Accept attended sign-in diagnosis caller proofs
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
b67b57a022
commit
e4761b843c
5 changed files with 131 additions and 6 deletions
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
64
docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"workplan": "NK-WP-0051",
|
||||
"date": "2026-10-15",
|
||||
"result": "pass",
|
||||
"source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
|
||||
"admin": {
|
||||
"uid": "platform-root",
|
||||
"groups": [
|
||||
"activity-core-operators",
|
||||
"net-kingdom-admins",
|
||||
"net-kingdom-users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"contained_session_exit": 0,
|
||||
"ccr": "CCR-2026-0045",
|
||||
"ccr_status": "applied"
|
||||
},
|
||||
"member": {
|
||||
"uid": "bernd.worsch-3",
|
||||
"groups": [
|
||||
"reuse-surface-hub-writers",
|
||||
"tenant:trial:demo-company:users",
|
||||
"whynot-design"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "accepted",
|
||||
"revoked": true
|
||||
},
|
||||
"non_member": {
|
||||
"uid": "tegwick",
|
||||
"groups": [
|
||||
"railiance-admins"
|
||||
],
|
||||
"assurance": "aal2",
|
||||
"client_id": "openbao-admin",
|
||||
"result": "refused",
|
||||
"openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
|
||||
},
|
||||
"overlay": {
|
||||
"apply": "passed",
|
||||
"verify": "passed after transient connection reset during gateway rollout",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
|
||||
},
|
||||
"verification": {
|
||||
"directory_helper": "68 passed",
|
||||
"platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
|
||||
"ccr_0045_validate": "passed",
|
||||
"ccr_0045_dry_run": "passed; no warnings"
|
||||
},
|
||||
"limits": [
|
||||
"No KV secret values read",
|
||||
"User diagnosis values are founder observations, not independently captured browser evidence",
|
||||
"No independent live platform-admin entity-policy inventory performed",
|
||||
"No changes to directory memberships, admin entity policy, or ops-mason-survey"
|
||||
],
|
||||
"receipts": {
|
||||
"reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
|
||||
"reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=member
|
||||
at=2026-10-15T17:16:54Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=bernd.worsch-3
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=ok
|
||||
openbao_error=
|
||||
entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
|
||||
policies=workload-kv-read-reuse-surface-runtime
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
|
||||
platform/data/workloads/reuse/reuse-surface: deny
|
||||
platform/metadata/workloads/reuse/reuse-surface: deny
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
|
||||
revoked=yes
|
||||
result=pass
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
mode=non-member
|
||||
at=2026-10-15T17:20:11Z
|
||||
addr=http://127.0.0.1:18200
|
||||
role=reuse-surface-hub-writer-workload-kv-read
|
||||
policy=workload-kv-read-reuse-surface-runtime
|
||||
uid=tegwick
|
||||
uid_source=operator
|
||||
assurance=aal2
|
||||
assurance_source=operator
|
||||
login=refused
|
||||
openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
|
||||
entity_id=
|
||||
policies=
|
||||
identity_policies=
|
||||
platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
|
||||
platform/data/workloads/reuse/reuse-surface: not-run
|
||||
platform/metadata/workloads/reuse/reuse-surface: not-run
|
||||
platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
|
||||
revoked=n/a
|
||||
result=pass
|
||||
|
|
@ -38,7 +38,7 @@ role's aal2 bound claim on success. No token and no KV value is recorded.
|
|||
```bash
|
||||
export BAO_ADDR=http://127.0.0.1:18200
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid signin-probe-negative --assurance aal2
|
||||
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid tegwick --assurance aal2
|
||||
```
|
||||
|
||||
`member` passes when the token's policies are exactly
|
||||
|
|
@ -52,3 +52,9 @@ recorded in `openbao_error`.
|
|||
|
||||
Do not run `bao kv get` on this path to prove the lane. Do not attach the
|
||||
workload policy to the admin entity.
|
||||
|
||||
|
||||
2026-10-15: CCR-2026-0045 was applied in a contained founder admin session.
|
||||
Both proofs passed with the founder confirming each request's diagnosis;
|
||||
negative fixture is the founder-selected existing `tegwick` account.
|
||||
Receipts: `docs/evidence/2026-10-15-sign-in-diagnosis/`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue