coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T04 done: live capability verification of the KeyCape secrets-engine-openbao lane

Browse source 
Value-free evidence under the read-only ops-mason-survey grant (revoked after
use). Adds T05 for live-token checks and the pointer route. Fixes
bao-session.sh grant misreporting an unreadable policy as absent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-07 13:47:14 +02:00
parent dee5bac2c6
commit 6a602edafb
4 changed files with 229 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

41
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: claude
topic_slug: netkingdom
created: "2026-10-06"
updated: "2026-10-06"
updated: "2026-10-07"
state_hub_workstream_id: "d9be08f5-a0f5-5cd1-8f87-0a6868661d77"
---
@ -73,7 +73,7 @@ state_hub_task_id: "f59fae58-397a-5bf5-9d1d-a33dc4aaa2ac"
```task
id: MASON-WP-0009-T04
status: todo
status: done
priority: medium
state_hub_task_id: "01f55a4d-06de-5d48-a3db-a0746dcf9892"
```
@ -87,3 +87,40 @@ Note (2026-10-07, MASON-IN-0004): the capability verification runs under the
read-only `ops-mason-survey` grant, which replaces `ops-mason-build`. Installing
that policy is a founder act (AGENTS.md, "Installing the survey policy");
ops-mason cannot install or widen it.
Done 2026-10-07 under grant `claude-MASON-WP-0009-T04` (`ops-mason-survey`,
revoked and shredded after use). Evidence, value-free:
`docs/evidence/2026-10-07-keycape-secrets-engine-openbao-capabilities.json`.
All five capability checks pass: both lane policies match the platform repo
files; both roles match CCR-2026-0033/0034 (retired redirect noted); KV metadata
is v1, `cas_required`, `max_versions=2`, `delete_version_after=0s`, custom
metadata as in plan 3.1; only the two lane policies plus `platform-admin`/root
reach the data path, no `auth/jwt` (or `keycape-services`) mount exists, the
ESO reader is on Kubernetes auth; the grant itself is `deny` on the data path
and read-only on `sys/policies/acl/*`. Not permitted by the survey grant:
`auth/keycape/role`. Owner observations (retired `ops-mason-build` still
installed; `secrets-engine-prod` can author `se-prod-*` policies; this path is
missing from `agent-high-risk-boundary`) are in the evidence file. Plan checks
1-3 and 6 need live lane tokens and the route proposal is still owed: T05.
Side finding, fixed: `scripts/bao-session.sh grant` reported "policy does not
exist yet" whenever `bao policy read` failed, including when the founder's
`~/.vault-token` session was expired or unauthorised. It now says "cannot read
(session expired or not permitted)" unless bao answers "No policy named"
(`tests/test_bao_session.py`).
## Live lane proof and pointer route
```task
id: MASON-WP-0009-T05
status: wait
blocked_on: message-from:railiance-platform
blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route."
priority: medium
```
Once the service-JWT lane exists: re-run invariant (ii) against its policy,
collect owner-run evidence for checks 1-3 and 6 (operator and ESO token
capabilities, non-member refusal, a secrets-engine `service-jwt` run), then
propose the pointer-only ops-warden entry for the operator lane
(`resolvable: false` until those pass).