coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0004-T03: founder accepts six owner-supplied custody descriptions

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-10 12:59:45 +02:00
parent c9b1cea83b
commit 1c07b65a3c
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
manifests/custody-descriptions.yaml
View file

@ -18,7 +18,7 @@ operators/nextcloud/backup:
on_loss: Resettable by the founder in the Storage Share provider admin (attended). If the share is recreated,
update the workload lane's NC_WEBDAV_TOKEN. Stored backups are unaffected.
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/docs/backup-credential-recovery.md; railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml
sources:
- railiance-platform reply 3e490cd4 (2026-10-09)
@ -69,7 +69,7 @@ platform/workloads/agent-harness/forgejo-deploy-key:
on_loss: 're-establish by railiance-platform: On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/
(mode 600); do not paste the private key into chat or Git.'
owner: railiance-platform
review: draft
review: accepted
rotation: ops-warden/wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
sources:
- ops-warden catalog agent-harness-forgejo-deploy
@ -176,7 +176,7 @@ platform/workloads/coulomb/whynot-design/npm-publish:
on_loss: 'Re-issue per rotation: Replace NPM_AUTH_TOKEN value directly in OpenBao and record non-secret
rotation evidence.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0001-whynot-design-npm-publish.yaml#lifecycle.rotate
sources:
- CCR-2026-0001-whynot-design-npm-publish.yaml
@ -375,7 +375,7 @@ platform/workloads/railiance-telemetry/smtp:
on_loss: 'Resettable by the founder in IONOS mail admin; write a new KV version keeping the other fields,
wait for ESO refresh. Cost: alert mail and Authelia reset emails fail until then; no data loss.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml#lifecycle.rotate
sources:
- CCR-2026-0035-authelia-platform-smtp.yaml
@ -428,7 +428,7 @@ platform/workloads/rapp-qonto/keycape-client:
on_loss: 'rotate by key-cape: Generate a fresh newline-free secret through an approved execution transport;
never print it. NOT automatable — no admitted execution and rollback contract (see delegation.blocked_on).'
owner: key-cape
review: draft
review: accepted
rotation: ops-warden/wiki/CredentialRouting.md#routing-catalog-index
sources:
- ops-warden catalog rapp-qonto-keycape-client
@ -504,7 +504,7 @@ platform/workloads/telemetry/grafana-admin:
on_loss: 'Resettable by a cluster operator with Grafana''s admin reset in the pod, then a new KV version
(not yet exercised). Cost: short loss of admin access; dashboards and data unaffected.'
owner: railiance-platform
review: draft
review: accepted
rotation: 'railiance-platform/docs/credential-lane-designs/telemetry-grafana.md (attended: change the
Grafana DB admin password and OpenBao together, then test old fails and new works)'
sources: