ops-mason/README.md

# ops-mason

The builder of NetKingdom security infrastructure — creates, changes,
maintains, and tears down access routes, credentials, tokens, and policies
so that ops-warden always has something real to route to.

- Why and boundaries: [INTENT.md](INTENT.md)
- Current work: [workplans/](workplans/)

## The four-phase process

1. **Construction plan** — given an access demand, draft what needs
   building, respecting/extending/compacting existing structure first.
2. **Review and optimize** — self-review the plan against what already
   exists, for consistency and ease of use.
3. **Executive summary** — the one mandatory human decision gate: render
   who gets what access, for how long, and what it costs to reverse.
4. **Build** — once approved, execute the plan.

See `INTENT.md` for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
Initial commit 2026-07-26 21:42:19 +00:00			`# ops-mason`

Charter ops-mason: builder of NetKingdom security infrastructure INTENT.md establishes the four-phase process (construction plan -> review/optimize -> executive summary -> build), grounded in ops-warden's own charter: ops-warden explicitly disclaims being a builder/provisioner ("owns no secret store and vends nothing", routes provisioning elsewhere) and states its own design principle that "the founder is escalated to, never tasked with mechanics" -- ops-mason's executive summary gate is that principle applied to the provisioning side, turning today's ad hoc founder Red-lane bao commands into a reviewed, repeatable process. MASON-WP-0001 stands up the four phases and exercises the whole pipeline on real, already-waiting demand: the rein-openweights OpenBao AppRole that glas-harness/GLAS-WP-0002-T02 is blocked on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> 2026-07-27 00:21:25 +02:00			`The builder of NetKingdom security infrastructure — creates, changes,`
			`maintains, and tears down access routes, credentials, tokens, and policies`
			`so that ops-warden always has something real to route to.`

			`- Why and boundaries: [INTENT.md](INTENT.md)`
			`- Current work: [workplans/](workplans/)`

			`## The four-phase process`

			`1. Construction plan — given an access demand, draft what needs`
			`building, respecting/extending/compacting existing structure first.`
			`2. Review and optimize — self-review the plan against what already`
			`exists, for consistency and ease of use.`
			`3. Executive summary — the one mandatory human decision gate: render`
			`who gets what access, for how long, and what it costs to reverse.`
			`4. Build — once approved, execute the plan.`

			See `INTENT.md` for the full responsibility boundary against ops-warden,
			`OpenBao, flex-auth, and key-cape.`