coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(cases): expose explicit versioned type roots in Mason CLI

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 07:51:41 +02:00
parent e4761b843c
commit 57411f25b9
4 changed files with 129 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/forgejo-structural-materialization-source-v1.md
View file

@ -115,3 +115,31 @@ binding/application; mint is removed from its structural readiness blocker.
WARDEN-WP-0044-T03 and NK-WP-0048-T06 retain native follow-through, full current
run digest/machine source binding, verification and first live-case acceptance.
No case/type status, credential, policy, catalog activation or workload was changed.
## Explicit source-root selection — 2026-10-16
`plan`, `build` and `structure-request` accept `--types-root` and pass it to
NetKingdom's existing exact-version loader. The default remains
`<netkingdom-root>/security-case-types`; a requested version never falls forward
or backward. Provider declarations still resolve from the NetKingdom repository's
siblings, independently of the selected type root.
Prepare the acknowledged 1.2 source projection without a live survey:
```bash
ops-mason plan --case ../net-kingdom/security-case-type-revisions/1.2/oidc-browser-relying-party/examples/forgejo.yaml --types-root ../net-kingdom/security-case-type-revisions/1.2 --no-live --allow-unimplemented
```
This actual case is proposed and has no acceptance. Its six-object draft includes
the dedicated consumer ESO role bound to namespace `forgejo` and service account
`forgejo-keycape-forgejo-eso`. Source-root selection grants no acceptance: normal
admission still refuses the acknowledged type; `build` refuses the proposed case,
and `structure-request` refuses the historical 1.1 plan/bundle for it. A current
accepted case and reviewed plan are needed before regenerating a build/request.
Do not repin historical acceptance or relabel an offline plan as reviewed.
Six integration checks exercise these paths against the actual owner validator
and source package, including malformed namespace refusal. This CLI compatibility
change does not supply the owner-native contracts listed above. Machine descriptors,
source receipt authentication, current CCR42 binding and native six-object proof
remain with MASON-WP-0010-T03 / NK-WP-0048-T06 and their existing owners.