From e4761b843cd881a672cbb33a5b451de31a61d730 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 15 Oct 2026 19:23:24 +0200 Subject: [PATCH] Accept attended sign-in diagnosis caller proofs Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- .../acceptance.json | 64 +++++++++++++++++++ .../reuse-surface-hub-writer-member.txt | 21 ++++++ .../reuse-surface-hub-writer-non-member.txt | 21 ++++++ docs/reuse-surface-hub-writer-attended.md | 8 ++- ...-WP-0012-sign-in-diagnosis-caller-proof.md | 23 +++++-- 5 files changed, 131 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt create mode 100644 docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json new file mode 100644 index 0000000..886fa08 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json @@ -0,0 +1,64 @@ +{ + "workplan": "NK-WP-0051", + "date": "2026-10-15", + "result": "pass", + "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks", + "admin": { + "uid": "platform-root", + "groups": [ + "activity-core-operators", + "net-kingdom-admins", + "net-kingdom-users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "contained_session_exit": 0, + "ccr": "CCR-2026-0045", + "ccr_status": "applied" + }, + "member": { + "uid": "bernd.worsch-3", + "groups": [ + "reuse-surface-hub-writers", + "tenant:trial:demo-company:users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "accepted", + "revoked": true + }, + "non_member": { + "uid": "tegwick", + "groups": [ + "railiance-admins" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "refused", + "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values" + }, + "overlay": { + "apply": "passed", + "verify": "passed after transient connection reset during gateway rollout", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes." + }, + "verification": { + "directory_helper": "68 passed", + "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation", + "ccr_0045_validate": "passed", + "ccr_0045_dry_run": "passed; no warnings" + }, + "limits": [ + "No KV secret values read", + "User diagnosis values are founder observations, not independently captured browser evidence", + "No independent live platform-admin entity-policy inventory performed", + "No changes to directory memberships, admin entity policy, or ops-mason-survey" + ], + "receipts": { + "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328", + "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322" + } +} diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt new file mode 100644 index 0000000..d0cb1b0 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt @@ -0,0 +1,21 @@ +mode=member +at=2026-10-15T17:16:54Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=bernd.worsch-3 +uid_source=operator +assurance=aal2 +assurance_source=operator +login=ok +openbao_error= +entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94 +policies=workload-kv-read-reuse-surface-runtime +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: read +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read +platform/data/workloads/reuse/reuse-surface: deny +platform/metadata/workloads/reuse/reuse-surface: deny +platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny +revoked=yes +result=pass diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt new file mode 100644 index 0000000..44ce20f --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt @@ -0,0 +1,21 @@ +mode=non-member +at=2026-10-15T17:20:11Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=tegwick +uid_source=operator +assurance=aal2 +assurance_source=operator +login=refused +openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values +entity_id= +policies= +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/data/workloads/reuse/reuse-surface: not-run +platform/metadata/workloads/reuse/reuse-surface: not-run +platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run +revoked=n/a +result=pass diff --git a/docs/reuse-surface-hub-writer-attended.md b/docs/reuse-surface-hub-writer-attended.md index c14450a..ee33518 100644 --- a/docs/reuse-surface-hub-writer-attended.md +++ b/docs/reuse-surface-hub-writer-attended.md @@ -38,7 +38,7 @@ role's aal2 bound claim on success. No token and no KV value is recorded. ```bash export BAO_ADDR=http://127.0.0.1:18200 python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3 -python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid signin-probe-negative --assurance aal2 +python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid tegwick --assurance aal2 ``` `member` passes when the token's policies are exactly @@ -52,3 +52,9 @@ recorded in `openbao_error`. Do not run `bao kv get` on this path to prove the lane. Do not attach the workload policy to the admin entity. + + +2026-10-15: CCR-2026-0045 was applied in a contained founder admin session. +Both proofs passed with the founder confirming each request's diagnosis; +negative fixture is the founder-selected existing `tegwick` account. +Receipts: `docs/evidence/2026-10-15-sign-in-diagnosis/`. diff --git a/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md b/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md index 3381b81..cab4acb 100644 --- a/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md +++ b/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md @@ -4,11 +4,11 @@ type: workplan title: "Named-role login without session reuse, diagnosis receipt, and a self-only capability proof" domain: infotech repo: ops-mason -status: active +status: finished owner: claude topic_slug: custodian created: "2026-10-14" -updated: "2026-10-14" +updated: "2026-10-15" state_hub_workstream_id: "347f452c-cf66-5b92-8d2e-f5027101ae80" --- @@ -28,7 +28,8 @@ the OpenBao UI role choice). `4a1f663c-0621-0483-edd0-f852274f4b6b`. - No `verbose_oidc_logging`. Receipts carry no token, authorization code, email, OTP, or KV value. -- Repo changes and tests only; nothing applied to OpenBao or the cluster. +- Original preparation was repo-only. Founder approved the paired metadata + apply and attended verification on 2026-10-15; evidence is below. ## Named-role login prints the address and waits @@ -82,13 +83,25 @@ Done 2026-10-14 in the repo. Works live only after CCR-2026-0045 is applied. ```task id: MASON-WP-0012-T04 -status: wait +status: done depends_on: [MASON-WP-0012-T03] priority: medium state_hub_task_id: "a22ca4f1-dc18-5298-8a10-0c736951f939" ``` After railiance-platform applies CCR-2026-0045 (RPF-WP-0057-T02): run -`member` (as `bernd.worsch-3`) and `non-member` (as `signin-probe-negative`, +`member` (as `bernd.worsch-3`) and `non-member` (as `tegwick`, NK-WP-0051-T05) attended, copy the sanitized receipts into `docs/evidence/`, and report acceptance to net-kingdom for NK-WP-0051-T06. + + +Accepted live 2026-10-15 in the founder-attended NK-WP-0051 sitting. After +CCR-2026-0045 apply, both proofs passed. Founder corroborated diagnosis uid, +groups and `aal2` for each exact request. Member `bernd.worsch-3` had exactly +the workload policy, intended data/metadata reads, parent and sibling denials, +and successful self-revocation. `tegwick` carried `railiance-admins` only, +verified MFA, then received the groups bound-claim refusal. No KV values read. +[Acceptance and sanitized receipt digests](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json). +Copies of both native receipts are beside that record. NK-WP-0051-T06 accepted. +No residual ops-mason work remains; separate UI control clickthrough is already +tracked by the platform owner in RPF-WP-0057-T04.