From 247c829569d8e98b17db7299fb719ad72f7edae3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:51:58 +0200 Subject: [PATCH] MASON-WP-0010: mark the missing-role cause as unconfirmed Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- workplans/MASON-WP-0010-security-case-materialization.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md index c4e814b..652cd0a 100644 --- a/workplans/MASON-WP-0010-security-case-materialization.md +++ b/workplans/MASON-WP-0010-security-case-materialization.md @@ -217,10 +217,10 @@ check on the next grant. 2026-10-10: checked. `auth/kubernetes/role/external-secrets-keycape-forgejo` exists as applied (external-secrets/external-secrets, audience openbao, 15m, -policy `workload-kv-read-keycape-forgejo-eso`, no default policy). It was missing -from the plan's "already present" list because the live survey reads role -lists only for the mount named in the role body, which this run did not -resolve; the collision review is unaffected (it never flagged it). +policy `workload-kv-read-keycape-forgejo-eso`, no default policy). Why the plan's +"already present" list omitted it is not yet confirmed (the survey should list +`auth/kubernetes/role`); reproduce under the next grant. The collision review +is unaffected: it never flagged the role. 2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the consumer-enforces-groups verification and tightens redirect URIs; the case is