coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the OpenBao UI role clickthrough and finish RPF-WP-0057.
All checks were successful
CCR intake gate / gate (push) Successful in 1m12s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 236506@bnt-lap001
Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4
This commit is contained in:
codex 2026-11-03 13:13:14 +01:00
parent 233ec5f586
commit 430c6eea07
3 changed files with 53 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -37,7 +37,7 @@
| workplan | RPF-WP-0054 | finished | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md |
| workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
| workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
| workplan | RPF-WP-0057 | active | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| workplan | RPF-WP-0057 | finished | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
| workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
@ -178,7 +178,7 @@
| task | RPF-WP-0057-T01 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0057-T04 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0057-T05 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |

35
docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json Normal file
View file

@ -0,0 +1,35 @@
{
"schema": "railiance-platform.openbao-ui-role-clickthrough.v1",
"workplan": "RPF-WP-0057",
"task": "RPF-WP-0057-T04",
"date": "2026-11-03",
"runner": "attended: founder browser clickthrough of the deployed OpenBao UI through the operator tunnel http://127.0.0.1:18200",
"deployed_from": {
"repo": "rapp-openbao",
"overlay_commit": "32d6e92",
"gateway_commit": "004ca55",
"verifier": "make openbao-verify-login-overlay passed (re-run after one connection reset during gateway rollout)"
},
"admin_control": {
"control": "Sign in with KeyCape",
"role": "platform-admin",
"result": "login succeeded"
},
"workload_control": {
"control": "Sign in with a workload role",
"role": "reuse-surface-hub-writer-workload-kv-read",
"window": "private",
"person": "bernd.worsch-3",
"result": "login succeeded",
"observed": {
"secrets_engines_visible": ["platform/ (kv, accessor kv_380ad217)"],
"access_and_policies": "not authorized"
}
},
"limits": [
"Founder observations; no browser capture or token metadata recorded",
"Not observed directly: that the policy set is exactly workload-kv-read-reuse-surface-runtime (the visible reach is consistent with it)",
"No KV values read",
"No non-member browser refusal repeated; the 2026-10-15 native refusal receipt stands"
]
}

18
workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI"
domain: financials
repo: railiance-platform
status: active
status: finished
owner: claude
topic_slug: railiance
created: "2026-10-14"
@ -79,7 +79,7 @@ Source done 2026-10-14; live overlay deployed 2026-10-15.
```task
id: RPF-WP-0057-T04
status: progress
status: done
depends_on: [RPF-WP-0057-T03]
priority: medium
state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265"
@ -154,3 +154,17 @@ gateway is back at 25m until the founder re-applies from `rapp-openbao`
`assurance/ownership-handoffs.json` are refreshed. Read-only targets still run
here. Retained files are not deleted. Automating the attended apply is
deferred by founder decision; the founder deploys.
### UI clickthrough — 2026-11-03
T04 done. The overlay from `rapp-openbao` (`32d6e92`, gateway `004ca55`)
passes `make openbao-verify-login-overlay`. The founder then signed in
through the browser:
- **Sign in with KeyCape** signed in as `platform-admin`.
- In a private window, **Sign in with a workload role** offered the
hub-writer role, and `bernd.worsch-3` signed in. That session saw only the
`platform/` KV engine (accessor `kv_380ad217`) and was refused Access and
Policies.
No KV values were read. These are founder observations; no token metadata was
captured. Receipt: `docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json`.
All tasks are done, and RPF-WP-0057 is finished.