From 401616bb0b5411c60d9fe3ec80039b82ae59a58f Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 00:33:51 +0200 Subject: [PATCH] MASON-WP-0009-T05: lane packaged as CCR-2026-0038, waits on founder apply Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- ...keycape-secrets-engine-openbao-client-custody.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md index bc50382..bfaacd2 100644 --- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md +++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md @@ -127,8 +127,8 @@ exist yet" whenever `bao policy read` failed, including when the founder's ```task id: MASON-WP-0009-T05 status: wait -blocked_on: message-from:railiance-platform -blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route." +blocked_on: human +blocking_reason: "Founder applies CCR-2026-0038 (railiance-platform 0b2e7dd: mount auth/keycape-services, role secrets-engine-openbao, policy secrets-engine-login-self); then SECRETS-WP-0012-T03 login proof; then checks 1-3 and 6, invariant (ii) (expect deny on both guarded paths), pointer-only route." priority: medium state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537" ``` @@ -138,3 +138,12 @@ collect owner-run evidence for checks 1-3 and 6 (operator and ESO token capabilities, non-member refusal, a secrets-engine `service-jwt` run), then propose the pointer-only ops-warden entry for the operator lane (`resolvable: false` until those pass). + +2026-10-09: railiance-platform packaged the lane as CCR-2026-0038 (proposed, +`0b2e7dd`, message `029a6ee2`): isolated JWT mount `auth/keycape-services`, +role `secrets-engine-openbao` (KeyCape registration claims, 5m, 8 uses, no +default policy), policy `secrets-engine-login-self` (self endpoints only, with +explicit deny on `platform/data/` and `platform/metadata/` for +`workloads/keycape/secrets-engine-openbao`, so invariant (ii) holds by +construction). New `service-jwt-login` applier with read-back; 8 tests. Waits +on the founder's approve, confirm-binding and delegated apply.