700"
```
Ask key-cape to create or confirm the group and to name the member entity
id without sending a credential. `bound_claims_confirmed` stays false until
that reply. railiance-platform's two approvers still have to accept the CCR.
key-cape (message `b0ec5f8e`, 2026-10-14) has no directory record for
`reuse-surface-hub-writers` and did not create one. Live membership is an
attended directory change. The maintenance helper in
`net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` only creates
`net-kingdom-users`, `net-kingdom-admins` and `activity-core-operators`, and
its membership command refuses to create a group. The precedent is
`fluid-telegram-operators`: the founder creates the group in the LLDAP admin
UI at `lldap.coulomb.social`.
Founder steps, with no secret in the reply:
1. Create group `reuse-surface-hub-writers`.
2. Add one member who can pass aal2. `tegwick` is the precedent for a
non-admin attended operator. The member's OpenBao entity must not be
`4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin`
or `operator-custody`.
3. Reply with the group name and the member entity id only.
`bound_claims_confirmed` stays false until that reply. CCR-2026-0044 stays
proposed until platform-operator and reuse-surface-owner approve.
## Apply the role without a KV write
@ -76,14 +97,16 @@ id: MASON-WP-0011-T03
status: wait
depends_on: [MASON-WP-0011-T02]
blocked_on: human
blocking_reason: "After T02. Founder applies the CCR through the delegated applier. No bao kv put. Do not attach the policy to the admin entity."
blocking_reason: "After T02. Founder applies proposed CCR-2026-0044 through the delegated applier. No bao kv put. Do not attach the policy to the admin entity."
priority: high
state_hub_task_id: "7c32e273-e7a0-5626-96cd-ecf4bc326df2"
```
railiance-platform assigns the real CCR id, copies the policy file over the
existing `workload-kv-read-reuse-surface-runtime` policy, and applies the
role. The KV value is already present under CCR-2026-0005.
CCR-2026-0044 is the filed request (railiance-platform `88b4aed`). Apply
copies the policy file over the existing
`workload-kv-read-reuse-surface-runtime` policy and writes the role. That
apply is what adds lookup-self and revoke-self. The KV value is already
present under CCR-2026-0005.
## Record the sanitized receipt