coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0010-T03: source review complete; attended owner checklist

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
tegwick 2026-10-17 04:31:10 +02:00
parent 57411f25b9
commit 20b92e2d46
2 changed files with 30 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

19
.custodian-brief.md
View file

@ -2,17 +2,17 @@
# Custodian Brief — ops-mason
**Domain:** infotech
**Last synced:** 2026-10-14 17:49 UTC
**Last synced:** 2026-10-16 05:54 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Name a dedicated caller for the reuse-surface hub writer token
Progress: 3/4 done | workplan_id: `08e52353-b6e5-5742-b7b4-080d51a0cf57`
### Check the target's readiness tier before a direct Kubernetes apply
Progress: 5/6 done | workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
**Open tasks:**
- ! Record the sanitized receipt `9e12db29`
*(wait: After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet.)*
- ! Review on 2026-12-21 `49dd5f9a`
*(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
### Describe every stored credential so the store is navigable
Progress: 2/4 done | workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
@ -23,13 +23,6 @@ Progress: 2/4 done | workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
- ! Make an undescribed path visible before it accumulates `9a0cea06`
*(wait: After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.)*
### Check the target's readiness tier before a direct Kubernetes apply
Progress: 5/6 done | workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
**Open tasks:**
- ! Review on 2026-12-21 `49dd5f9a`
*(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
### Materialize SecurityCases from their type, with acceptance as the only gate
Progress: 2/4 done | workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583`
@ -55,7 +48,7 @@ Progress: 4/5 done | workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77`
## Inbox Hygiene
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 2 unread message(s) lack supersession chains.
**Missing thread_id:** 7 unread message(s) lack supersession chains.
---
## MCP Orientation (when available)

24
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -258,3 +258,27 @@ namespace/SA, ordinary unimplemented refusal, proposed build refusal, historical
structure tests pass. No live survey, execution, case/type status, acceptance,
native owner evidence or CCR was changed. T03 remains progress; actual accepted
1.2 case/reviewed source and authenticated native owner evidence remain required.
2026-10-17 (T03 source review): ops-mason source is complete for T03.
`structure-request` prepares the typed request; `case_structure.verify` and
`bind_status_transition` take an owner-supplied authenticating verifier by
design, so no CLI that trusts observation JSON is added. Every remaining step
is an owner observation or an attended native run.
Attended checklist (in order; none may be simulated):
1. net-kingdom: accept the Forgejo case at type 1.2 (acceptance record in the
case); ops-mason then re-renders `plan --case ... --types-root <1.2>` to
`reviewed` and rebuilds the bundle (source-only, worker may run).
2. railiance-platform: supply independently authenticated metadata-only
observations for ESO policy, `external-secrets-keycape-forgejo` role and
KV layout, each marked created (with change receipt) or preexisting-matched,
against the `structure-request` digest. No values.
3. railiance-apps + railiance-platform: bind CCR-2026-0042 consumer
`openbao.auth` (namespace/SA), reconcile it from @1.0 to the current type,
review and apply; supply its receipt.
4. ops-warden: authenticate the pointer-only catalog entry observation.
5. Owner (railiance-platform) supplies the authenticating verifier seam and,
with founder go, runs `bind_status_transition` to preview
accepted -> materialized; Warden accepts the new raw case digest.
6. Follow-through after materialization, not prerequisites: mint in custody,
ESO delivery, first live verification (NK-WP-0048-T06).