Record approved capabilities-self apply and attended caller proofs

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/evidence/2026-10-15-sign-in-diagnosis/acceptance.json

@@ -0,0 +1,64 @@
+{
+  "workplan": "NK-WP-0051",
+  "date": "2026-10-15",
+  "result": "pass",
+  "source": "Attended founder observations in this session, ops-mason native verifier receipts, railiance-platform delegated applier and overlay checks",
+  "admin": {
+    "uid": "platform-root",
+    "groups": [
+      "activity-core-operators",
+      "net-kingdom-admins",
+      "net-kingdom-users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "contained_session_exit": 0,
+    "ccr": "CCR-2026-0045",
+    "ccr_status": "applied"
+  },
+  "member": {
+    "uid": "bernd.worsch-3",
+    "groups": [
+      "reuse-surface-hub-writers",
+      "tenant:trial:demo-company:users",
+      "whynot-design"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "accepted",
+    "revoked": true
+  },
+  "non_member": {
+    "uid": "tegwick",
+    "groups": [
+      "railiance-admins"
+    ],
+    "assurance": "aal2",
+    "client_id": "openbao-admin",
+    "result": "refused",
+    "openbao_error": "Vault login failed. error validating claims: claim \"groups\" does not match any associated bound claim values"
+  },
+  "overlay": {
+    "apply": "passed",
+    "verify": "passed after transient connection reset during gateway rollout",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "ui_role_browser_clickthrough": "Not separately exercised; retained in RPF-WP-0057-T04. Native attended OIDC logins for both roles passed expected outcomes."
+  },
+  "verification": {
+    "directory_helper": "68 passed",
+    "platform_credential_and_ui_tests": "64 passed, 2 unrelated failures: CCR-2026-0035 schema validation; core-hub resource inventory expectation",
+    "ccr_0045_validate": "passed",
+    "ccr_0045_dry_run": "passed; no warnings"
+  },
+  "limits": [
+    "No KV secret values read",
+    "User diagnosis values are founder observations, not independently captured browser evidence",
+    "No independent live platform-admin entity-policy inventory performed",
+    "No changes to directory memberships, admin entity policy, or ops-mason-survey"
+  ],
+  "receipts": {
+    "reuse-surface-hub-writer-member.txt": "1b61f06bba55562dc833345f8c10cfa286212f84815b9fcdcdb6f28c9cf0a328",
+    "reuse-surface-hub-writer-non-member.txt": "94fa475eb31e4c6a61c223b997b426c960a5144384d4aa688b4de01c8a47d322"
+  }
+}

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt

@@ -0,0 +1,21 @@
+mode=member
+at=2026-10-15T17:16:54Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=bernd.worsch-3
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=ok
+openbao_error=
+entity_id=c204099b-cb94-363f-e207-5ff4d4aa6e94
+policies=workload-kv-read-reuse-surface-runtime
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: read
+platform/data/workloads/reuse/reuse-surface: deny
+platform/metadata/workloads/reuse/reuse-surface: deny
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: deny
+revoked=yes
+result=pass

docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt

@@ -0,0 +1,21 @@
+mode=non-member
+at=2026-10-15T17:20:11Z
+addr=http://127.0.0.1:18200
+role=reuse-surface-hub-writer-workload-kv-read
+policy=workload-kv-read-reuse-surface-runtime
+uid=tegwick
+uid_source=operator
+assurance=aal2
+assurance_source=operator
+login=refused
+openbao_error=Error authenticating: Error making API request. | URL: GET http://127.0.0.1:18200/v1/auth/netkingdom/oidc/callback?client_nonce=cnM23po0ewSOMtT1AhuU&code=[redacted]&id_token=&state=st_GrdNJIELAV9Evdxna5YB | Code: 400. Errors: | * Vault login failed. error validating claims: claim "groups" does not match any associated bound claim values
+entity_id=
+policies=
+identity_policies=
+platform/data/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/metadata/workloads/reuse/reuse-surface/runtime-secrets: not-run
+platform/data/workloads/reuse/reuse-surface: not-run
+platform/metadata/workloads/reuse/reuse-surface: not-run
+platform/data/workloads/issue-core/issue-core/issue-core-runtime: not-run
+revoked=n/a
+result=pass