ops-mason/README.md

# ops-mason

The builder of NetKingdom security infrastructure — creates, changes,
maintains, and tears down access routes, credentials, tokens, and policies
so that ops-warden always has something real to route to.

- Why and boundaries: [INTENT.md](INTENT.md)
- Current work: [workplans/](workplans/)

## The four-phase process

1. **Construction plan** — given an access demand, draft what needs
   building, respecting/extending/compacting existing structure first.
2. **Review and optimize** — self-review the plan against what already
   exists, for consistency and ease of use.
3. **Executive summary** — the one mandatory human decision gate: render
   who gets what access, for how long, and what it costs to reverse.
4. **Build** — once approved, execute the plan.

See `INTENT.md` for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.

## Guarded Kubernetes planes

Small Kubernetes security foundations can use the fail-closed `ops-mason
plane` workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.

See [docs/kubernetes-plane.md](docs/kubernetes-plane.md).