RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06)

credential-change.py generates sys/capabilities-self (update) when
openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it
for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops
calling sys/capabilities with a root token. The OpenBao login page keeps
its platform-admin button and adds an allow-listed workload role choice.
Repo only; nothing applied to OpenBao or the cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml

@@ -0,0 +1,121 @@
+id: CCR-2026-0045
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Let the reuse-surface hub-writer caller query its own capabilities
+status: proposed
+created: '2026-10-14'
+updated: '2026-10-14'
+supersedes: CCR-2026-0044
+requester:
+  agent: ops-mason
+  reason: NK-WP-0051-T06 / MASON-WP-0012. The CCR-2026-0044 member proof called sys/capabilities
+    with a root or platform-admin token because the lane policy has no capabilities-self grant.
+    This request adds a generated sys/capabilities-self grant (update; the endpoint is a POST
+    and returns capability names only) so the lane token proves its own reach. Policy, role,
+    bound claims and token bounds are otherwise unchanged from CCR-2026-0044. Do not attach
+    workload-kv-read-reuse-surface-runtime to entity 4a1f663c-0621-0483-edd0-f852274f4b6b. No
+    secret value is read, written or rotated.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  - reuse-surface-owner
+  comments:
+  - at: '2026-10-14T21:00:00Z'
+    reviewer: claude
+    decision: filed_proposed
+    comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries the generated
+      sys/capabilities-self grant; the live policy is unchanged until approval and a delegated
+      apply. Bound claims are those confirmed under CCR-2026-0044 (groups=reuse-surface-hub-writers,
+      /assurance/level=aal2); this request does not change them.
+target:
+  domain: financials
+  tenant: reuse
+  workload: reuse-surface
+  environment: production
+  purpose: Attended read of the existing hub writer token by one dedicated caller.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/reuse/reuse-surface/runtime-secrets
+  fields:
+  - REUSE_SURFACE_TOKEN
+  - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+  policy_name: workload-kv-read-reuse-surface-runtime
+  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
+  metadata_read: true
+  token_self_lifecycle: true
+  auth:
+    method: oidc
+    mount: netkingdom
+    role: reuse-surface-hub-writer-workload-kv-read
+    allowed_redirect_uris:
+    - http://localhost:8250/oidc/callback
+    - http://127.0.0.1:8250/oidc/callback
+    - http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
+    oidc_scopes:
+    - openid
+    - profile
+    - email
+    - groups
+    user_claim: sub
+    groups_claim: groups
+    bound_claims_type: string
+    bound_claims:
+      groups:
+      - reuse-surface-hub-writers
+      /assurance/level: aal2
+    bound_claims_confirmed: true
+    policies:
+    - workload-kv-read-reuse-surface-runtime
+    ttl: 15m
+    token_max_ttl: 30m
+    token_explicit_max_ttl: 30m
+    token_no_default_policy: true
+    token_type: service
+  token_capabilities_self: true
+access_frontdoor:
+  type: ops-warden
+  catalog_id: reuse-surface-hub-write-token
+  selector: reuse-surface federation hub write bearer token
+  command: After a passing member receipt, run warden access reuse-surface-hub-write-token --exec
+    --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane token. Do not use
+    --fetch.
+  resolvable: false
+  readiness: pending-review
+risk:
+  classification: high
+  notes:
+  - sys/capabilities-self reports capability names for paths the caller names. It returns no
+    secret value and grants no access.
+  - The platform-admin entity must not receive this policy. OpenBao merges entity policies into
+    every token for that entity.
+  - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes role and
+    is unchanged.
+  - Until this apply, the live lane policy differs from openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
+    by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token path.
+verification:
+  positive:
+  - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
+  - That token's capabilities are read on the exact data path and the exact metadata path.
+  - The member token can call sys/capabilities-self on the five proof paths without any operator
+    or root token.
+  negative:
+  - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata parent,
+    and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
+  - A principal outside reuse-surface-hub-writers is refused by the role.
+  - Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity.
+  activation_conditions:
+  - platform-operator and reuse-surface-owner approve this request.
+  - Founder applies the policy through the delegated applier. No KV write, no role change beyond
+    re-asserting the CCR-2026-0044 role.
+  - ops-mason scripts/verify-reuse-surface-hub-writer.py member passes using capabilities-self
+    only, and non-member records the OpenBao refusal verbatim. Receipts stay mode 0600 with
+    no token or field value.
+  evidence: []
+lifecycle:
+  deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self stanza).
+    Leave the role, KV path and ESO lane in place.
+  rotate: unchanged from CCR-2026-0005. This request does not rotate field values.
+  compromised: detach the role, revoke outstanding tokens for the role, and follow the CCR-2026-0005
+    compromise procedure if a field value was exposed.