ops-mason/SCOPE.md

# SCOPE

## One-liner

Builder of NetKingdom security infrastructure — creates, changes,
maintains, and tears down OpenBao AppRoles, policies, and KV secret paths
so ops-warden always has something real to route to.

## Core Idea

Four-phase process: (1) construction plan — respect/extend/compact
existing structure before proposing new; (2) review/optimize against
what already exists; (3) executive summary — the one mandatory human
decision gate, in plain terms; (4) build, only after approval.

## In Scope

- Construction plans for new/changed/retired OpenBao AppRoles, policies,
  KV secret path *structure* (never values)
- Consistency review — reuse over duplication, compaction over sprawl
- The executive-summary format that makes a plan decidable at a glance
- Proposing pointer-only entries (`warden_executes: false`, no authored
  `steps`) in ops-warden's routing catalog for what it builds — a normal
  git contribution to that repo, not a live API
- Its own audit trail of what it built, under which approved plan

## Out of Scope

- Deciding *whether* access should exist — that's architecture/founder,
  ops-mason builds what's already decided
- Runtime authorization decisions — flex-auth
- Identity/MFA — key-cape/Keycloak
- Routing consumers to lanes once built — ops-warden
- SSH certificate issuance — ops-warden
- OpenBao cluster init/unseal, platform deploy — railiance-platform
- Touching secret values at all, even transiently — delivered via
  ops-warden's existing `paste_once_provision` desk instead

## Current State

Charter only (`INTENT.md`). `MASON-WP-0001` scopes the four-phase
pipeline and its first real exercise: the `rein-openweights` OpenBao
AppRole that `glas-harness/GLAS-WP-0002-T02` is blocked on. No code yet.

## Getting Oriented

- Start with: `INTENT.md`
- Agent instructions: `AGENTS.md`
- Workplans: `workplans/`