MASON-WP-0012: named-role login without session reuse, diagnosis receipt, capabilities-self proof (NK-WP-0051-T06)

verify-reuse-surface-hub-writer.py logs in with skip_browser=true and
shows the address (or opens a fresh temporary browser profile), so the
default Authelia session is never reused. The receipt records uid,
openbao_error and assurance per net-kingdom/docs/sign-in-diagnosis.md,
with tokens, codes and emails redacted. Capabilities come from
sys/capabilities-self on the lane token; no operator or root token is
read. Needs railiance-platform CCR-2026-0045 applied to run live.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

src/ops_mason/reuse_surface_hub_writer.py

@@ -8,6 +8,10 @@ from __future__ import annotations
 
 POLICY = "workload-kv-read-reuse-surface-runtime"
 ROLE = "reuse-surface-hub-writer-workload-kv-read"
+MOUNT = "netkingdom"
+# The role binds /assurance/level=aal2 (CCR-2026-0044), so a login that
+# succeeds on it carried aal2 for that request.
+ROLE_REQUIRES_AAL2 = True
 FORBIDDEN_ENTITY_ID = "4a1f663c-0621-0483-edd0-f852274f4b6b"
 FORBIDDEN_POLICIES = frozenset(
     {
@@ -48,9 +52,11 @@ def assess(report: dict) -> list[str]:
         return [f"unknown mode {mode!r}"]
     login = report.get("login")
     if mode == "non-member":
-        if login == "refused":
-            return []
-        return ["non-member login succeeded; the role accepted the wrong principal"]
+        if login != "refused":
+            return ["non-member login succeeded; the role accepted the wrong principal"]
+        if not str(report.get("openbao_error") or "").strip():
+            return ["non-member refusal recorded no openbao_error text"]
+        return []
 
     failures: list[str] = []
     if login != "ok":