coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T05: lane packaged as CCR-2026-0038, waits on founder apply

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 00:33:51 +02:00
parent 5daa9f936a
commit 401616bb0b
1 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -127,8 +127,8 @@ exist yet" whenever `bao policy read` failed, including when the founder's
```task
id: MASON-WP-0009-T05
status: wait
blocked_on: message-from:railiance-platform
blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route."
blocked_on: human
blocking_reason: "Founder applies CCR-2026-0038 (railiance-platform 0b2e7dd: mount auth/keycape-services, role secrets-engine-openbao, policy secrets-engine-login-self); then SECRETS-WP-0012-T03 login proof; then checks 1-3 and 6, invariant (ii) (expect deny on both guarded paths), pointer-only route."
priority: medium
state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
```
@ -138,3 +138,12 @@ collect owner-run evidence for checks 1-3 and 6 (operator and ESO token
capabilities, non-member refusal, a secrets-engine `service-jwt` run), then
propose the pointer-only ops-warden entry for the operator lane
(`resolvable: false` until those pass).
2026-10-09: railiance-platform packaged the lane as CCR-2026-0038 (proposed,
`0b2e7dd`, message `029a6ee2`): isolated JWT mount `auth/keycape-services`,
role `secrets-engine-openbao` (KeyCape registration claims, 5m, 8 uses, no
default policy), policy `secrets-engine-login-self` (self endpoints only, with
explicit deny on `platform/data/` and `platform/metadata/` for
`workloads/keycape/secrets-engine-openbao`, so invariant (ii) holds by
construction). New `service-jwt-login` applier with read-back; 8 tests. Waits
on the founder's approve, confirm-binding and delegated apply.