diff --git a/credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml b/credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml index 2e9a261..925d411 100644 --- a/credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml +++ b/credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml @@ -3,19 +3,19 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Let the reuse-surface hub-writer caller query its own capabilities -status: proposed +status: applied created: '2026-10-14' -updated: '2026-10-14' +updated: '2026-10-15' supersedes: CCR-2026-0044 requester: agent: ops-mason reason: NK-WP-0051-T06 / MASON-WP-0012. The CCR-2026-0044 member proof called sys/capabilities - with a root or platform-admin token because the lane policy has no capabilities-self grant. - This request adds a generated sys/capabilities-self grant (update; the endpoint is a POST - and returns capability names only) so the lane token proves its own reach. Policy, role, - bound claims and token bounds are otherwise unchanged from CCR-2026-0044. Do not attach - workload-kv-read-reuse-surface-runtime to entity 4a1f663c-0621-0483-edd0-f852274f4b6b. No - secret value is read, written or rotated. + with a root or platform-admin token because the lane policy has no capabilities-self + grant. This request adds a generated sys/capabilities-self grant (update; the + endpoint is a POST and returns capability names only) so the lane token proves + its own reach. Policy, role, bound claims and token bounds are otherwise unchanged + from CCR-2026-0044. Do not attach workload-kv-read-reuse-surface-runtime to entity + 4a1f663c-0621-0483-edd0-f852274f4b6b. No secret value is read, written or rotated. review: required: true required_approvers: @@ -25,10 +25,19 @@ review: - at: '2026-10-14T21:00:00Z' reviewer: claude decision: filed_proposed - comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries the generated - sys/capabilities-self grant; the live policy is unchanged until approval and a delegated - apply. Bound claims are those confirmed under CCR-2026-0044 (groups=reuse-surface-hub-writers, - /assurance/level=aal2); this request does not change them. + comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries + the generated sys/capabilities-self grant; the live policy is unchanged until + approval and a delegated apply. Bound claims are those confirmed under CCR-2026-0044 + (groups=reuse-surface-hub-writers, /assurance/level=aal2); this request does + not change them. + - at: '2026-10-15T08:55:59+00:00' + reviewer: Bernd Worsch (founder; platform-operator and reuse-surface-owner) + decision: approved + comment: 'Approved in the NetKingdom NK-WP-0051 attended session on 2026-10-15, + in response to the explicit request covering both approval roles, CCR-2026-0045 + capabilities-self metadata apply, and the prepared RPF-WP-0057 login-page deployment. + Negative fixture selected: tegwick; founder confirms MFA enrolled and railiance-admins + membership only.' target: domain: financials tenant: reuse @@ -78,44 +87,72 @@ access_frontdoor: type: ops-warden catalog_id: reuse-surface-hub-write-token selector: reuse-surface federation hub write bearer token - command: After a passing member receipt, run warden access reuse-surface-hub-write-token --exec - --field REUSE_SURFACE_TOKEN -- with the unprinted lane token. Do not use - --fetch. + command: After a passing member receipt, run warden access reuse-surface-hub-write-token + --exec --field REUSE_SURFACE_TOKEN -- with the unprinted lane + token. Do not use --fetch. resolvable: false readiness: pending-review risk: classification: high notes: - - sys/capabilities-self reports capability names for paths the caller names. It returns no - secret value and grants no access. - - The platform-admin entity must not receive this policy. OpenBao merges entity policies into - every token for that entity. - - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes role and - is unchanged. + - sys/capabilities-self reports capability names for paths the caller names. It + returns no secret value and grants no access. + - The platform-admin entity must not receive this policy. OpenBao merges entity + policies into every token for that entity. + - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes + role and is unchanged. - Until this apply, the live lane policy differs from openbao/policies/workload-kv-read-reuse-surface-runtime.hcl - by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token path. + by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token + path. verification: positive: - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime. - - That token's capabilities are read on the exact data path and the exact metadata path. - - The member token can call sys/capabilities-self on the five proof paths without any operator - or root token. + - That token's capabilities are read on the exact data path and the exact metadata + path. + - The member token can call sys/capabilities-self on the five proof