tegwick
e4761b843c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
60 lines
3 KiB
Markdown
60 lines
3 KiB
Markdown
# reuse-surface hub-writer attended verification
|
|
|
|
Plan: `plans/reuse-surface-hub-writer.md`. Filed request:
|
|
`railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml`
|
|
(applied 2026-10-14). Source copy:
|
|
`builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml`.
|
|
|
|
Run this only after CCR-2026-0044 is approved and applied. LLDAP group
|
|
`reuse-surface-hub-writers` exists with member `bernd.worsch-3`, and that
|
|
user enrolled a second factor on 2026-10-14. `member` still has to be a
|
|
login that KeyCape marks `/assurance/level=aal2`. The reported uuid
|
|
`f94b7c34-e151-30bb-b473-df3ccdbb9bf1` is not an OpenBao entity. A token for
|
|
`4a1f663c-0621-0483-edd0-f852274f4b6b` fails. Later groups of this
|
|
shape go through
|
|
identity-provisioner `POST /v1/groups/ensure`; see
|
|
`docs/directory-group-binding.md`.
|
|
|
|
The script leaves `~/.vault-token` in place and reads no operator or root
|
|
token. Since NK-WP-0051-T06 it asks `sys/capabilities-self` with the lane
|
|
token itself, which needs railiance-platform CCR-2026-0045 applied (the
|
|
generated `sys/capabilities-self` grant). Until that apply, `member` fails
|
|
with the OpenBao permission error in `openbao_error`. The lane token is not
|
|
printed and is revoked before the script exits. A passing receipt is the
|
|
sanitized verification record.
|
|
|
|
`bao login` runs with `skip_browser=true`: it prints the sign-in address and
|
|
waits, so the default browser and its Authelia session are not used. Open the
|
|
address in a private window, or set `OPS_MASON_LOGIN_BROWSER` to a Chromium or
|
|
Firefox binary to open it in a fresh temporary profile.
|
|
|
|
The receipt follows `net-kingdom/docs/sign-in-diagnosis.md`: `uid`,
|
|
`openbao_error` (OpenBao's text, verbatim, with tokens, codes and emails
|
|
redacted) and `assurance` when known. Pass `--uid` and `--assurance` as
|
|
KeyCape's diagnosis page showed them for this request; otherwise `uid` comes
|
|
from the token display name on success, and `assurance=aal2` follows from the
|
|
role's aal2 bound claim on success. No token and no KV value is recorded.
|
|
|
|
```bash
|
|
export BAO_ADDR=http://127.0.0.1:18200
|
|
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
|
|
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid tegwick --assurance aal2
|
|
```
|
|
|
|
`member` passes when the token's policies are exactly
|
|
`workload-kv-read-reuse-surface-runtime`, the entity is not the admin entity,
|
|
the runtime-secrets data and metadata paths are `read`, the parent paths and
|
|
`platform/data/workloads/issue-core/issue-core/issue-core-runtime` are `deny`,
|
|
and revoke succeeded.
|
|
|
|
`non-member` passes when the role refuses the login and the refusal text is
|
|
recorded in `openbao_error`.
|
|
|
|
Do not run `bao kv get` on this path to prove the lane. Do not attach the
|
|
workload policy to the admin entity.
|
|
|
|
|
|
2026-10-15: CCR-2026-0045 was applied in a contained founder admin session.
|
|
Both proofs passed with the founder confirming each request's diagnosis;
|
|
negative fixture is the founder-selected existing `tegwick` account.
|
|
Receipts: `docs/evidence/2026-10-15-sign-in-diagnosis/`.
|