coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T05: service-JWT role verified, ops-mason checks complete; pointer proposed

Browse source 
Also confirms the Forgejo ESO role is live as applied (WP-0010).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-10 15:51:17 +02:00
parent efefb8bbc7
commit 437074dff6
2 changed files with 19 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -126,9 +126,9 @@ exist yet" whenever `bao policy read` failed, including when the founder's
```task
id: MASON-WP-0009-T05
status: wait
status: progress
blocked_on: human
blocking_reason: "Check 6 passed 2026-10-10 (secrets-engine probe-openbao). Remaining: invariant (ii) and the policy/role checks under a survey grant; operator/ESO capability checks and non-member refusal are owner-run; then propose the pointer-only route."
blocking_reason: "ops-mason checks complete (policies, roles, invariant ii, login proof). Owner-run: live operator/ESO token capability checks and a non-member refusal; ops-warden activates the proposed pointer."
priority: medium
state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
```
@ -172,3 +172,13 @@ command), then the role check runs.
sha256 equals the repo file's (`c845bc79…`, receipt
`~/.local/state/railiance/receipts/ops-mason-survey.sha256`). Role check runs
under the next grant.
2026-10-10 (grant `claude-MASON-WP-0009-T05`, revoked): role
`auth/keycape-services/role/secrets-engine-openbao` equals railiance-platform
`openbao/auth/secrets-engine-jwt-role.json` on every field compared (jwt,
`sub`, audience `secrets-engine-openbao`, subject `service:secrets-engine`,
claims principal_type/roles/scope/tenant, policy `secrets-engine-login-self`
only, 5m, 8 uses, no default policy). ops-mason's checks are complete. Pointer
entry proposed to ops-warden as draft, non-resolvable (message `8ad8ed4e`).
Left owner-run: capability checks with live operator and ESO tokens and a
non-member refusal.

7
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -215,6 +215,13 @@ is stale: net-kingdom's `{client_id:env}` change moves the render digest from
present from this case's own bundle. The ESO role did not appear as present;
check on the next grant.
2026-10-10: checked. `auth/kubernetes/role/external-secrets-keycape-forgejo`
exists as applied (external-secrets/external-secrets, audience openbao, 15m,
policy `workload-kv-read-keycape-forgejo-eso`, no default policy). It was missing
from the plan's "already present" list because the live survey reads role
lists only for the mount named in the role body, which this run did not
resolve; the collision review is unaffected (it never flagged it).
2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the
consumer-enforces-groups verification and tightens redirect URIs; the case is
re-pinned to @1.1. The live re-render above was already 1.1. Bundle rebuilt