ops-mason/AGENTS.md

# ops-mason — Agent Instructions

## Repo Identity

**Purpose:** Builder of NetKingdom security infrastructure (AppRoles, policies, KV paths) for ops-warden to route to

**Domain:** infotech
**Repo slug:** ops-mason
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `MASON-`

---

## State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
there is no MCP server for Codex agents.

| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | http://127.0.0.1:18080 |

When an operator has enabled the edge relay, set API_BASE to the relay URL.
Queueable writes return an explicit queued receipt if the central hub is
unreachable. Treat that as pending local evidence, then ask the operator to run
statehub outbox status/replay after connectivity returns.

### Orient at session start

```bash
# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-mason&unread_only=true" \
  | python3 -m json.tool
```

Mark a message read:
```bash
curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'
```

### Log progress (required at session close)

```bash
curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'
```

Omit `workplan_id` / `task_id` when not applicable.

### Update task status

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel
```

### Flag a task for human review

```bash
curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'
```

---

## Session Protocol

**Start:**
1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
2. Check inbox: `GET /messages/?to_agent=ops-mason&unread_only=true`; mark read
3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
4. Check human-needed tasks: `GET /tasks/?needs_human=true`

**During work:**
- Update task statuses in workplan files as tasks progress
- Record significant decisions via `POST /decisions/`

**Close:**
1. Update workplan file task statuses to reflect progress
2. If finishing a workplan: hand off **residuals** as live work records first
   (intake with `origin: residual` + `origin_ref: <WP-id>`, or a next workplan /
   decision / engagement). Do not park leftovers only in prose or `SCOPE.md`.
   Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals.
3. Log: `POST /progress/` with a summary of what changed (name handoff ids)
4. After workplan file changes, run:
   ```bash
   statehub fix-consistency
   ```
   Coding agents should run this directly; ask the operator only if the CLI or
   State Hub API is unavailable. This syncs task status from files into the hub DB.

---

## Credential and access routing

**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
for inference. Run this check **before** requesting secrets, API keys, SSH access,
login tokens, or database passwords — in any repo, not only `ops-warden`.

ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
other credential need belongs to another subsystem. **Do not** message
`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.

### Lookup (do this first)

```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
```

Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).

| Agent runtime | How to orient |
| --- | --- |
| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=ops-mason` is for coordination, not secret vending |
| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |

### Quick routing table

| I need… | Owner | ops-warden executes? |
| --- | --- | --- |
| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
| Authorization decision | flex-auth | No — route only |
| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |

### Anti-patterns (do not do these)

- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
- Pasting secrets into Git, State Hub, workplans, logs, or chat

### Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through **reuse-surface** federation
(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
every repo's agent instructions because it is high-frequency, high-risk, and easy to
get wrong.

**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`

<!-- REPO-AGENTS-EXTENSIONS -->
<!-- Append repo-specific agent instructions below this marker.
     The state-hub template sync preserves content after this line. -->

## Secrets practice guide

From 2026-10-11, secrets practice follows SecurityCanon `SEC-DSM` 1.0.0:

`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`

Gate House teaches that standard. This repo builds routes inside it. Read these
parts before proposing a credential:

- §5 preference hierarchy, highest practical mechanism first
- §37 decision procedure, questions Q1 through Q5, in order
- §35 OpenBao/Vault mapping — a broker is not the default store for every value
- §36 Kubernetes mapping — projected workload identity before a secret broker;
  Kubernetes Secrets are a delivery copy, not the authority
- `DSM-ARCH-001` through `DSM-ARCH-004`, `DSM-TRANS-002`, `DSM-TRANS-003`,
  `DSM-K8S-001` through `DSM-K8S-004`

A new static secret, AppRole, or KV path is allowed when Q1–Q3 are no. The plan
records that answer, the owner, the consumers, the authority, and how the
residual secret is rotated and revoked (`DSM-TRANS-002`). Do not add an issuance
layer only to look dynamic (`DSM-TRANS-003`). Do not put secret values in the
plan, the workplan, or chat.

---

## Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files.

**File location:** `workplans/MASON-NNNN-<slug>.md`

**Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-MASON-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change.

**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
this only for low-risk work completed directly; create a normal workplan for
anything needing analysis, design, approval, dependencies, or multiple phases.

**Frontmatter:**

```yaml
---
id: MASON-NNNN
type: workplan
title: "..."
domain: infotech
repo: ops-mason
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # fix-consistency — do not edit (legacy field name; workplan UUID)
---
```

Use `proposed` for a new draft, `ready` after review against current repo
state, and `finished` after implementation. `stalled` and `needs_review` are
derived health labels, not frontmatter statuses.

**Terminology:** workplan is the fleet term; `workstream` appears only in legacy
API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.

**Task block format** (one per `##` section):

```
## Task Title

` ` `task
id: MASON-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.
```

Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.

**Residuals when finishing:** actionable leftovers become live work records
before `status: finished` — usually an intake (`origin: residual`,
`origin_ref: MASON-NNNN`) or a spawned workplan. Residual is a *role*,
not a kind. Fleet list lives on State Hub, not in `SCOPE.md`.

To create a new workplan:
1. Write the file following the format above
2. Run `statehub fix-consistency` locally; ask the operator only if the CLI or
   State Hub API is unavailable.

## OpenBao Access — how to grant a session, and what it authorises

ops-mason builds in OpenBao, so it needs a session. Do not hand it your own
operator session: that gives everything you have, for as long as you have it,
and every action lands in the audit log as you.

