coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0010-T03: ops-mason build --case; Forgejo case bundle built

Browse source 
Builds from an accepted case and its reviewed, undrifted plan into CCR drafts
for railiance-platform's applier, policy HCL, catalog proposal, exact rollback
and manifest; the local audit log records case, type and acceptance. Drafts
pass the platform's own CCR validator. 6 tests; suite 175 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 19:52:33 +02:00
parent a97d1931dd
commit 3e49ed4c0c
11 changed files with 633 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -141,10 +141,10 @@ collision, digest `sha256:fb8b114d…`.
```task
id: MASON-WP-0010-T03
status: wait
status: progress
depends_on: [MASON-WP-0010-T02]
blocked_on: message-from:net-kingdom
blocking_reason: "Needs the type implemented (net-kingdom) and the Forgejo case accepted; builds that write are founder-applied through the railiance-platform applier, so the build path is designed against that applier, and its acceptance is the Forgejo case materializing live."
blocked_on: message-from:railiance-platform
blocking_reason: "Built 2026-10-09 (builds/case-forgejo-netkingdom-oidc). Acceptance waits on railiance-platform filing the CCR drafts and the founder applying them, plus mint-secret; then the Forgejo case is live."
priority: high
state_hub_task_id: "56cea6be-c613-586c-80cd-125340b374da"
```
@ -160,6 +160,21 @@ removes exactly what this case created.
Acceptance: the Forgejo reference case (NK-WP-0048-T06) materializes through this
path.
2026-10-09: implemented. `ops-mason build --case <case> --plan <plan> [--out]
[--allow-unimplemented]` (`src/ops_mason/case_build.py`) refuses unless the
case is accepted, the plan is `reviewed` and its render digest equals a fresh
render. It writes a bundle and never touches OpenBao: one workload-kv-read CCR
draft per policy (ESO policy + Kubernetes role, mirroring CCR-2026-0033; the
consumer policy `in_flight` with `openbao.auth` missing until the consumer owner
binds it), the policy HCL, an ops-warden catalog proposal, `rollback.yaml`
(exactly what the case creates, reverse order) and a manifest with file hashes.
Every file names the case, type version, render digest and acceptance record;
the audit log gets a `case-build-prepared` record with the case acceptance as
approver. The drafts are checked with railiance-platform's own
`credential-change.py validate`. `tests/test_case_build.py` (6); suite 175
passed. Forgejo bundle built into `builds/case-forgejo-netkingdom-oidc/`,
platform validation pass; handed to railiance-platform (message `2c409503`).
```task
id: MASON-WP-0010-T04
status: wait