coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name a dedicated reuse-surface hub-writer caller.

Browse source 
CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 18:19:14 +02:00
parent 6434877a44
commit fd2c5a5904
12 changed files with 841 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/reuse-surface-hub-writer-attended.md Normal file
View file

@ -0,0 +1,30 @@
# reuse-surface hub-writer attended verification
Plan: `plans/reuse-surface-hub-writer.md`. Draft CCR:
`builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`.
Run this only after the founder has applied the role and key-cape has
confirmed group `reuse-surface-hub-writers`. The member must not be OpenBao
entity `4a1f663c-0621-0483-edd0-f852274f4b6b`.
The script leaves `~/.vault-token` in place and uses it only to call
`sys/capabilities`. The lane token is not printed and is revoked before the
script exits. A passing receipt is the sanitized verification record.
```bash
export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member
python3 scripts/verify-reuse-surface-hub-writer.py non-member
```
`member` passes when the token's policies are exactly
`workload-kv-read-reuse-surface-runtime`, the entity is not the admin entity,
the runtime-secrets data and metadata paths are `read`, the parent paths and
`platform/data/workloads/issue-core/issue-core/issue-core-runtime` are `deny`,
and revoke succeeded.
`non-member` passes when the role refuses the login. Use a private window so
an existing KeyCape session is not reused.
Do not run `bao kv get` on this path to prove the lane. Do not attach the
workload policy to the admin entity.