coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the passing hub-writer receipts.

Browse source 
Member and non-member verification both passed. The verifier accepts s. tokens and calls sys/capabilities with a token that is allowed to.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 22:14:32 +02:00
parent 05882b189f
commit 97d1fed949
7 changed files with 116 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/MASON-WP-0011-reuse-surface-hub-writer.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Name a dedicated caller for the reuse-surface hub writer token"
domain: infotech
repo: ops-mason
status: active
status: finished
flavor: planning
owner: codex
topic_slug: custodian
@ -117,15 +117,20 @@ Done 2026-10-14.
```task
id: MASON-WP-0011-T04
status: wait
status: done
depends_on: [MASON-WP-0011-T03]
blocked_on: human
blocking_reason: "After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet."
priority: high
state_hub_task_id: "9e12db29-532d-5d90-8519-227799018ab0"
```
Both modes must pass. Copy the mode-0600 receipts into `docs/evidence/`
with no token and no field value, reply to message `08b254af`, and tell
ops-warden the role name for `auth_method`. Hub registration itself stays
Both modes passed on 2026-10-14. Member receipt at 20:05:45Z: login ok,
entity `c204099b-cb94-363f-e207-5ff4d4aa6e94`, policy
`workload-kv-read-reuse-surface-runtime` only, exact paths read, parent and
sibling paths deny, token revoked. Non-member receipt at 20:10:49Z:
login refused. Copies with no token are
`docs/evidence/2026-10-14-reuse-surface-hub-writer-member.txt` and
`docs/evidence/2026-10-14-reuse-surface-hub-writer-non-member.txt`.
Replied to message `08b254af`. ops-warden can name role
`reuse-surface-hub-writer-workload-kv-read` on
`auth_method` for `reuse-surface-hub-write-token`. Hub registration stays
with the-custodian.