coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/docs/reuse-surface-hub-writer-attended.md
tegwick 97d1fed949 Record the passing hub-writer receipts. 
Member and non-member verification both passed. The verifier accepts s. tokens and calls sys/capabilities with a token that is allowed to.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
2026-10-14 22:14:32 +02:00

1.9 KiB
Raw Blame History

reuse-surface hub-writer attended verification

Plan: plans/reuse-surface-hub-writer.md. Filed request: railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml (applied 2026-10-14). Source copy: builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml.

Run this only after CCR-2026-0044 is approved and applied. LLDAP group reuse-surface-hub-writers exists with member bernd.worsch-3, and that user enrolled a second factor on 2026-10-14. member still has to be a login that KeyCape marks /assurance/level=aal2. The reported uuid f94b7c34-e151-30bb-b473-df3ccdbb9bf1 is not an OpenBao entity. A token for 4a1f663c-0621-0483-edd0-f852274f4b6b fails. Later groups of this shape go through identity-provisioner POST /v1/groups/ensure; see docs/directory-group-binding.md.

The script leaves ~/.vault-token in place. It calls sys/capabilities with the first local token that is allowed to: BAO_TOKEN or VAULT_TOKEN, then ~/.local/openbao/platform-admin.token, then ~/.vault-token. The lane token is not printed and is revoked before the script exits. A passing receipt is the sanitized verification record.

export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member
python3 scripts/verify-reuse-surface-hub-writer.py non-member

member passes when the token's policies are exactly workload-kv-read-reuse-surface-runtime, the entity is not the admin entity, the runtime-secrets data and metadata paths are read, the parent paths and platform/data/workloads/issue-core/issue-core/issue-core-runtime are deny, and revoke succeeded.

non-member passes when the role refuses the login. Use a private window so an existing KeyCape session is not reused.

Do not run bao kv get on this path to prove the lane. Do not attach the workload policy to the admin entity.