CCR-2026-0044: file the reuse-surface hub-writer caller as proposed

Copied from ops-mason fd2c5a5 for MASON-WP-0011. Not approved or applied.
bound_claims_confirmed stays false, the caller policy file is unchanged,
and no KV write or platform-admin binding is authorized.

Assistant: grok
Assistant-Session: 01a13b3e-0402-7a83-a827-6b29197b7132

credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml

@@ -0,0 +1,119 @@
+id: CCR-2026-0044
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Name the dedicated reuse-surface hub-writer caller
+status: proposed
+created: '2026-10-14'
+updated: '2026-10-14'
+requester:
+  agent: ops-mason
+  reason: 'CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and
+    does not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries
+    default, operator-custody and platform-admin, so its token can reach the data
+    path, the metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime
+    to that entity. Bind a new OIDC role to a different principal. No secret value
+    is rotated or read by this request.'
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  - reuse-surface-owner
+  comments:
+  - at: '2026-10-14T16:40:00Z'
+    reviewer: grok
+    decision: filed_proposed
+    comment: 'Filed from ops-mason fd2c5a5 (State Hub 3642bdc4, MASON-WP-0011).
+      Status stays proposed. bound_claims_confirmed stays false until key-cape
+      confirms group reuse-surface-hub-writers and a member entity other than
+      4a1f663c-0621-0483-edd0-f852274f4b6b. The caller policy file is unchanged;
+      apply, after platform-operator and reuse-surface-owner approval, is what
+      adds lookup-self and revoke-self. CCR-2026-0005 remains the KV and ESO
+      authority. No KV write and no attachment to the platform-admin entity.'
+target:
+  domain: financials
+  tenant: reuse
+  workload: reuse-surface
+  environment: production
+  purpose: Attended read of the existing hub writer token by one dedicated caller.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/reuse/reuse-surface/runtime-secrets
+  fields:
+  - REUSE_SURFACE_TOKEN
+  - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+  policy_name: workload-kv-read-reuse-surface-runtime
+  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
+  metadata_read: true
+  token_self_lifecycle: true
+  auth:
+    method: oidc
+    mount: netkingdom
+    role: reuse-surface-hub-writer-workload-kv-read
+    allowed_redirect_uris:
+    - http://localhost:8250/oidc/callback
+    - http://127.0.0.1:8250/oidc/callback
+    - http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
+    oidc_scopes:
+    - openid
+    - profile
+    - email
+    - groups
+    user_claim: sub
+    groups_claim: groups
+    bound_claims_type: string
+    bound_claims:
+      groups:
+      - reuse-surface-hub-writers
+      /assurance/level: aal2
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-reuse-surface-runtime
+    ttl: 15m
+    token_max_ttl: 30m
+    token_explicit_max_ttl: 30m
+    token_no_default_policy: true
+    token_type: service
+access_frontdoor:
+  type: ops-warden
+  catalog_id: reuse-surface-hub-write-token
+  selector: reuse-surface federation hub write bearer token
+  command: 'After a passing member receipt, run warden access reuse-surface-hub-write-token
+    --exec --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane
+    token. Do not use --fetch.'
+  resolvable: false
+  readiness: pending-review
+risk:
+  classification: high
+  notes:
+  - REUSE_SURFACE_TOKEN writes to the production federation hub. This request does
+    not read or rotate it.
+  - The platform-admin entity must not receive this policy. OpenBao merges entity
+    policies into every token for that entity.
+  - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes
+    role. This role does not attach it.
+  - bound_claims_confirmed stays false until key-cape confirms group reuse-surface-hub-writers
+    and a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b.
+  - Public bao.coulomb.social ingress is not a callback. Use the workstation tunnel.
+verification:
+  positive:
+  - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
+  - That token's capabilities are read on the exact data path and the exact metadata path.
+  negative:
+  - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata
+    parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
+  - A principal outside reuse-surface-hub-writers is refused by the role.
+  - Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity.
+  activation_conditions:
+  - platform-operator and reuse-surface-owner approve this caller binding.
+  - key-cape confirms the group and that the member entity has no platform-admin or
+    operator-custody identity policy.
+  - Founder applies policy and role through the delegated applier. No KV write.
+  - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass.
+    Receipts stay mode 0600 and contain no token or field value.
+lifecycle:
+  deactivate: delete auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read.
+    Leave the KV path, the ESO role, and CCR-2026-0005 delivery in place.
+  rotate: unchanged from CCR-2026-0005. This request does not rotate field values.
+  compromised: detach the role, revoke outstanding tokens for the role, and follow
+    the CCR-2026-0005 compromise procedure if a field value was exposed.