Name a dedicated reuse-surface hub-writer caller.

CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6

tests/test_reuse_surface_hub_writer.py

@@ -0,0 +1,67 @@
+from ops_mason.reuse_surface_hub_writer import (
+    DATA,
+    FORBIDDEN_ENTITY_ID,
+    METADATA,
+    PARENT_DATA,
+    POLICY,
+    SIBLING,
+    assess,
+)
+
+
+def member(**overrides):
+    report = {
+        "mode": "member",
+        "login": "ok",
+        "policies": [POLICY],
+        "identity_policies": [],
+        "entity_id": "11111111-1111-1111-1111-111111111111",
+        "capabilities": {
+            DATA: ["read"],
+            METADATA: ["read"],
+            PARENT_DATA: ["deny"],
+            "platform/metadata/workloads/reuse/reuse-surface": ["deny"],
+            SIBLING: ["deny"],
+        },
+        "revoked": True,
+    }
+    report.update(overrides)
+    return report
+
+
+def test_member_exact_policy_passes():
+    assert assess(member()) == []
+
+
+def test_admin_entity_and_broad_capabilities_fail():
+    failures = assess(
+        member(
+            policies=["default", "operator-custody", "platform-admin", POLICY],
+            identity_policies=["platform-admin"],
+            entity_id=FORBIDDEN_ENTITY_ID,
+            capabilities={
+                DATA: ["create", "delete", "list", "read", "update"],
+                METADATA: ["create", "delete", "list", "read", "update"],
+                PARENT_DATA: ["create", "delete", "list", "read", "update"],
+                "platform/metadata/workloads/reuse/reuse-surface": ["read"],
+                SIBLING: ["create", "delete", "list", "read", "update"],
+            },
+        )
+    )
+    assert any("platform-admin entity" in item for item in failures)
+    assert any("forbidden policies" in item for item in failures)
+    assert any(SIBLING in item for item in failures)
+    assert any("not exactly" in item for item in failures)
+
+
+def test_missing_revoke_fails():
+    assert any("not revoked" in item for item in assess(member(revoked=False)))
+
+
+def test_non_member_refusal_passes_and_unexpected_login_fails():
+    assert assess({"mode": "non-member", "login": "refused"}) == []
+    assert assess({"mode": "non-member", "login": "ok"})
+
+
+def test_unknown_mode_fails():
+    assert assess({"mode": "other"})