coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Review/optimize checklist, executive-summary format, build executor (T02-T04)

Browse source 
docs/review-optimize-checklist.md: six checks (naming, TTL/scoping,
redundancy, compaction, ease of use, posture), applied for real to the
rein-openweights plan's section 4 -- including a genuinely useful
finding (credentials.py already expects this exact path/delivery shape,
zero code changes needed to consume it).

docs/executive-summary-format.md: six fixed fields, no bao syntax, no
restating earlier sections, explicit approve/reject/revise decision.
Rendered for real into the plan's section 5 -- ready for an actual
decision.

src/ops_mason/{plan,executor,audit}.py: the phase-4 build executor for
credential_type openbao-approle-kv. Refuses to run against anything but
an approved plan -- verified the refusal never even calls subprocess.run.
role_id/secret_id (the AppRole's own access credential, not the
downstream secret) land as 0600 files, never logged; the HCL policy
goes over stdin, never argv; the audit trail is metadata-only. 12 tests,
all mocked at the bao boundary (no live OpenBao access from this
session).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-27 00:56:34 +02:00
parent 123ccfe20c
commit 0d62ac501d
12 changed files with 645 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

37
workplans/MASON-WP-0001-foundation.md
View file

@ -57,9 +57,20 @@ note any compaction opportunity (two existing lanes that could merge).
This can start as a checklist a human/agent runs manually against a
draft plan — doesn't need to be automated tooling on day one.
**Done (2026-07-27).** `docs/review-optimize-checklist.md`: six checks
(naming, TTL/scoping, redundancy, compaction, ease of use for the
consumer, posture) — manual for now, automating a checker deferred until
there's a second worked example to generalize from. Applied for real to
`plans/rein-openweights-openrouter-approle.md` §4 — including a
genuinely useful finding (`credentials.py` already expects exactly this
plan's path/delivery shape, zero code changes needed to consume it) and
one explicit posture assumption flagged rather than left silent
(`secret_id_ttl=0`, carried from `agent-harness-binky-mail`, surfaced
again in the executive summary for the approval decision to confirm).
```task
id: MASON-WP-0001-T02
status: todo
status: done
priority: high
state_hub_task_id: "58a446fb-78d0-42b4-b10a-1119266b1016"
```
@ -74,9 +85,17 @@ be readable without knowing `bao` syntax. Document in
`docs/executive-summary-format.md`, with the rein-openweights AppRole
plan (task T05) as the worked example.
**Done (2026-07-27).** `docs/executive-summary-format.md`: six fixed
fields (one-line ask, who/what gets access, to what, for how long,
blast radius, cost to reverse) plus an explicit approve/reject/revise
decision — no `bao` syntax, no restating sections 1-4, no editorializing
beyond the plan's own reuse-vs-new conclusion. Rendered for real into
`plans/rein-openweights-openrouter-approle.md` §5 — ready for an actual
decision, not a mockup.
```task
id: MASON-WP-0001-T03
status: todo
status: done
priority: medium
state_hub_task_id: "e37debfd-8a00-4780-b036-9376c6a10557"
```
@ -98,9 +117,21 @@ the one place a bug is a real security incident, not a bad UX. Start
narrow: implement only the operations the first real plan (T05) needs,
not a general OpenBao automation framework.
**Done (2026-07-27).** `src/ops_mason/plan.py` (frontmatter parser +
`is_approved()`), `src/ops_mason/executor.py`
(`build_approle_kv_lane` — policy write, AppRole create,
role_id/secret_id delivery, never the KV path's value), `src/ops_mason/audit.py`
(metadata-only JSONL build log). 12 tests, all mocked at the `bao`
subprocess boundary (no live OpenBao access from this session — see
`GLAS-WP-0002-T02`'s original blocker). Explicitly verified: the refusal
gate never even calls `subprocess.run` when the plan isn't fully
approved (`test_refusal_never_calls_bao`); role_id/secret_id land as
`0600` files and never appear in a log line or exception message; the
policy HCL goes over stdin, never argv.
```task
id: MASON-WP-0001-T04
status: todo
status: done
priority: high
state_hub_task_id: "e949f4b7-5ef4-4e42-8a07-61b6c8040298"
```