Accept attended sign-in diagnosis caller proofs
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
b67b57a022
commit
e4761b843c
5 changed files with 131 additions and 6 deletions
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"workplan": "NK-WP-0051",
|
||||
"date": "2026-10-15",
|
||||
"result": "pass",
|
||||
"source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
|
||||
"admin": {
|
||||
"uid": "platform-root",
|
||||
"groups": [
|
||||
"activity-core-operators",
|
||||
"net-kingdom-admins",
|
||||
"net-kingdom-users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"contained_session_exit": 0,
|
||||
"ccr": "CCR-2026-0045",
|
||||
"ccr_status": "applied"
|
||||
},
|
||||
"member": {
|
||||
"uid": "bernd.worsch-3",
|
||||
"groups": [
|
||||
"reuse-surface-hub-writers",
|
||||
"tenant:trial:demo-company:users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "accepted",
|
||||
"revoked": true
|
||||
},
|
||||
"non_member": {
|
||||
"uid": "tegwick",
|
||||
"groups": [
|
||||
"railiance-admins"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "refused",
|
||||
"openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
|
||||
},
|
||||
"overlay": {
|
||||
"apply": "passed",
|
||||
"verify": "passed after transient connection reset during gateway rollout",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
|
||||
},
|
||||
"verification": {
|
||||
"directory_helper": "68 passed",
|
||||
"platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
|
||||
"ccr_0045_validate": "passed",
|
||||
"ccr_0045_dry_run": "passed; no warnings"
|
||||
},
|
||||
"limits": [
|
||||
"No KV secret values read",
|
||||
"User diagnosis values are founder observations, not independently captured browser evidence",
|
||||
"No independent live platform-admin entity-policy inventory performed",
|
||||
"No changes to directory memberships, admin entity policy, or ops-mason-survey"
|
||||
],
|
||||
"receipts": {
|
||||
"reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
|
||||
"reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=member
|
||||
at=2026-10-15T17:16:54Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=bernd.worsch-3
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=ok
|
||||
openbao_error=
|
||||
entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
|
||||
policies=workload-kv-read-reuse-surface-runtime
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/data/workloads/reuse/reuse-surface: deny
|
||||
platform/metadata/workloads/reuse/reuse-surface: deny
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
|
||||
revoked=yes
|
||||
result=pass
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=non-member
|
||||
at=2026-10-15T17:20:11Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=tegwick
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=refused
|
||||
openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
|
||||
entity_id=
|
||||
policies=
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/data/workloads/reuse/reuse-surface: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface: not-run
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
|
||||
revoked=n/a
|
||||
result=pass
|
||||
|
|
@ -38,7 +38,7 @@ role's aal2 bound claim on success. No token and no KV value is recorded.
|
|||
```bash
|
||||
export BAO_ADDR=http://127.0.0.1:18200
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid signin-probe-negative --assurance aal2
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid tegwick --assurance aal2
|
||||
```
|
||||
|
||||
`member` passes when the token's policies are exactly
|
||||
|
|
@ -52,3 +52,9 @@ recorded in `openbao_error`.
|
|||
|
||||
Do not run `bao kv get` on this path to prove the lane. Do not attach the
|
||||
workload policy to the admin entity.
|
||||
|
||||
|
||||
2026-10-15: CCR-2026-0045 was applied in a contained founder admin session.
|
||||
Both proofs passed with the founder confirming each request's diagnosis;
|
||||
negative fixture is the founder-selected existing `tegwick` account.
|
||||
Receipts: `docs/evidence/2026-10-15-sign-in-diagnosis/`.
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@ type: workplan
|
|||
title: "Named-role login without session reuse, diagnosis receipt, and a self-only capability proof"
|
||||
domain: infotech
|
||||
repo: ops-mason
|
||||
status: active
|
||||
status: finished
|
||||
owner: claude
|
||||
topic_slug: custodian
|
||||
created: "2026-10-14"
|
||||
updated: "2026-10-14"
|
||||
updated: "2026-10-15"
|
||||
state_hub_workstream_id: "347f452c-cf66-5b92-8d2e-f5027101ae80"
|
||||
---
|
||||
|
||||
|
|
@ -28,7 +28,8 @@ the OpenBao UI role choice).
|
|||
`4a1f663c-0621-0483-edd0-f852274f4b6b`.
|
||||
- No `verbose_oidc_logging`. Receipts carry no token, authorization code,
|
||||
email, OTP, or KV value.
|
||||
- Repo changes and tests only; nothing applied to OpenBao or the cluster.
|
||||
- Original preparation was repo-only. Founder approved the paired metadata
|
||||
apply and attended verification on 2026-10-15; evidence is below.
|
||||
|
||||
## Named-role login prints the address and waits
|
||||
|
||||
|
|
@ -82,13 +83,25 @@ Done 2026-10-14 in the repo. Works live only after CCR-2026-0045 is applied.
|
|||
|
||||
```task
|
||||
id: MASON-WP-0012-T04
|
||||
status: wait
|
||||
status: done
|
||||
depends_on: [MASON-WP-0012-T03]
|
||||
priority: medium
|
||||
state_hub_task_id: "a22ca4f1-dc18-5298-8a10-0c736951f939"
|
||||
```
|
||||
|
||||
After railiance-platform applies CCR-2026-0045 (RPF-WP-0057-T02): run
|
||||
`member` (as `bernd.worsch-3`) and `non-member` (as `signin-probe-negative`,
|
||||
`member` (as `bernd.worsch-3`) and `non-member` (as `tegwick`,
|
||||
NK-WP-0051-T05) attended, copy the sanitized receipts into `docs/evidence/`,
|
||||
and report acceptance to net-kingdom for NK-WP-0051-T06.
|
||||
|
||||
|
||||
Accepted live 2026-10-15 in the founder-attended NK-WP-0051 sitting. After
|
||||
CCR-2026-0045 apply, both proofs passed. Founder corroborated diagnosis uid,
|
||||
groups and `aal2` for each exact request. Member `bernd.worsch-3` had exactly
|
||||
the workload policy, intended data/metadata reads, parent and sibling denials,
|
||||
and successful self-revocation. `tegwick` carried `railiance-admins` only,
|
||||
verified MFA, then received the groups bound-claim refusal. No KV values read.
|
||||
[Acceptance and sanitized receipt digests](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json).
|
||||
Copies of both native receipts are beside that record. NK-WP-0051-T06 accepted.
|
||||
No residual ops-mason work remains; separate UI control clickthrough is already
|
||||
tracked by the platform owner in RPF-WP-0057-T04.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue