tegwick
fca5591bc6
verify-reuse-surface-hub-writer.py logs in with skip_browser=true and shows the address (or opens a fresh temporary browser profile), so the default Authelia session is never reused. The receipt records uid, openbao_error and assurance per net-kingdom/docs/sign-in-diagnosis.md, with tokens, codes and emails redacted. Capabilities come from sys/capabilities-self on the lane token; no operator or root token is read. Needs railiance-platform CCR-2026-0045 applied to run live. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
2.8 KiB
reuse-surface hub-writer attended verification
Plan: plans/reuse-surface-hub-writer.md. Filed request:
railiance-platform/credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml
(applied 2026-10-14). Source copy:
builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml.
Run this only after CCR-2026-0044 is approved and applied. LLDAP group
reuse-surface-hub-writers exists with member bernd.worsch-3, and that
user enrolled a second factor on 2026-10-14. member still has to be a
login that KeyCape marks /assurance/level=aal2. The reported uuid
f94b7c34-e151-30bb-b473-df3ccdbb9bf1 is not an OpenBao entity. A token for
4a1f663c-0621-0483-edd0-f852274f4b6b fails. Later groups of this
shape go through
identity-provisioner POST /v1/groups/ensure; see
docs/directory-group-binding.md.
The script leaves ~/.vault-token in place and reads no operator or root
token. Since NK-WP-0051-T06 it asks sys/capabilities-self with the lane
token itself, which needs railiance-platform CCR-2026-0045 applied (the
generated sys/capabilities-self grant). Until that apply, member fails
with the OpenBao permission error in openbao_error. The lane token is not
printed and is revoked before the script exits. A passing receipt is the
sanitized verification record.
bao login runs with skip_browser=true: it prints the sign-in address and
waits, so the default browser and its Authelia session are not used. Open the
address in a private window, or set OPS_MASON_LOGIN_BROWSER to a Chromium or
Firefox binary to open it in a fresh temporary profile.
The receipt follows net-kingdom/docs/sign-in-diagnosis.md: uid,
openbao_error (OpenBao's text, verbatim, with tokens, codes and emails
redacted) and assurance when known. Pass --uid and --assurance as
KeyCape's diagnosis page showed them for this request; otherwise uid comes
from the token display name on success, and assurance=aal2 follows from the
role's aal2 bound claim on success. No token and no KV value is recorded.
export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member --uid bernd.worsch-3
python3 scripts/verify-reuse-surface-hub-writer.py non-member --uid signin-probe-negative --assurance aal2
member passes when the token's policies are exactly
workload-kv-read-reuse-surface-runtime, the entity is not the admin entity,
the runtime-secrets data and metadata paths are read, the parent paths and
platform/data/workloads/issue-core/issue-core/issue-core-runtime are deny,
and revoke succeeded.
non-member passes when the role refuses the login and the refusal text is
recorded in openbao_error.
Do not run bao kv get on this path to prove the lane. Do not attach the
workload policy to the admin entity.