MASON-WP-0012: named-role login without session reuse, diagnosis receipt, capabilities-self proof (NK-WP-0051-T06)

verify-reuse-surface-hub-writer.py logs in with skip_browser=true and
shows the address (or opens a fresh temporary browser profile), so the
default Authelia session is never reused. The receipt records uid,
openbao_error and assurance per net-kingdom/docs/sign-in-diagnosis.md,
with tokens, codes and emails redacted. Capabilities come from
sys/capabilities-self on the lane token; no operator or root token is
read. Needs railiance-platform CCR-2026-0045 applied to run live.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md

@@ -0,0 +1,89 @@
+---
+id: MASON-WP-0012
+type: workplan
+title: "Named-role login without session reuse, diagnosis receipt, and a self-only capability proof"
+domain: infotech
+repo: ops-mason
+status: active
+owner: claude
+topic_slug: custodian
+created: "2026-10-14"
+updated: "2026-10-14"
+---
+
+# Named-role login without session reuse, diagnosis receipt, and a self-only capability proof
+
+## Goal
+
+Answer NetKingdom NK-WP-0051-T06 for ops-mason. Contract and the only source
+of field names: `net-kingdom/docs/sign-in-diagnosis.md`. Background:
+MASON-WP-0011. Paired railiance-platform work: RPF-WP-0057 (CCR-2026-0045 and
+the OpenBao UI role choice).
+
+## Boundaries
+
+- `ops-mason-survey` stays read-only; this plan does not touch it.
+- `workload-kv-read-reuse-surface-runtime` is never attached to entity
+  `4a1f663c-0621-0483-edd0-f852274f4b6b`.
+- No `verbose_oidc_logging`. Receipts carry no token, authorization code,
+  email, OTP, or KV value.
+- Repo changes and tests only; nothing applied to OpenBao or the cluster.
+
+## Named-role login prints the address and waits
+
+```task
+id: MASON-WP-0012-T01
+status: done
+priority: high
+```
+
+`scripts/verify-reuse-surface-hub-writer.py` logs in with
+`skip_browser=true`, shows the address, and waits. `OPS_MASON_LOGIN_BROWSER`
+opens it in a fresh temporary Chromium or Firefox profile instead. The default
+Authelia session is never used. Helpers: `src/ops_mason/attended_login.py`.
+
+Done 2026-10-14. Tests: `tests/test_attended_login.py`.
+
+## Receipt records uid, openbao_error, assurance
+
+```task
+id: MASON-WP-0012-T02
+status: done
+priority: high
+```
+
+The receipt adds `uid`, `openbao_error` (verbatim, redacted of tokens, codes
+and emails) and `assurance` when known, each with its source. `--uid` and
+`--assurance` take what KeyCape's diagnosis page showed. A non-member pass now
+needs the refusal text recorded.
+
+Done 2026-10-14. Tests: `tests/test_attended_login.py`,
+`tests/test_reuse_surface_hub_writer.py`.
+
+## Proof uses sys/capabilities-self only
+
+```task
+id: MASON-WP-0012-T03
+status: done
+priority: high
+```
+
+The verifier no longer reads `BAO_TOKEN`, `VAULT_TOKEN`,
+`~/.local/openbao/platform-admin.token` or `~/.vault-token` and never calls
+`sys/capabilities`. It calls `sys/capabilities-self` with the lane token.
+
+Done 2026-10-14 in the repo. Works live only after CCR-2026-0045 is applied.
+
+## Re-run both proofs after CCR-2026-0045
+
+```task
+id: MASON-WP-0012-T04
+status: wait
+depends_on: [MASON-WP-0012-T03]
+priority: medium
+```
+
+After railiance-platform applies CCR-2026-0045 (RPF-WP-0057-T02): run
+`member` (as `bernd.worsch-3`) and `non-member` (as `signin-probe-negative`,
+NK-WP-0051-T05) attended, copy the sanitized receipts into `docs/evidence/`,
+and report acceptance to net-kingdom for NK-WP-0051-T06.