tegwick
0af5a09e89
OpenBao has no entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1 and no entity named bernd.worsch-3. T02 waits for the entity created at first login. The member receipt still rejects the admin entity. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
1.8 KiB
reuse-surface hub-writer attended verification
Plan: plans/reuse-surface-hub-writer.md. Filed request:
railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml
(proposed). Source copy:
builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml.
Run this only after CCR-2026-0044 is approved and applied. LLDAP group
reuse-surface-hub-writers exists with member bernd.worsch-3, and that
user enrolled a second factor on 2026-10-14. member still has to be a
login that KeyCape marks /assurance/level=aal2. The reported uuid
f94b7c34-e151-30bb-b473-df3ccdbb9bf1 is not an OpenBao entity. A token for
4a1f663c-0621-0483-edd0-f852274f4b6b fails. Later groups of this
shape go through
identity-provisioner POST /v1/groups/ensure; see
docs/directory-group-binding.md.
The script leaves ~/.vault-token in place and uses it only to call
sys/capabilities. The lane token is not printed and is revoked before the
script exits. A passing receipt is the sanitized verification record.
export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member
python3 scripts/verify-reuse-surface-hub-writer.py non-member
member passes when the token's policies are exactly
workload-kv-read-reuse-surface-runtime, the entity is not the admin entity,
the runtime-secrets data and metadata paths are read, the parent paths and
platform/data/workloads/issue-core/issue-core/issue-core-runtime are deny,
and revoke succeeded.
non-member passes when the role refuses the login. Use a private window so
an existing KeyCape session is not reused.
Do not run bao kv get on this path to prove the lane. Do not attach the
workload policy to the admin entity.