coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0014: record CCR-2026-0051

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 12:26:14 +02:00
parent e850cbfeff
commit 2f7237fe01
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
plans/mas-tem-relay-smtp.md
View file

@ -193,10 +193,10 @@ SEC-DSM §37:
| # | Action | Object | Reuse-vs-new rationale |
|---|---|---|---|
| 1 | create | KV v2 `platform/suppliers/scaleway/mas-tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). Supplier account path `platform/suppliers/<supplier>/<account>` (founder decision 2026-10-08, ops-warden `platform-supplier-credentials`); `credential-change.py` accepts it |
| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay` only | Single-path ESO reader; no metadata read needed |
| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay`, plus token lookup-self and revoke-self (CCR-2026-0051 policy file, used verbatim) | Single-path ESO reader; no metadata read needed |
| 3 | create | Kubernetes auth role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`, ns `mas`, audience `openbao`, ttl/max 15m, `token_no_default_policy` | Current pattern (CCR-2026-0050), with no static ESO token to deliver or expire |
| 4 | create (consumer repo) | ServiceAccount `mas-tem-relay-eso`, **namespaced** SecretStore `openbao-mas-tem-relay`, ExternalSecret `mas-relay` (keys `username`, `password`), all in ns `mas` | Namespaced instead of a ClusterSecretStore, so the store is deleted with the namespace |
| 5 | create (railiance-platform) | CCR-2026-00NN `workload-kv-read` for rows 1–3 | Platform allocates the CCR and applies it through the delegated applier |
| 5 | reuse (railiance-platform) | **CCR-2026-0051** (`railiance-platform@4398f89`), with policy file `openbao/policies/workload-kv-read-mas-tem-relay.hcl` | Platform's record of the lane. ops-mason applies rows 2–3 under `ops-mason-construct` after approval and records evidence against the CCR |
| 6 | tear-down (at MAS-WP-0003 close) | auth role, policy, KV path (`metadata delete`) | Cluster-scoped OpenBao objects do not go away with the namespace |
| 7 | tear-down (founder) | Scaleway API key | Revokes the authority itself |
@ -223,8 +223,10 @@ No catalog entry: the lane is temporary and has a single consumer.
- **Build path:** after approval, ops-mason applies rows 2–3 itself under
`bao-session.sh build`. Row 1 is done: the placeholder came first and the
founder wrote the value on 2026-10-18.
- **Open:** CCR number from railiance-platform; `bound_claims_confirmed`
after the SA exists; founder approval.
- **CCR:** CCR-2026-0051 (approvers: founder, railiance-platform-owner,
mail-address-semantics-owner). The post-build check compares the written
policy with its policy file.
- **Open:** founder approval; `bound_claims_confirmed` after the SA exists.
## 5. Executive summary