Record approved capabilities-self apply and attended caller proofs

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml

@@ -3,19 +3,19 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Let the reuse-surface hub-writer caller query its own capabilities
-status: proposed
+status: applied
 created: '2026-10-14'
-updated: '2026-10-14'
+updated: '2026-10-15'
 supersedes: CCR-2026-0044
 requester:
   agent: ops-mason
   reason: NK-WP-0051-T06 / MASON-WP-0012. The CCR-2026-0044 member proof called sys/capabilities
-    with a root or platform-admin token because the lane policy has no capabilities-self grant.
-    This request adds a generated sys/capabilities-self grant (update; the endpoint is a POST
-    and returns capability names only) so the lane token proves its own reach. Policy, role,
-    bound claims and token bounds are otherwise unchanged from CCR-2026-0044. Do not attach
-    workload-kv-read-reuse-surface-runtime to entity 4a1f663c-0621-0483-edd0-f852274f4b6b. No
-    secret value is read, written or rotated.
+    with a root or platform-admin token because the lane policy has no capabilities-self
+    grant. This request adds a generated sys/capabilities-self grant (update; the
+    endpoint is a POST and returns capability names only) so the lane token proves
+    its own reach. Policy, role, bound claims and token bounds are otherwise unchanged
+    from CCR-2026-0044. Do not attach workload-kv-read-reuse-surface-runtime to entity
+    4a1f663c-0621-0483-edd0-f852274f4b6b. No secret value is read, written or rotated.
 review:
   required: true
   required_approvers:
@@ -25,10 +25,19 @@ review:
   - at: '2026-10-14T21:00:00Z'
     reviewer: claude
     decision: filed_proposed
-    comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries the generated
-      sys/capabilities-self grant; the live policy is unchanged until approval and a delegated
-      apply. Bound claims are those confirmed under CCR-2026-0044 (groups=reuse-surface-hub-writers,
-      /assurance/level=aal2); this request does not change them.
+    comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries
+      the generated sys/capabilities-self grant; the live policy is unchanged until
+      approval and a delegated apply. Bound claims are those confirmed under CCR-2026-0044
+      (groups=reuse-surface-hub-writers, /assurance/level=aal2); this request does
+      not change them.
+  - at: '2026-10-15T08:55:59+00:00'
+    reviewer: Bernd Worsch (founder; platform-operator and reuse-surface-owner)
+    decision: approved
+    comment: 'Approved in the NetKingdom NK-WP-0051 attended session on 2026-10-15,
+      in response to the explicit request covering both approval roles, CCR-2026-0045
+      capabilities-self metadata apply, and the prepared RPF-WP-0057 login-page deployment.
+      Negative fixture selected: tegwick; founder confirms MFA enrolled and railiance-admins
+      membership only.'
 target:
   domain: financials
   tenant: reuse
@@ -78,44 +87,72 @@ access_frontdoor:
   type: ops-warden
   catalog_id: reuse-surface-hub-write-token
   selector: reuse-surface federation hub write bearer token
-  command: After a passing member receipt, run warden access reuse-surface-hub-write-token --exec
-    --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane token. Do not use
-    --fetch.
+  command: After a passing member receipt, run warden access reuse-surface-hub-write-token
+    --exec --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane
+    token. Do not use --fetch.
   resolvable: false
   readiness: pending-review
 risk:
   classification: high
   notes:
-  - sys/capabilities-self reports capability names for paths the caller names. It returns no
-    secret value and grants no access.
-  - The platform-admin entity must not receive this policy. OpenBao merges entity policies into
-    every token for that entity.
-  - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes role and
-    is unchanged.
+  - sys/capabilities-self reports capability names for paths the caller names. It
+    returns no secret value and grants no access.
+  - The platform-admin entity must not receive this policy. OpenBao merges entity
+    policies into every token for that entity.
+  - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes
+    role and is unchanged.
   - Until this apply, the live lane policy differs from openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
-    by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token path.
+    by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token
+    path.
 verification:
   positive:
   - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
-  - That token's capabilities are read on the exact data path and the exact metadata path.
-  - The member token can call sys/capabilities-self on the five proof paths without any operator
-    or root token.
+  - That token's capabilities are read on the exact data path and the exact metadata
+    path.
+  - The member token can call sys/capabilities-self on the five proof paths without
+    any operator or root token.
   negative:
-  - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata parent,
-    and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
+  - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata
+    parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
   - A principal outside reuse-surface-hub-writers is refused by the role.
   - Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity.
   activation_conditions:
   - platform-operator and reuse-surface-owner approve this request.
-  - Founder applies the policy through the delegated applier. No KV write, no role change beyond
-    re-asserting the CCR-2026-0044 role.
+  - Founder applies the policy through the delegated applier. No KV write, no role
+    change beyond re-asserting the CCR-2026-0044 role.
   - ops-mason scripts/verify-reuse-surface-hub-writer.py member passes using capabilities-self
-    only, and non-member records the OpenBao refusal verbatim. Receipts stay mode 0600 with
-    no token or field value.
-  evidence: []
+    only, and non-member records the OpenBao refusal verbatim. Receipts stay mode
+    0600 with no token or field value.
+  evidence:
+  - at: '2026-10-15T17:13:16+00:00'
+    actor: Bernd Worsch (founder), via codex conduit
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as Bernd Worsch (founder), via codex conduit
+      using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-reuse-surface-runtime'
+    - 'Auth role metadata write: auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-15T17:22:52+00:00'
+    actor: Bernd Worsch (founder), via codex conduit
+    kind: positive_verification
+    result: passed
+    details:
+    - Attended bernd.worsch-3 diagnosis aal2 and hub-writers group confirmed; exact
+      workload policy, intended reads, parent/sibling denial and self-revocation passed
+      using capabilities-self. Receipt docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt
+  - at: '2026-10-15T17:22:52+00:00'
+    actor: Bernd Worsch (founder), via codex conduit
+    kind: negative_verification
+    result: passed
+    details:
+    - 'Founder-selected tegwick diagnosis showed railiance-admins only and aal2 before
+      the workload role refused the groups bound claim. Native sanitized receipt names
+      same uid and preserves error: docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt'
 lifecycle:
-  deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self stanza).
-    Leave the role, KV path and ESO lane in place.
+  deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self
+    stanza). Leave the role, KV path and ESO lane in place.
   rotate: unchanged from CCR-2026-0005. This request does not rotate field values.
-  compromised: detach the role, revoke outstanding tokens for the role, and follow the CCR-2026-0005
-    compromise procedure if a field value was exposed.
+  compromised: detach the role, revoke outstanding tokens for the role, and follow
+    the CCR-2026-0005 compromise procedure if a field value was exposed.

docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json

@@ -0,0 +1,64 @@
+{
+  "workplan": "NK-WP-0051",
+  "date": "2026-10-15",
+  "result": "pass",
+  "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
+  "admin": {
+    "uid": "platform-root",
+    "groups": [
+      "activity-core-operators",
+      "net-kingdom-admins",
+      "net-kingdom-users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "contained_session_exit": 0,
+    "ccr": "CCR-2026-0045",
+    "ccr_status": "applied"
+  },
+  "member": {
+    "uid": "bernd.worsch-3",
+    "groups": [
+      "reuse-surface-hub-writers",
+      "tenant:trial:demo-company:users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "accepted",
+    "revoked": true
+  },
+  "non_member": {
+    "uid": "tegwick",
+    "groups": [
+      "railiance-admins"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "refused",
+    "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
+  },
+  "overlay": {
+    "apply": "passed",
+    "verify": "passed after transient connection reset during gateway rollout",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
+  },
+  "verification": {
+    "directory_helper": "68 passed",
+    "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
+    "ccr_0045_validate": "passed",
+    "ccr_0045_dry_run": "passed; no warnings"
+  },
+  "limits": [
+    "No KV secret values read",
+    "User diagnosis values are founder observations, not independently captured browser evidence",
+    "No independent live platform-admin entity-policy inventory performed",
+    "No changes to directory memberships, admin entity policy, or ops-mason-survey"
+  ],
+  "receipts": {
+    "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
+    "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
+  }
+}