paths without + any operator or root token. negative: - - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata parent, - and platform/data/workloads/issue-core/issue-core/issue-core-runtime. + - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata + parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime. - A principal outside reuse-surface-hub-writers is refused by the role. - Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity. activation_conditions: - platform-operator and reuse-surface-owner approve this request. - - Founder applies the policy through the delegated applier. No KV write, no role change beyond - re-asserting the CCR-2026-0044 role. + - Founder applies the policy through the delegated applier. No KV write, no role + change beyond re-asserting the CCR-2026-0044 role. - ops-mason scripts/verify-reuse-surface-hub-writer.py member passes using capabilities-self - only, and non-member records the OpenBao refusal verbatim. Receipts stay mode 0600 with - no token or field value. - evidence: [] + only, and non-member records the OpenBao refusal verbatim. Receipts stay mode + 0600 with no token or field value. + evidence: + - at: '2026-10-15T17:13:16+00:00' + actor: Bernd Worsch (founder), via codex conduit + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as Bernd Worsch (founder), via codex conduit + using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-reuse-surface-runtime' + - 'Auth role metadata write: auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read' + - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-15T17:22:52+00:00' + actor: Bernd Worsch (founder), via codex conduit + kind: positive_verification + result: passed + details: + - Attended bernd.worsch-3 diagnosis aal2 and hub-writers group confirmed; exact + workload policy, intended reads, parent/sibling denial and self-revocation passed + using capabilities-self. Receipt docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt + - at: '2026-10-15T17:22:52+00:00' + actor: Bernd Worsch (founder), via codex conduit + kind: negative_verification + result: passed + details: + - 'Founder-selected tegwick diagnosis showed railiance-admins only and aal2 before + the workload role refused the groups bound claim. Native sanitized receipt names + same uid and preserves error: docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt' lifecycle: - deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self stanza). - Leave the role, KV path and ESO lane in place. + deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self + stanza). Leave the role, KV path and ESO lane in place. rotate: unchanged from CCR-2026-0005. This request does not rotate field values. - compromised: detach the role, revoke outstanding tokens for the role, and follow the CCR-2026-0005 - compromise procedure if a field value was exposed. + compromised: detach the role, revoke outstanding tokens for the role, and follow + the CCR-2026-0005 compromise procedure if a field value was exposed. diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json new file mode 100644 index 0000000..886fa08 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json @@ -0,0 +1,64 @@ +{ + "workplan": "NK-WP-0051", + "date": "2026-10-15", + "result": "pass", + "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks", + "admin": { + "uid": "platform-root", + "groups": [ + "activity-core-operators", + "net-kingdom-admins", + "net-kingdom-users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "contained_session_exit": 0, + "ccr": "CCR-2026-0045", + "ccr_status": "applied" + }, + "member": { + "uid": "bernd.worsch-3", + "groups": [ + "reuse-surface-hub-writers", + "tenant:trial:demo-company:users", + "whynot-design" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "accepted", + "revoked": true + }, + "non_member": { + "uid": "tegwick", + "groups": [ + "railiance-admins" + ], + "assurance": "aal2", + "client_id": "openbao-admin", + "result": "refused", + "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values" + }, + "overlay": { + "apply": "passed", + "verify": "passed after transient connection reset during gateway rollout", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes." + }, + "verification": { + "directory_helper": "68 passed", + "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation", + "ccr_0045_validate": "passed", + "ccr_0045_dry_run": "passed; no warnings" + }, + "limits": [ + "No KV secret values read", + "User diagnosis values are founder observations, not independently captured browser evidence", + "No independent live platform-admin entity-policy inventory performed", + "No changes to directory memberships, admin entity policy, or ops-mason-survey" + ], + "receipts": { + "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328", + "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322" + } +} diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt new file mode 100644 index 0000000..d0cb1b0 --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt @@ -0,0 +1,21 @@ +mode=member +at=2026-10-15T17:16:54Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=bernd.worsch-3 +uid_source=operator +assurance=aal2 +assurance_source=operator +login=ok +openbao_error= +entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94 +policies=workload-kv-read-reuse-surface-runtime +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: read +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read +platform/data/workloads/reuse/reuse-surface: deny +platform/metadata/workloads/reuse/reuse-surface: deny +platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny +revoked=yes +result=pass diff --git a/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt new file mode 100644 index 0000000..44ce20f --- /dev/null +++ b/docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt @@ -0,0 +1,21 @@ +mode=non-member +at=2026-10-15T17:20:11Z +addr=http://127.0.0.1:18200 +role=reuse-surface-hub-writer-workload-kv-read +policy=workload-kv-read-reuse-surface-runtime +uid=tegwick +uid_source=operator +assurance=aal2 +assurance_source=operator +login=refused +openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values +entity_id= +policies= +identity_policies= +platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run +platform/data/workloads/reuse/reuse-surface: not-run +platform/metadata/workloads/reuse/reuse-surface: not-run +platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run +revoked=n/a +result=pass diff --git a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md index 56c71d5..440351d 100644 --- a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md +++ b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md @@ -8,7 +8,7 @@ status: active owner: claude topic_slug: railiance created: "2026-10-14" -updated: "2026-10-14" +updated: "2026-10-15" state_hub_workstream_id: "04f7c4aa-0a24-5d61-994d-2487ca6bfb91" --- @@ -18,7 +18,8 @@ MASON-WP-0012. Background: MASON-WP-0011 and CCR-2026-0044. ## Boundaries -- Repo changes and tests only. Nothing is applied to OpenBao or the cluster. +- Initial preparation was repo-only. Founder approved CCR-2026-0045 in both + required roles and the overlay deployment on 2026-10-15; live results below. - `ops-mason-survey` is not touched. - `workload-kv-read-reuse-surface-runtime` is not attached to entity `4a1f663c-0621-0483-edd0-f852274f4b6b`. @@ -40,13 +41,13 @@ CCR-2026-0045 sets it for the reuse-surface hub-writer caller and supersedes CCR-2026-0044 once applied. `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl` matches the generated body. Tests in `tests/test_credential_change.py`. -Done 2026-10-14 in the repo. The live policy is unchanged. +Source done 2026-10-14; live policy applied 2026-10-15 under CCR-2026-0045. ## Apply CCR-2026-0045 ```task id: RPF-WP-0057-T02 -status: wait +status: done depends_on: [RPF-WP-0057-T01] priority: high state_hub_task_id: "d3236de5-a3b5-5373-8a3b-725294e94fd6" @@ -72,13 +73,13 @@ offers only the roles in `presets.json` `workloadRoles` (`reuse-surface-hub-writer-workload-kv-read`). Test: `tests/test_openbao_ui_role_select.py` (node harness). -Done 2026-10-14 in the repo. The live overlay is unchanged. +Source done 2026-10-14; live overlay deployed 2026-10-15. ## Deploy the overlay ```task id: RPF-WP-0057-T04 -status: wait +status: progress depends_on: [RPF-WP-0057-T03] priority: medium state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265" @@ -87,3 +88,25 @@ state_hub_task_id: "94cdfd1c-c639-5c5e-9bd6-7db823ab0265" Operator runs `make openbao-overlay-apply` then `make openbao-verify-login-overlay`, and one attended browser login per role (the workload role in a private window). + + +### Live acceptance — 2026-10-15 + +T02 done: founder approved as platform-operator and reuse-surface-owner in the +NK-WP-0051 sitting. Validate/dry-run/plan-only passed without warnings. Contained +`platform-root` login (`net-kingdom-admins`, `aal2`) applied metadata and exited +0 with session self-revocation. Both subsequent ops-mason proofs passed with +capabilities-self only; member token self-revocation succeeded. No KV values read. +[Acceptance and sanitized receipts](../docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json). + +T04 in progress: `make openbao-overlay-apply` succeeded on cluster UID +`a553c742-0115-43d4-99a4-a5ca56fe0786`; gateway rollout passed. +`make openbao-verify-login-overlay` passed after a transient connection reset +during restart. Admin and workload roles were exercised through native attended +OIDC logins. Separate browser clickthrough of the deployed UI role-selection +controls remains in this task; no UI clickthrough is claimed from CLI logins. + +Validation: 64 platform tests passed; two unrelated existing failures concern +CCR-2026-0035 schema and the core-hub expected resource inventory. The target +CCR validates without warnings. NK-WP-0051's native diagnosis/refusal proof is +accepted; this owner task retains the remaining UI control check.