From 2f7237fe0148c1619166ef2c571ff45f2f82870e Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 12:26:14 +0200 Subject: [PATCH] MASON-WP-0014: record CCR-2026-0051 Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f --- plans/mas-tem-relay-smtp.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md index 066d9ce..8688fbf 100644 --- a/plans/mas-tem-relay-smtp.md +++ b/plans/mas-tem-relay-smtp.md @@ -193,10 +193,10 @@ SEC-DSM §37: | # | Action | Object | Reuse-vs-new rationale | |---|---|---|---| | 1 | create | KV v2 `platform/suppliers/scaleway/mas-tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). Supplier account path `platform/suppliers//` (founder decision 2026-10-08, ops-warden `platform-supplier-credentials`); `credential-change.py` accepts it | -| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay` only | Single-path ESO reader; no metadata read needed | +| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay`, plus token lookup-self and revoke-self (CCR-2026-0051 policy file, used verbatim) | Single-path ESO reader; no metadata read needed | | 3 | create | Kubernetes auth role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`, ns `mas`, audience `openbao`, ttl/max 15m, `token_no_default_policy` | Current pattern (CCR-2026-0050), with no static ESO token to deliver or expire | | 4 | create (consumer repo) | ServiceAccount `mas-tem-relay-eso`, **namespaced** SecretStore `openbao-mas-tem-relay`, ExternalSecret `mas-relay` (keys `username`, `password`), all in ns `mas` | Namespaced instead of a ClusterSecretStore, so the store is deleted with the namespace | -| 5 | create (railiance-platform) | CCR-2026-00NN `workload-kv-read` for rows 1–3 | Platform allocates the CCR and applies it through the delegated applier | +| 5 | reuse (railiance-platform) | **CCR-2026-0051** (`railiance-platform@4398f89`), with policy file `openbao/policies/workload-kv-read-mas-tem-relay.hcl` | Platform's record of the lane. ops-mason applies rows 2–3 under `ops-mason-construct` after approval and records evidence against the CCR | | 6 | tear-down (at MAS-WP-0003 close) | auth role, policy, KV path (`metadata delete`) | Cluster-scoped OpenBao objects do not go away with the namespace | | 7 | tear-down (founder) | Scaleway API key | Revokes the authority itself | @@ -223,8 +223,10 @@ No catalog entry: the lane is temporary and has a single consumer. - **Build path:** after approval, ops-mason applies rows 2–3 itself under `bao-session.sh build`. Row 1 is done: the placeholder came first and the founder wrote the value on 2026-10-18. -- **Open:** CCR number from railiance-platform; `bound_claims_confirmed` - after the SA exists; founder approval. +- **CCR:** CCR-2026-0051 (approvers: founder, railiance-platform-owner, + mail-address-semantics-owner). The post-build check compares the written + policy with its policy file. +- **Open:** founder approval; `bound_claims_confirmed` after the SA exists. ## 5. Executive summary