coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004)

Browse source 
Founder decision 2026-10-07, option (c)+(a): ops-mason surveys and verifies
only. Policy/role writes, secret-id minting and token creation go through the
founder-attended railiance-platform delegated applier. ops-mason-build retired
to policies/retired/ (never installed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-07 10:44:24 +02:00
parent 47171385ce
commit 6b177270d3
10 changed files with 261 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/construction-plan-format.md
View file

@ -64,7 +64,7 @@ Generate the section rather than gathering it by hand (MASON-WP-0008). The
founder mints the scoped grant; the agent then runs the survey with it:
```bash
./scripts/bao-session.sh grant <task> # founder: ops-mason-build, 45m, claude-<task>
./scripts/bao-session.sh grant <task> # founder: ops-mason-survey (read-only), 45m, claude-<task>
./scripts/plan-survey.py \
--kv-path platform/workloads/<consumer>/<name> \
--policy workload-kv-read-<consumer>-<name> \
@ -83,10 +83,10 @@ matching ops-warden catalog entries, a UTC timestamp, `BAO_ADDR`, the token
draft answer into a decision; it is generated evidence, not a review.
The survey refuses to run without a grant, refuses a token whose policies
are anything but `ops-mason-build` (plus `default`), and never prints the
are anything but `ops-mason-survey` (plus `default`), and never prints the
token. Every bao call passes an allowlist that rejects `kv get` and any
`*/data/*` path before a process starts. A query the grant does not permit
is reported as `not permitted by ops-mason-build` and listed under
is reported as `not permitted by ops-mason-survey` and listed under
"incomplete" rather than read as an empty answer. Policies with names that
do not match the demand are not read, so a broadly named policy covering
the path is not detected; the output says so.