```bash
./scripts/bao-session.sh status          # what session exists, if any
./scripts/bao-session.sh login           # refresh YOUR operator session (OIDC)
./scripts/bao-session.sh grant <task>    # mint a scoped token for Claude
./scripts/bao-session.sh revoke          # end it immediately
```

With a grant in place, generate a construction plan's section 2 with
`./scripts/plan-survey.py --kv-path <path> --policy <name> --approle <role>
--consumer <repo> [--keyword <word>]` (metadata only; see
`docs/construction-plan-format.md` § 2).

`grant` mints a **separate** token into `~/.claude-bao-token` — your own
`~/.vault-token` is untouched, and the two revoke independently. The agent uses
it as `BAO_TOKEN=$(cat ~/.claude-bao-token) bao <cmd>`.

### What the grant authorises

Policy `ops-mason-survey` (`policies/ops-mason-survey.hcl`), 45 minutes, max
one hour, named `claude-<task>`. Read-only (MASON-IN-0004, 2026-10-07); used
for surveys. Building uses the separate `build` grant below (MASON-IN-0005).
`ops-mason-build` stays in `policies/retired/`, never to be installed.

| Allowed | Denied / not granted |
|---|---|
| read/list `sys/mounts`, `sys/auth`; list `sys/policies/acl`, read `sys/policies/acl/*` — the phase-2 survey | **any policy write** (no create/update/delete on `sys/policies/acl/*`; explicit deny on its own policy) |
| read/list role definitions on `auth/kubernetes/role/*`, `auth/netkingdom/role/*`, `auth/jwt/role/*`; list `auth/approle/role`, read `auth/approle/role/<name>` | **any auth-role write**; AppRole `role-id`, `secret-id`, `secret-id/*`, `secret-id-accessor/*`, `custom-secret-id` (explicit deny) |
| read/list KV **metadata** on `platform/`, `operators/` — enough to confirm a delivery landed | **every `*/data/*`** on `platform`, `operators`, `secret` (explicit deny); KV metadata writes |
| `sys/capabilities`, `sys/capabilities-self` (query only), `auth/token/lookup-self`, `auth/token/revoke-self` | **token creation of any kind**; revoking other tokens; `sys/mounts/*` |

The grant can show what exists and prove what a token can reach; it cannot
change anything. That removes the escalation MASON-IN-0004 described — write a
policy without the denies, bind it to an AppRole, read the role-id, mint a
secret-id, log in — because none of those steps is granted.

### Installing the survey policy (founder act)

ops-mason cannot install its own grant. The founder runs, silently and with an
absolute path (the warden wrapper refuses output and runs with a temporary
`HOME`):

```bash
warden access openbao-platform-admin-login --exec -- sh -c \
  'bao policy write ops-mason-survey /home/worsch/ops-mason/policies/ops-mason-survey.hcl >/dev/null 2>&1'
```

Silent check — the installed policy's hash into a 0600 receipt, compared with
the repo file's hash outside the wrapper:

```bash
warden access openbao-platform-admin-login --exec -- sh -c \
  'umask 077; mkdir -p /home/worsch/.local/state/railiance/receipts; bao policy read ops-mason-survey 2>/dev/null | sha256sum > /home/worsch/.local/state/railiance/receipts/ops-mason-survey.sha256'
cat /home/worsch/.local/state/railiance/receipts/ops-mason-survey.sha256
sha256sum < /home/worsch/ops-mason/policies/ops-mason-survey.hcl
```

The two hashes match only if OpenBao returns the file byte-for-byte; if they
differ, compare the stored text against the file before concluding the install
is wrong (OpenBao may normalise a trailing newline).

### Choosing the task name

`grant <task>` sets `display_name=claude-<task>`, so the audit log attributes an
action to a piece of work rather than to a person. Use the workplan task where
there is one — `grant MASON-WP-0003-T02` — otherwise something a reader would
recognise later.

### The build grant (MASON-IN-0005)

ops-mason is the builder. After a plan is approved, the founder mints the
build grant:

```bash
./scripts/bao-session.sh build <plan-task>   # ops-mason-construct, 45m, claude-<task>
```

Policy `ops-mason-construct` (`policies/ops-mason-construct.hcl`). It
includes everything the survey grant can do, plus:

| Allowed | Still denied |
|---|---|
| create/update/delete `sys/policies/acl/workload-kv-read-*` | every other policy; `default`, `root`, `ops-mason-*` (explicit deny) |
| create/update/delete `auth/kubernetes/role/external-secrets-*` and AppRole role definitions, with `token_policies` limited to `workload-kv-read-*` | AppRole `role-id`, `secret-id*`, `custom-secret-id`; `auth/token/create*` |
| `create` (no read or update) on `platform/data/{workloads,suppliers}/*`, so placeholders only | reading any `*/data/*`; overwriting an existing value |
| full metadata on `platform/metadata/{workloads,suppliers}/*` (describe, tear down) | `sys/mounts/*`, `sys/auth/*`, `operators/` and `secret/` writes |

The grant can build a lane but can never log in as one, which keeps the
MASON-IN-0004 chain broken. AppRole secret-id delivery stays a founder act;
Kubernetes-auth lanes need no secret-id. After every build, compare the
written policy text with the plan's policy file (MASON-WP-0015-T04).

Install it the same way as the survey policy, with `ops-mason-construct` and
its file path.

### When a broader grant is genuinely needed

Minting a secret-id or a token, enabling a mount, reading a value, a policy
outside `workload-kv-read-*`, or another subsystem's paths is outside both
grants on purpose. Do not widen a policy to get past a refusal. Those acts go
through the founder and the railiance-platform delegated applier
(`scripts/credential-change.py applier-apply` under `warden access
openbao-platform-admin-login --exec`), or need their own named policy and
founder decision.