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt

@@ -0,0 +1,21 @@
+mode=member
+at=2026-10-15T17:16:54Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=bernd.worsch-3
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=ok
+openbao_error=
+entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
+policies=workload-kv-read-reuse-surface-runtime
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/data/workloads/reuse/reuse-surface: deny
+platform/metadata/workloads/reuse/reuse-surface: deny
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
+revoked=yes
+result=pass

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt

@@ -0,0 +1,21 @@
+mode=non-member
+at=2026-10-15T17:20:11Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=tegwick
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=refused
+openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
+entity_id=
+policies=
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/data/workloads/reuse/reuse-surface: not-run
+platform/metadata/workloads/reuse/reuse-surface: not-run
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
+revoked=n/a
+result=pass

workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md

@@ -8,7 +8,7 @@ status: active
 owner: claude
 topic_slug: railiance
 created: "2026-10-14"
-updated: "2026-10-14"
+updated: "2026-10-15"
 state_hub_workstream_id: "04f7c4aa-0a24-5d61-994d-2487ca6bfb91"
 ---
 
@@ -18,7 +18,8 @@ MASON-WP-0012. Background: MASON-WP-0011 and CCR-2026-0044.
 
 ## Boundaries
 
-- Repo changes and tests only. Nothing is applied to OpenBao or the cluster.
+- Initial preparation was repo-only. Founder approved CCR-2026-0045 in both
+  required roles and the overlay deployment on 2026-10-15; live results below.
 - `ops-mason-survey` is not touched.
 - `workload-kv-read-reuse-surface-runtime` is not attached to entity
   `4a1f663c-0621-0483-edd0-f852274f4b6b`.
@@ -40,13 +41,13 @@ CCR-2026-0045 sets it for the reuse-surface hub-writer caller and supersedes
 CCR-2026-0044 once applied. `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl`
 matches the generated body. Tests in `tests/test_credential_change.py`.
 
-Done 2026-10-14 in the repo. The live policy is unchanged.
+Source done 2026-10-14; live policy applied 2026-10-15 under CCR-2026-0045.
 
 ## Apply CCR-2026-0045
 
 ```task
 id: RPF-WP-0057-T02
-status: wait
+status: done
 depends_on: [RPF-WP-0057-T01]
 priority: high
 state_hub_task_id: "d3236de5-a3b5-5373-8a3b-725294e94fd6"
@@ -72,13 +73,13 @@ offers only the roles in `presets.json` `workloadRoles`
 (`reuse-surface-hub-writer-workload-kv-read`). Test:
 `tests/test_openbao_ui_role_select.py` (node harness).
 
-Done 2026-10-14 in the repo. The live overlay is unchanged.
+Source done 2026-10-14; live overlay deployed 2026-10-15.
 
 ## Deploy the overlay
 
 ```task
 id: RPF-WP-0057-T04
-status: wait
+status: progress
 depends_on: [RPF-WP-0057-T03]
 priority: medium
 state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265"
@@ -87,3 +88,25 @@ state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265"
 Operator runs `make openbao-overlay-apply` then
 `make openbao-verify-login-overlay`, and one attended browser login per role
 (the workload role in a private window).
+
+
+### Live acceptance — 2026-10-15
+
+T02 done: founder approved as platform-operator and reuse-surface-owner in the
+NK-WP-0051 sitting. Validate/dry-run/plan-only passed without warnings. Contained
+`platform-root` login (`net-kingdom-admins`, `aal2`) applied metadata and exited
+0 with session self-revocation. Both subsequent ops-mason proofs passed with
+capabilities-self only; member token self-revocation succeeded. No KV values read.
+[Acceptance and sanitized receipts](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json).
+
+T04 in progress: `make openbao-overlay-apply` succeeded on cluster UID
+`a553c742-0115-43d4-99a4-a5ca56fe0786`; gateway rollout passed.
+`make openbao-verify-login-overlay` passed after a transient connection reset
+during restart. Admin and workload roles were exercised through native attended
+OIDC logins. Separate browser clickthrough of the deployed UI role-selection
+controls remains in this task; no UI clickthrough is claimed from CLI logins.
+
+Validation: 64 platform tests passed; two unrelated existing failures concern
+CCR-2026-0035 schema and the core-hub expected resource inventory. The target
+CCR validates without warnings. NK-WP-0051's native diagnosis/refusal proof is
+accepted; this owner task retains the remaining UI control check.