diff --git a/builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml b/builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml index 9b052ad..768db8c 100644 --- a/builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml +++ b/builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml @@ -19,7 +19,14 @@ review: required_approvers: - platform-operator - reuse-surface-owner - comments: [] + comments: + - at: '2026-10-14T16:40:00Z' + reviewer: railiance-platform + decision: filed_proposed + comment: 'Filed as CCR-2026-0044 in railiance-platform 88b4aed. This file + remains the ops-mason source copy. Apply the platform CCR, not a second + write from this draft. bound_claims_confirmed stays false until the + founder creates LLDAP group reuse-surface-hub-writers (key-cape b0ec5f8e).' target: domain: financials tenant: reuse diff --git a/docs/reuse-surface-hub-writer-attended.md b/docs/reuse-surface-hub-writer-attended.md index a8b9774..2412fca 100644 --- a/docs/reuse-surface-hub-writer-attended.md +++ b/docs/reuse-surface-hub-writer-attended.md @@ -3,9 +3,12 @@ Plan: `plans/reuse-surface-hub-writer.md`. Draft CCR: `builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`. -Run this only after the founder has applied the role and key-cape has -confirmed group `reuse-surface-hub-writers`. The member must not be OpenBao -entity `4a1f663c-0621-0483-edd0-f852274f4b6b`. +Run this only after CCR-2026-0044 is approved and applied, and after the +founder has created LLDAP group `reuse-surface-hub-writers` in the admin UI +at `lldap.coulomb.social`. key-cape does not create that group from the repo, +and `net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` does not create it +either. The member must not be OpenBao entity +`4a1f663c-0621-0483-edd0-f852274f4b6b`. The script leaves `~/.vault-token` in place and uses it only to call `sys/capabilities`. The lane token is not printed and is revoked before the diff --git a/manifests/custody-descriptions.yaml b/manifests/custody-descriptions.yaml index b1853d4..9fd3dc1 100644 --- a/manifests/custody-descriptions.yaml +++ b/manifests/custody-descriptions.yaml @@ -488,7 +488,8 @@ platform/workloads/reuse/reuse-surface/runtime-secrets: sources: - CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml - ops-warden catalog reuse-surface-hub-write-token - - ops-mason plan reuse-surface-hub-writer (MASON-WP-0011; role not applied) + - ops-mason plan reuse-surface-hub-writer (MASON-WP-0011) + - CCR-2026-0044-reuse-surface-hub-writer-caller.yaml (proposed; role not applied) used_by: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env; ClusterSecretStore openbao-reuse uses private railiance01 OpenBao and exact reuse/reuse-surface-eso Kubernetes identity. Caller-facing OIDC policy workload-kv-read-reuse-surface-runtime remains separately retained. diff --git a/plans/reuse-surface-hub-writer.md b/plans/reuse-surface-hub-writer.md index 921fb80..d498031 100644 --- a/plans/reuse-surface-hub-writer.md +++ b/plans/reuse-surface-hub-writer.md @@ -8,6 +8,7 @@ approved_by: null approved_at: null created: "2026-10-14" updated: "2026-10-14" +filed_as: CCR-2026-0044 --- # Construction plan: dedicated reuse-surface hub-writer caller @@ -164,3 +165,10 @@ Do not export the field. Revoke the lane token when the command returns. ## 6. Result Not applied. No live receipt yet. + +2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044 +(`88b4aed`, message `14e23602`). The live policy file stays as it was until +apply. key-cape (message `b0ec5f8e`) has no group `reuse-surface-hub-writers` +and will not create it from the repo. The founder creates that group in the +LLDAP admin UI, then names the member entity id. `bound_claims_confirmed` +stays false. diff --git a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md index 7065457..81bc99b 100644 --- a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md +++ b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md @@ -53,21 +53,42 @@ Done 2026-10-14. Plan `plans/reuse-surface-hub-writer.md` (status draft). Bundle `builds/reuse-surface-hub-writer/`. Verifier `scripts/verify-reuse-surface-hub-writer.py`. No live login and no KV read. +2026-10-14: railiance-platform filed the bundle as proposed CCR-2026-0044 +(`88b4aed`, message `14e23602`). Not approved and not applied. The live policy +file is unchanged until that apply. + ## Confirm the group and the member entity ```task id: MASON-WP-0011-T02 status: wait depends_on: [MASON-WP-0011-T01] -blocked_on: message-from:key-cape -blocking_reason: "key-cape confirms group reuse-surface-hub-writers and a member entity that is not 4a1f663c-0621-0483-edd0-f852274f4b6b and has no platform-admin or operator-custody identity policy." +blocked_on: human +blocking_reason: "Founder creates LLDAP group reuse-surface-hub-writers in the admin UI and names a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b with no platform-admin or operator-custody identity policy. key-cape b0ec5f8e: no directory record, and this path is not created from the repo." priority: high state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700" ``` -Ask key-cape to create or confirm the group and to name the member entity -id without sending a credential. `bound_claims_confirmed` stays false until -that reply. railiance-platform's two approvers still have to accept the CCR. +key-cape (message `b0ec5f8e`, 2026-10-14) has no directory record for +`reuse-surface-hub-writers` and did not create one. Live membership is an +attended directory change. The maintenance helper in +`net-kingdom/sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md` only creates +`net-kingdom-users`, `net-kingdom-admins` and `activity-core-operators`, and +its membership command refuses to create a group. The precedent is +`fluid-telegram-operators`: the founder creates the group in the LLDAP admin +UI at `lldap.coulomb.social`. + +Founder steps, with no secret in the reply: + +1. Create group `reuse-surface-hub-writers`. +2. Add one member who can pass aal2. `tegwick` is the precedent for a + non-admin attended operator. The member's OpenBao entity must not be + `4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin` + or `operator-custody`. +3. Reply with the group name and the member entity id only. + +`bound_claims_confirmed` stays false until that reply. CCR-2026-0044 stays +proposed until platform-operator and reuse-surface-owner approve. ## Apply the role without a KV write @@ -76,14 +97,16 @@ id: MASON-WP-0011-T03 status: wait depends_on: [MASON-WP-0011-T02] blocked_on: human -blocking_reason: "After T02. Founder applies the CCR through the delegated applier. No bao kv put. Do not attach the policy to the admin entity." +blocking_reason: "After T02. Founder applies proposed CCR-2026-0044 through the delegated applier. No bao kv put. Do not attach the policy to the admin entity." priority: high state_hub_task_id: "7c32e273-e7a0-5626-96cd-ecf4bc326df2" ``` -railiance-platform assigns the real CCR id, copies the policy file over the -existing `workload-kv-read-reuse-surface-runtime` policy, and applies the -role. The KV value is already present under CCR-2026-0005. +CCR-2026-0044 is the filed request (railiance-platform `88b4aed`). Apply +copies the policy file over the existing +`workload-kv-read-reuse-surface-runtime` policy and writes the role. That +apply is what adds lookup-self and revoke-self. The KV value is already +present under CCR-2026-0005. ## Record the sanitized receipt