Approve CCR-2026-0044 for the hub-writer caller.

Founder approval covers platform-operator and reuse-surface-owner. The policy file gains lookup-self and revoke-self. No KV write.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6

credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml

@@ -3,17 +3,17 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Name the dedicated reuse-surface hub-writer caller
-status: proposed
+status: approved
 created: '2026-10-14'
 updated: '2026-10-14'
 requester:
   agent: ops-mason
-  reason: 'CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and
-    does not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries
-    default, operator-custody and platform-admin, so its token can reach the data
-    path, the metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime
+  reason: CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and does
+    not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries default,
+    operator-custody and platform-admin, so its token can reach the data path, the
+    metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime
     to that entity. Bind a new OIDC role to a different principal. No secret value
-    is rotated or read by this request.'
+    is rotated or read by this request.
 review:
   required: true
   required_approvers:
@@ -23,13 +23,27 @@ review:
   - at: '2026-10-14T16:40:00Z'
     reviewer: grok
     decision: filed_proposed
-    comment: 'Filed from ops-mason fd2c5a5 (State Hub 3642bdc4, MASON-WP-0011).
-      Status stays proposed. bound_claims_confirmed stays false until key-cape
-      confirms group reuse-surface-hub-writers and a member entity other than
-      4a1f663c-0621-0483-edd0-f852274f4b6b. The caller policy file is unchanged;
-      apply, after platform-operator and reuse-surface-owner approval, is what
-      adds lookup-self and revoke-self. CCR-2026-0005 remains the KV and ESO
-      authority. No KV write and no attachment to the platform-admin entity.'
+    comment: Filed from ops-mason fd2c5a5 (State Hub 3642bdc4, MASON-WP-0011). Status
+      stays proposed. bound_claims_confirmed stays false until key-cape confirms group
+      reuse-surface-hub-writers and a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b.
+      The caller policy file is unchanged; apply, after platform-operator and reuse-surface-owner
+      approval, is what adds lookup-self and revoke-self. CCR-2026-0005 remains the
+      KV and ESO authority. No KV write and no attachment to the platform-admin entity.
+  - at: '2026-10-14T17:44:49+00:00'
+    reviewer: platform-operator, reuse-surface-owner (founder Bernd Worsch)
+    decision: approved
+    comment: Founder go-ahead 2026-10-14. Approves CCR-2026-0044 as platform-operator
+      and reuse-surface-owner. Group reuse-surface-hub-writers, member bernd.worsch-3,
+      second factor enrolled, entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1. That entity
+      is not 4a1f663c-0621-0483-edd0-f852274f4b6b. No KV write. Do not attach the
+      policy to the admin entity.
+  - at: '2026-10-14T17:44:49+00:00'
+    reviewer: founder Bernd Worsch
+    decision: binding_confirmed
+    comment: Bound claims are groups=reuse-surface-hub-writers and /assurance/level=aal2.
+      Member is bernd.worsch-3, entity f94b7c34-e151-30bb-b473-df3ccdbb9bf1. The apply
+      checks that entity's policy names and stops if platform-admin or operator-custody
+      is present.
 target:
   domain: financials
   tenant: reuse
@@ -66,7 +80,7 @@ openbao:
       groups:
       - reuse-surface-hub-writers
       /assurance/level: aal2
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
     policies:
     - workload-kv-read-reuse-surface-runtime
     ttl: 15m
@@ -78,9 +92,9 @@ access_frontdoor:
   type: ops-warden
   catalog_id: reuse-surface-hub-write-token
   selector: reuse-surface federation hub write bearer token
-  command: 'After a passing member receipt, run warden access reuse-surface-hub-write-token
+  command: After a passing member receipt, run warden access reuse-surface-hub-write-token
     --exec --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane
-    token. Do not use --fetch.'
+    token. Do not use --fetch.
   resolvable: false
   readiness: pending-review
 risk:
@@ -98,7 +112,8 @@ risk:
 verification:
   positive:
   - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
-  - That token's capabilities are read on the exact data path and the exact metadata path.
+  - That token's capabilities are read on the exact data path and the exact metadata
+    path.
   negative:
   - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata
     parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
@@ -109,8 +124,8 @@ verification:
   - key-cape confirms the group and that the member entity has no platform-admin or
     operator-custody identity policy.
   - Founder applies policy and role through the delegated applier. No KV write.
-  - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass.
-    Receipts stay mode 0600 and contain no token or field value.
+  - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass. Receipts
+    stay mode 0600 and contain no token or field value.
 lifecycle:
   deactivate: delete auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read.
     Leave the KV path, the ESO role, and CCR-2026-0005 delivery in place.

openbao/policies/workload-kv-read-reuse-surface-runtime.hcl

@@ -1,7 +1,18 @@
+# CCR-2026-0044 adds lookup-self and revoke-self for the dedicated caller.
+# Do not attach this policy to entity 4a1f663c-0621-0483-edd0-f852274f4b6b.
+
 path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
   capabilities = ["read"]
 }
 
 path "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" {
   capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
 }