railiance-platform/credential-change-requests/CCR-2026-0045-reuse-surface-hub-writer-capabilities-self.yaml

id: CCR-2026-0045
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Let the reuse-surface hub-writer caller query its own capabilities
status: applied
created: '2026-10-14'
updated: '2026-10-15'
supersedes: CCR-2026-0044
requester:
  agent: ops-mason
  reason: NK-WP-0051-T06 / MASON-WP-0012. The CCR-2026-0044 member proof called sys/capabilities
    with a root or platform-admin token because the lane policy has no capabilities-self
    grant. This request adds a generated sys/capabilities-self grant (update; the
    endpoint is a POST and returns capability names only) so the lane token proves
    its own reach. Policy, role, bound claims and token bounds are otherwise unchanged
    from CCR-2026-0044. Do not attach workload-kv-read-reuse-surface-runtime to entity
    4a1f663c-0621-0483-edd0-f852274f4b6b. No secret value is read, written or rotated.
review:
  required: true
  required_approvers:
  - platform-operator
  - reuse-surface-owner
  comments:
  - at: '2026-10-14T21:00:00Z'
    reviewer: claude
    decision: filed_proposed
    comment: Filed for NK-WP-0051-T06 (RPF-WP-0057). Repo policy file now carries
      the generated sys/capabilities-self grant; the live policy is unchanged until
      approval and a delegated apply. Bound claims are those confirmed under CCR-2026-0044
      (groups=reuse-surface-hub-writers, /assurance/level=aal2); this request does
      not change them.
  - at: '2026-10-15T08:55:59+00:00'
    reviewer: Bernd Worsch (founder; platform-operator and reuse-surface-owner)
    decision: approved
    comment: 'Approved in the NetKingdom NK-WP-0051 attended session on 2026-10-15,
      in response to the explicit request covering both approval roles, CCR-2026-0045
      capabilities-self metadata apply, and the prepared RPF-WP-0057 login-page deployment.
      Negative fixture selected: tegwick; founder confirms MFA enrolled and railiance-admins
      membership only.'
target:
  domain: financials
  tenant: reuse
  workload: reuse-surface
  environment: production
  purpose: Attended read of the existing hub writer token by one dedicated caller.
openbao:
  mount: platform
  kv_path: platform/workloads/reuse/reuse-surface/runtime-secrets
  fields:
  - REUSE_SURFACE_TOKEN
  - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
  policy_name: workload-kv-read-reuse-surface-runtime
  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
  metadata_read: true
  token_self_lifecycle: true
  auth:
    method: oidc
    mount: netkingdom
    role: reuse-surface-hub-writer-workload-kv-read
    allowed_redirect_uris:
    - http://localhost:8250/oidc/callback
    - http://127.0.0.1:8250/oidc/callback
    - http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
    oidc_scopes:
    - openid
    - profile
    - email
    - groups
    user_claim: sub
    groups_claim: groups
    bound_claims_type: string
    bound_claims:
      groups:
      - reuse-surface-hub-writers
      /assurance/level: aal2
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-reuse-surface-runtime
    ttl: 15m
    token_max_ttl: 30m
    token_explicit_max_ttl: 30m
    token_no_default_policy: true
    token_type: service
  token_capabilities_self: true
access_frontdoor:
  type: ops-warden
  catalog_id: reuse-surface-hub-write-token
  selector: reuse-surface federation hub write bearer token
  command: After a passing member receipt, run warden access reuse-surface-hub-write-token
    --exec --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane
    token. Do not use --fetch.
  resolvable: false
  readiness: pending-review
risk:
  classification: high
  notes:
  - sys/capabilities-self reports capability names for paths the caller names. It
    returns no secret value and grants no access.
  - The platform-admin entity must not receive this policy. OpenBao merges entity
    policies into every token for that entity.
  - The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes
    role and is unchanged.
  - Until this apply, the live lane policy differs from openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
    by this one stanza; CCR-2026-0044 member proofs stay on the earlier operator-token
    path.
verification:
  positive:
  - A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
  - That token's capabilities are read on the exact data path and the exact metadata
    path.
  - The member token can call sys/capabilities-self on the five proof paths without
    any operator or root token.
  negative:
  - The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata
    parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
  - A principal outside reuse-surface-hub-writers is refused by the role.
  - Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity.
  activation_conditions:
  - platform-operator and reuse-surface-owner approve this request.
  - Founder applies the policy through the delegated applier. No KV write, no role
    change beyond re-asserting the CCR-2026-0044 role.
  - ops-mason scripts/verify-reuse-surface-hub-writer.py member passes using capabilities-self
    only, and non-member records the OpenBao refusal verbatim. Receipts stay mode
    0600 with no token or field value.
  evidence:
  - at: '2026-10-15T17:13:16+00:00'
    actor: Bernd Worsch (founder), via codex conduit
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as Bernd Worsch (founder), via codex conduit
      using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-reuse-surface-runtime'
    - 'Auth role metadata write: auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-10-15T17:22:52+00:00'
    actor: Bernd Worsch (founder), via codex conduit
    kind: positive_verification
    result: passed
    details:
    - Attended bernd.worsch-3 diagnosis aal2 and hub-writers group confirmed; exact
      workload policy, intended reads, parent/sibling denial and self-revocation passed
      using capabilities-self. Receipt docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-member.txt
  - at: '2026-10-15T17:22:52+00:00'
    actor: Bernd Worsch (founder), via codex conduit
    kind: negative_verification
    result: passed
    details:
    - 'Founder-selected tegwick diagnosis showed railiance-admins only and aal2 before
      the workload role refused the groups bound claim. Native sanitized receipt names
      same uid and preserves error: docs/evidence/2026-10-15-sign-in-diagnosis/reuse-surface-hub-writer-non-member.txt'
lifecycle:
  deactivate: Re-apply the CCR-2026-0044 policy body (drop the sys/capabilities-self
    stanza). Leave the role, KV path and ESO lane in place.
  rotate: unchanged from CCR-2026-0005. This request does not rotate field values.
  compromised: detach the role, revoke outstanding tokens for the role, and follow
    the CCR-2026-0005 compromise procedure if a field value was exposed.