coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/docs/reuse-surface-hub-writer-attended.md
tegwick fd2c5a5904 Name a dedicated reuse-surface hub-writer caller. 
CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
2026-10-14 18:19:14 +02:00

1.3 KiB
Raw Blame History

reuse-surface hub-writer attended verification

Plan: plans/reuse-surface-hub-writer.md. Draft CCR: builds/reuse-surface-hub-writer/credential-change-requests/CCR-DRAFT-REUSE-SURFACE-HUB-WRITER.yaml.

Run this only after the founder has applied the role and key-cape has confirmed group reuse-surface-hub-writers. The member must not be OpenBao entity 4a1f663c-0621-0483-edd0-f852274f4b6b.

The script leaves ~/.vault-token in place and uses it only to call sys/capabilities. The lane token is not printed and is revoked before the script exits. A passing receipt is the sanitized verification record.

export BAO_ADDR=http://127.0.0.1:18200
python3 scripts/verify-reuse-surface-hub-writer.py member
python3 scripts/verify-reuse-surface-hub-writer.py non-member

member passes when the token's policies are exactly workload-kv-read-reuse-surface-runtime, the entity is not the admin entity, the runtime-secrets data and metadata paths are read, the parent paths and platform/data/workloads/issue-core/issue-core/issue-core-runtime are deny, and revoke succeeded.

non-member passes when the role refuses the login. Use a private window so an existing KeyCape session is not reused.

Do not run bao kv get on this path to prove the lane. Do not attach the workload policy to the admin entity.