coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0010-T03: source review complete; attended owner checklist

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
tegwick 2026-10-17 04:31:10 +02:00
parent 57411f25b9
commit 20b92e2d46
2 changed files with 30 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -258,3 +258,27 @@ namespace/SA, ordinary unimplemented refusal, proposed build refusal, historical
structure tests pass. No live survey, execution, case/type status, acceptance,
native owner evidence or CCR was changed. T03 remains progress; actual accepted
1.2 case/reviewed source and authenticated native owner evidence remain required.
2026-10-17 (T03 source review): ops-mason source is complete for T03.
`structure-request` prepares the typed request; `case_structure.verify` and
`bind_status_transition` take an owner-supplied authenticating verifier by
design, so no CLI that trusts observation JSON is added. Every remaining step
is an owner observation or an attended native run.
Attended checklist (in order; none may be simulated):
1. net-kingdom: accept the Forgejo case at type 1.2 (acceptance record in the
case); ops-mason then re-renders `plan --case ... --types-root <1.2>` to
`reviewed` and rebuilds the bundle (source-only, worker may run).
2. railiance-platform: supply independently authenticated metadata-only
observations for ESO policy, `external-secrets-keycape-forgejo` role and
KV layout, each marked created (with change receipt) or preexisting-matched,
against the `structure-request` digest. No values.
3. railiance-apps + railiance-platform: bind CCR-2026-0042 consumer
`openbao.auth` (namespace/SA), reconcile it from @1.0 to the current type,
review and apply; supply its receipt.
4. ops-warden: authenticate the pointer-only catalog entry observation.
5. Owner (railiance-platform) supplies the authenticating verifier seam and,
with founder go, runs `bind_status_transition` to preview
accepted -> materialized; Warden accepts the new raw case digest.
6. Follow-through after materialization, not prerequisites: mint in custody,
ESO delivery, first live verification (NK-WP-0048-T06).