From c54193ae24c0644f90cf9fc5dfabca5a774be816 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 19:24:14 +0200 Subject: [PATCH] Record the second factor on bernd.worsch-3. The hub-writer member has enrolled MFA. T02 still waits on the OpenBao entity id before bound_claims_confirmed can move. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6 --- .custodian-brief.md | 4 ++-- docs/reuse-surface-hub-writer-attended.md | 12 ++++++------ plans/reuse-surface-hub-writer.md | 7 ++++--- workplans/MASON-WP-0011-reuse-surface-hub-writer.md | 11 ++++++----- 4 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 7935006..3b07eb2 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — ops-mason **Domain:** infotech -**Last synced:** 2026-10-14 16:46 UTC +**Last synced:** 2026-10-14 17:06 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -12,7 +12,7 @@ Progress: 1/4 done | workplan_id: `08e52353-b6e5-5742-b7b4-080d51a0cf57` **Open tasks:** - ! Confirm the group and the member entity `9863b4b8` - *(wait: Founder creates LLDAP group reuse-surface-hub-writers in the admin UI and names a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b with no platform-admin or operator-custody identity policy. key-cape b0ec5f8e: no directory record, and this path is not created from the repo.)* + *(wait: Group reuse-surface-hub-writers exists; member is bernd.worsch-3. That user has no second factor, so the role's aal2 login cannot pass yet. OpenBao entity id is still unrecorded and must not be 4a1f663c-0621-0483-edd0-f852274f4b6b.)* - ! Apply the role without a KV write `7c32e273` *(wait: After T02. Founder applies proposed CCR-2026-0044 through the delegated applier. No bao kv put. Do not attach the policy to the admin entity.)* - ! Record the sanitized receipt `9e12db29` diff --git a/docs/reuse-surface-hub-writer-attended.md b/docs/reuse-surface-hub-writer-attended.md index e2a8e0e..e49db7c 100644 --- a/docs/reuse-surface-hub-writer-attended.md +++ b/docs/reuse-surface-hub-writer-attended.md @@ -5,12 +5,12 @@ Plan: `plans/reuse-surface-hub-writer.md`. Filed request: (proposed). Source copy: `builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`. -Run this only after CCR-2026-0044 is approved and applied, and after the -founder has created LLDAP group `reuse-surface-hub-writers` with member -`bernd.worsch-3`. That user still has to enroll a second factor at -`https://pink-account.coulomb.social/` before `member` can pass: the role -requires `/assurance/level=aal2`. The member must not be OpenBao entity -`4a1f663c-0621-0483-edd0-f852274f4b6b`. Later groups of this shape go through +Run this only after CCR-2026-0044 is approved and applied. LLDAP group +`reuse-surface-hub-writers` exists with member `bernd.worsch-3`, and that +user enrolled a second factor on 2026-10-14. `member` still has to be a +login that KeyCape marks `/assurance/level=aal2`. The member must not be +OpenBao entity `4a1f663c-0621-0483-edd0-f852274f4b6b`. Later groups of this +shape go through identity-provisioner `POST /v1/groups/ensure`; see `docs/directory-group-binding.md`. diff --git a/plans/reuse-surface-hub-writer.md b/plans/reuse-surface-hub-writer.md index 9b19ff2..d9954d5 100644 --- a/plans/reuse-surface-hub-writer.md +++ b/plans/reuse-surface-hub-writer.md @@ -169,6 +169,7 @@ Not applied. No live receipt yet. 2026-10-14: railiance-platform filed this bundle as proposed CCR-2026-0044 (`88b4aed`, message `14e23602`). The live policy file stays as it was until apply. The founder created LLDAP group `reuse-surface-hub-writers` with -member `bernd.worsch-3`. That user has no second factor, so the `aal2` bound -claim cannot succeed yet. `tegwick` is not the member. The OpenBao entity id -is still unrecorded. `bound_claims_confirmed` stays false. +member `bernd.worsch-3`. On 2026-10-14 that user enrolled a second factor. +`tegwick` is not the member. The OpenBao entity id is still unrecorded, so +`bound_claims_confirmed` stays false. A passing login still has to present +`/assurance/level=aal2`. diff --git a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md index 59a2260..af46d17 100644 --- a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md +++ b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md @@ -64,7 +64,7 @@ id: MASON-WP-0011-T02 status: wait depends_on: [MASON-WP-0011-T01] blocked_on: human -blocking_reason: "Group reuse-surface-hub-writers exists; member is bernd.worsch-3. That user has no second factor, so the role's aal2 login cannot pass yet. OpenBao entity id is still unrecorded and must not be 4a1f663c-0621-0483-edd0-f852274f4b6b." +blocking_reason: "Group reuse-surface-hub-writers exists; member is bernd.worsch-3, and that user has a second factor (founder, 2026-10-14). OpenBao entity id is still unrecorded and must not be 4a1f663c-0621-0483-edd0-f852274f4b6b. bound_claims_confirmed stays false until that check." priority: high state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700" ``` @@ -72,10 +72,11 @@ state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700" key-cape (message `b0ec5f8e`, 2026-10-14) had no directory record and did not create one from the repo. The founder then created LLDAP group `reuse-surface-hub-writers` and added `bernd.worsch-3`. `tegwick` is not the -member. `bernd.worsch-3` has no second factor yet, so a login cannot carry -`/assurance/level=aal2`. Enrollment is privacyIDEA self-service at -`https://pink-account.coulomb.social/`, realm `coulomb`. The OpenBao entity -id is still unrecorded. It must not be +member. On 2026-10-14 the founder enrolled a second factor for +`bernd.worsch-3` at privacyIDEA self-service +(`https://pink-account.coulomb.social/`, realm `coulomb`). A later login can +carry `/assurance/level=aal2` only when that login is challenged for the +factor. The OpenBao entity id is still unrecorded. It must not be `4a1f663c-0621-0483-edd0-f852274f4b6b` and must not carry `platform-admin` or `operator-custody`.