ops-mason/docs/reuse-surface-hub-writer-attended.md

reuse-surface hub-writer attended verification

Plan: plans/reuse-surface-hub-writer.md. Filed request: railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml (applied 2026-10-14). Source copy: builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml.

Run this only after CCR-2026-0044 is approved and applied. LLDAP group reuse-surface-hub-writers exists with member bernd.worsch-3, and that user enrolled a second factor on 2026-10-14. member still has to be a login that KeyCape marks /assurance/level=aal2. The reported uuid f94b7c34-e151-30bb-b473-df3ccdbb9bf1 is not an OpenBao entity. A token for 4a1f663c-0621-0483-edd0-f852274f4b6b fails. Later groups of this shape go through identity-provisioner POST /v1/groups/ensure; see docs/directory-group-binding.md.

The script leaves ~/.vault-token in place and reads no operator or root token. Since NK-WP-0051-T06 it asks sys/capabilities-self with the lane token itself, which needs railiance-platform CCR-2026-0045 applied (the generated sys/capabilities-self grant). Until that apply, member fails with the OpenBao permission error in openbao_error. The lane token is not printed and is revoked before the script exits. A passing receipt is the sanitized verification record.

bao login runs with skip_browser=true: it prints the sign-in address and waits, so the default browser and its Authelia session are not used. Open the address in a private window, or set OPS_MASON_LOGIN_BROWSER to a Chromium or Firefox binary to open it in a fresh temporary profile.

The receipt follows net-kingdom/docs/sign-in-diagnosis.md: uid, openbao_error (OpenBao's text, verbatim, with tokens, codes and emails redacted) and assurance when known. Pass --uid and --assurance as KeyCape's diagnosis page showed them for this request; otherwise uid comes from the token display name on success, and assurance=aal2 follows from the role's aal2 bound claim on success. No token and no KV value is recorded.

export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid tegwick --assurance aal2

member passes when the token's policies are exactly workload-kv-read-reuse-surface-runtime, the entity is not the admin entity, the runtime-secrets data and metadata paths are read, the parent paths and platform/data/workloads/issue-core/issue-core/issue-core-runtime are deny, and revoke succeeded.

non-member passes when the role refuses the login and the refusal text is recorded in openbao_error.

Do not run bao kv get on this path to prove the lane. Do not attach the workload policy to the admin entity.

2026-10-15: CCR-2026-0045 was applied in a contained founder admin session. Both proofs passed with the founder confirming each request's diagnosis; negative fixture is the founder-selected existing tegwick account. Receipts: docs/evidence/2026-10-15-sign-in-diagnosis/.