coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the passing hub-writer receipts.

Browse source 
Member and non-member verification both passed. The verifier accepts s. tokens and calls sys/capabilities with a token that is allowed to.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 22:14:32 +02:00
parent 05882b189f
commit 97d1fed949
7 changed files with 116 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/evidence/2026-10-14-reuse-surface-hub-writer-member.txt Normal file
View file

@ -0,0 +1,16 @@
mode=member
at=2026-10-14T20:05:45Z
addr=http://127.0.0.1:18200
role=reuse-surface-hub-writer-workload-kv-read
policy=workload-kv-read-reuse-surface-runtime
login=ok
entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
policies=workload-kv-read-reuse-surface-runtime
identity_policies=
platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
platform/data/workloads/reuse/reuse-surface: deny
platform/metadata/workloads/reuse/reuse-surface: deny
platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
revoked=yes
result=pass

16
docs/evidence/2026-10-14-reuse-surface-hub-writer-non-member.txt Normal file
View file

@ -0,0 +1,16 @@
mode=non-member
at=2026-10-14T20:10:49Z
addr=http://127.0.0.1:18200
role=reuse-surface-hub-writer-workload-kv-read
policy=workload-kv-read-reuse-surface-runtime
login=refused
entity_id=
policies=
identity_policies=
platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
platform/data/workloads/reuse/reuse-surface: not-run
platform/metadata/workloads/reuse/reuse-surface: not-run
platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
revoked=n/a
result=pass

10
docs/reuse-surface-hub-writer-attended.md
View file

@ -2,7 +2,7 @@
Plan: `plans/reuse-surface-hub-writer.md`. Filed request:
`railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml`
(proposed). Source copy:
(applied 2026-10-14). Source copy:
`builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`.
Run this only after CCR-2026-0044 is approved and applied. LLDAP group
@ -15,9 +15,11 @@ shape go through
identity-provisioner `POST /v1/groups/ensure`; see
`docs/directory-group-binding.md`.
The script leaves `~/.vault-token` in place and uses it only to call
`sys/capabilities`. The lane token is not printed and is revoked before the
script exits. A passing receipt is the sanitized verification record.
The script leaves `~/.vault-token` in place. It calls `sys/capabilities` with
the first local token that is allowed to: `BAO_TOKEN` or `VAULT_TOKEN`, then
`~/.local/openbao/platform-admin.token`, then `~/.vault-token`. The lane token
is not printed and is revoked before the script exits. A passing receipt is
the sanitized verification record.
```bash
export BAO_ADDR=http://127.0.0.1:18200