coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Name the verified reuse-surface hub-writer login

Browse source 
CCR-2026-0044 is applied. Member and non-member receipts passed on
2026-10-14: the member token holds only
workload-kv-read-reuse-surface-runtime, and a non-member login is
refused. The catalog auth_method is now that OIDC role. The proxy still
uses the ambient token and does not vend the hub writer value.

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0
This commit is contained in:
tegwick 2026-10-14 22:20:15 +02:00
parent 638cc9233b
commit 402b008986
3 changed files with 21 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/test_reuse_surface_caller_gate.py
View file

@ -6,12 +6,11 @@ from pathlib import Path
from warden.routing import load_catalog
def test_dedicated_caller_stays_unnamed_until_ccr_2026_0044_verification():
def test_dedicated_caller_is_the_verified_hub_writer_role():
catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
entry = catalog.get("reuse-surface-hub-write-token")
assert entry is not None
auth = entry.auth_method or ""
# MASON-WP-0011: the proposed OIDC role is not the auth method yet.
assert "reuse-surface-hub-writer" not in auth
assert "CCR-2026-0044" in auth
assert "unnamed" in auth
assert entry.auth_method == (
"bao login -method=oidc -path=netkingdom "
"role=reuse-surface-hub-writer-workload-kv-read"
)