coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0012: named-role login without session reuse, diagnosis receipt, capabilities-self proof (NK-WP-0051-T06)

Browse source 
verify-reuse-surface-hub-writer.py logs in with skip_browser=true and
shows the address (or opens a fresh temporary browser profile), so the
default Authelia session is never reused. The receipt records uid,
openbao_error and assurance per net-kingdom/docs/sign-in-diagnosis.md,
with tokens, codes and emails redacted. Capabilities come from
sys/capabilities-self on the lane token; no operator or root token is
read. Needs railiance-platform CCR-2026-0045 applied to run live.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-14 23:48:11 +02:00
parent 97d1fed949
commit fca5591bc6
8 changed files with 616 additions and 136 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/reuse-surface-hub-writer-attended.md
View file

@ -15,16 +15,30 @@ shape go through
identity-provisioner `POST /v1/groups/ensure`; see
`docs/directory-group-binding.md`.
The script leaves `~/.vault-token` in place. It calls `sys/capabilities` with
the first local token that is allowed to: `BAO_TOKEN` or `VAULT_TOKEN`, then
`~/.local/openbao/platform-admin.token`, then `~/.vault-token`. The lane token
is not printed and is revoked before the script exits. A passing receipt is
the sanitized verification record.
The script leaves `~/.vault-token` in place and reads no operator or root
token. Since NK-WP-0051-T06 it asks `sys/capabilities-self` with the lane
token itself, which needs railiance-platform CCR-2026-0045 applied (the
generated `sys/capabilities-self` grant). Until that apply, `member` fails
with the OpenBao permission error in `openbao_error`. The lane token is not
printed and is revoked before the script exits. A passing receipt is the
sanitized verification record.
`bao login` runs with `skip_browser=true`: it prints the sign-in address and
waits, so the default browser and its Authelia session are not used. Open the
address in a private window, or set `OPS_MASON_LOGIN_BROWSER` to a Chromium or
Firefox binary to open it in a fresh temporary profile.
The receipt follows `net-kingdom/docs/sign-in-diagnosis.md`: `uid`,
`openbao_error` (OpenBao's text, verbatim, with tokens, codes and emails
redacted) and `assurance` when known. Pass `--uid` and `--assurance` as
KeyCape's diagnosis page showed them for this request; otherwise `uid` comes
from the token display name on success, and `assurance=aal2` follows from the
role's aal2 bound claim on success. No token and no KV value is recorded.
```bash
export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member
python3 scripts/verify-reuse-surface-hub-writer.py non-member
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid signin-probe-negative --assurance aal2
```
`member` passes when the token's policies are exactly
@ -33,8 +47,8 @@ the runtime-secrets data and metadata paths are `read`, the parent paths and
`platform/data/workloads/issue-core/issue-core/issue-core-runtime` are `deny`,
and revoke succeeded.
`non-member` passes when the role refuses the login. Use a private window so
an existing KeyCape session is not reused.
`non-member` passes when the role refuses the login and the refusal text is
recorded in `openbao_error`.
Do not run `bao kv get` on this path to prove the lane. Do not attach the
workload policy to the admin entity.