From 430c6eea0786224921e6540c525a82a4396d0781 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 3 Nov 2026 13:13:14 +0100 Subject: [PATCH] Record the OpenBao UI role clickthrough and finish RPF-WP-0057. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4 --- WORK-RECORDS.md | 4 +-- ...26-11-03-openbao-ui-role-clickthrough.json | 35 +++++++++++++++++++ ...-WP-0057-sign-in-diagnosis-caller-proof.md | 18 ++++++++-- 3 files changed, 53 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 1f20b34..e77b60d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -37,7 +37,7 @@ | workplan | RPF-WP-0054 | finished | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md | | workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md | | workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | -| workplan | RPF-WP-0057 | active | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| workplan | RPF-WP-0057 | finished | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | | workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | @@ -178,7 +178,7 @@ | task | RPF-WP-0057-T01 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | -| task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0057-T04 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0057-T05 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | diff --git a/docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json b/docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json new file mode 100644 index 0000000..a567a48 --- /dev/null +++ b/docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json @@ -0,0 +1,35 @@ +{ + "schema": "railiance-platform.openbao-ui-role-clickthrough.v1", + "workplan": "RPF-WP-0057", + "task": "RPF-WP-0057-T04", + "date": "2026-11-03", + "runner": "attended: founder browser clickthrough of the deployed OpenBao UI through the operator tunnel http://127.0.0.1:18200", + "deployed_from": { + "repo": "rapp-openbao", + "overlay_commit": "32d6e92", + "gateway_commit": "004ca55", + "verifier": "make openbao-verify-login-overlay passed (re-run after one connection reset during gateway rollout)" + }, + "admin_control": { + "control": "Sign in with KeyCape", + "role": "platform-admin", + "result": "login succeeded" + }, + "workload_control": { + "control": "Sign in with a workload role", + "role": "reuse-surface-hub-writer-workload-kv-read", + "window": "private", + "person": "bernd.worsch-3", + "result": "login succeeded", + "observed": { + "secrets_engines_visible": ["platform/ (kv, accessor kv_380ad217)"], + "access_and_policies": "not authorized" + } + }, + "limits": [ + "Founder observations; no browser capture or token metadata recorded", + "Not observed directly: that the policy set is exactly workload-kv-read-reuse-surface-runtime (the visible reach is consistent with it)", + "No KV values read", + "No non-member browser refusal repeated; the 2026-10-15 native refusal receipt stands" + ] +} diff --git a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md index 171d46b..db32bff 100644 --- a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md +++ b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md @@ -4,7 +4,7 @@ type: workplan title: "Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI" domain: financials repo: railiance-platform -status: active +status: finished owner: claude topic_slug: railiance created: "2026-10-14" @@ -79,7 +79,7 @@ Source done 2026-10-14; live overlay deployed 2026-10-15. ```task id: RPF-WP-0057-T04 -status: progress +status: done depends_on: [RPF-WP-0057-T03] priority: medium state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265" @@ -154,3 +154,17 @@ gateway is back at 25m until the founder re-applies from `rapp-openbao` `assurance/ownership-handoffs.json` are refreshed. Read-only targets still run here. Retained files are not deleted. Automating the attended apply is deferred by founder decision; the founder deploys. + +### UI clickthrough — 2026-11-03 + +T04 done. The overlay from `rapp-openbao` (`32d6e92`, gateway `004ca55`) +passes `make openbao-verify-login-overlay`. The founder then signed in +through the browser: +- **Sign in with KeyCape** signed in as `platform-admin`. +- In a private window, **Sign in with a workload role** offered the + hub-writer role, and `bernd.worsch-3` signed in. That session saw only the + `platform/` KV engine (accessor `kv_380ad217`) and was refused Access and + Policies. +No KV values were read. These are founder observations; no token metadata was +captured. Receipt: `docs/evidence/2026-11-03-openbao-ui-role-clickthrough.json`. +All tasks are done, and RPF-WP-0057 is finished.