coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0007-T06 in progress (tenant-engine ESO synced); WP-0010-T02 unblocked

Browse source 
rapp-tenant-engine applied by the founder: store Ready, ExternalSecret
SecretSynced. NK type oidc-browser-relying-party acknowledged (decision
e418263e resolved), so rendering from a case can start.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 14:59:09 +02:00
parent dc5a71bf07
commit 5dc876f566
2 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
View file

@ -151,12 +151,23 @@ the plan. Blocking reason widened to cover both steps; gate unchanged
## Verify and hand off
2026-10-09: founder applied rapp-tenant-engine (`make prerequisites`). Checked
without touching the Secret: SA `tenant-engine/tenant-engine-eso` exists;
ClusterSecretStore `openbao-tenant-engine-audit-core-sender` Ready=True
(Valid); ExternalSecret `tenant-engine/tenant-engine-audit-core-sender`
Ready=True (SecretSynced), which means ESO wrote the target. A direct presence
check on the Secret was refused by the guard-secret-reads hook, as intended;
the founder runs it if wanted. The declared policy grants exactly `read` on
`platform/data/workloads/tenant-engine/audit-core-sender` plus self
lookup/revoke, so it cannot reach the registry path; comparing it with the
live policy needs a survey grant.
```task
id: MASON-WP-0007-T06
status: wait
status: progress
depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
blocked_on: human
blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token (via railiance-platform secret_annotation_maintenance.py inspect mode only, never a go-template/jsonpath against the Secret, per the 2026-09-28 standing notice); negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
blocking_reason: "Applied by the founder 2026-10-09; store Ready and ExternalSecret SecretSynced. Open: Secret presence (founder runs the check; the agent hook blocks Secret reads), live policy compare under a survey grant, ops-warden pointer, tell tenant-engine."
priority: medium
state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
```

6
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -95,11 +95,13 @@ With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05.
`508e2a12`); its schema/validator now require a body on policy and role items.
NK-WP-0048-T05 still waits on WARDEN-WP-0044-T01 and a founder answer.
2026-10-09: the founder accepted memo r4; hub decision `e418263e` resolved and
the type is `acknowledged` (net-kingdom `0e86f95`). T02 is unblocked.
```task
id: MASON-WP-0010-T02
status: wait
status: todo
depends_on: [MASON-WP-0010-T01, NK-WP-0048-T05]
blocking_reason: "Rendering waits for net-kingdom to fold in the T01 review and acknowledge the type (NK-WP-0048-T05)."
priority: high
state_hub_task_id: "fd385537-7378-5539-8a6e-f45851296f42"
```