MASON-WP-0014: record MAS sync evidence and teardown intake

KV metadata stays unconfirmed without an ops-mason-survey grant, so T04 stays wait. ExternalSecret mas-relay is Ready/SecretSynced by name only. MASON-IN-0007 holds plan rows 6-7 for MAS-WP-0003 close. MASON-WP-0013 T02-T04 stay wait and the private-reader plan stays draft. plan-survey refused before any OpenBao call. The Forgejo Q1-Q3 citation and the existing CCR and founder decision are not this plan's approval. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
2026-10-22 00:02:06 +02:00 · 2026-10-22 00:02:06 +02:00 · 78a31e1444
commit 78a31e1444
parent 0a489116a8
7 changed files with 258 additions and 11 deletions
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -108,3 +108,4 @@
 | intake | MASON-IN-0004 | closed | — | intakes/intakes.md |
 | intake | MASON-IN-0005 | open | — | intakes/intakes.md |
 | intake | MASON-IN-0006 | open | — | intakes/intakes.md |
+| intake | MASON-IN-0007 | open | green | intakes/intakes.md |
--- a/intakes/intakes.md
+++ b/intakes/intakes.md
@ -272,3 +272,29 @@ options: >-
 updated: '2026-10-18T00:00:00Z'
 state_hub_intake_id: "01a14ea8-3bd8-7da1-b51e-849067a39aff"
 ```
+
+## MASON-IN-0007 — Tear down the temporary MAS TEM relay lane when MAS-WP-0003 closes
+
+```yaml
+id: MASON-IN-0007
+kind: intake
+title: Tear down the temporary MAS TEM relay lane when MAS-WP-0003 closes
+lane: green
+status: open
+origin: residual
+origin_ref: MASON-WP-0014
+priority: medium
+owner: ops-mason
+requested_by: ops-mason
+description: >-
+  Due at MAS-WP-0003 close. Recorded from plans/mas-tem-relay-smtp.md rows 6–7.
+  This intake does not perform the teardown.
+  Delete Kubernetes auth role external-secrets-mas-tem-relay.
+  Delete policy workload-kv-read-mas-tem-relay.
+  Delete KV path platform/suppliers/scaleway/mas-tem-relay by metadata delete.
+  The founder revokes the Scaleway API key.
+  No values are stored in this record.
+created: '2026-10-21T21:55:39Z'
+updated: '2026-10-21T21:55:39Z'
+state_hub_intake_id: "01a1607a-a17f-7936-9f9d-82c379891457"
+```
--- a/plans/mas-tem-relay-smtp.md
+++ b/plans/mas-tem-relay-smtp.md
@ -7,7 +7,7 @@ status: built
 approved_by: "Bernd Worsch"
 approved_at: "2026-10-18"
 created: "2026-10-18"
-updated: "2026-10-18"
+updated: "2026-10-21"
 ---

 # Construction plan: MAS live-test TEM SMTP relay credential
@ -277,12 +277,25 @@ Built 2026-10-18 by ops-mason under `ops-mason-construct`
  `approved`

 **Deviation:** platform's condition was apply after `confirm-binding`. The
-role was applied before it, while SA `mas-tem-relay-eso` does not exist yet,
-so no login is possible until the MAS side creates it. `confirm-binding`
-(and `bound_claims_confirmed: true`) follows once the SA exists. This was
-reported to railiance-platform.
+role was applied before it, while SA `mas-tem-relay-eso` did not exist yet
+on 2026-10-18, so no login was possible until the MAS side created it.
+`confirm-binding` (and `bound_claims_confirmed: true`) follows once the SA
+exists. This was reported to railiance-platform.

-**Remaining:** the MAS side applies SA, SecretStore and ExternalSecret;
-confirm-binding; check that Secret `mas/mas-relay` syncs (names only);
-teardown at MAS-WP-0003 close (rows 6–7). No catalog entry (temporary).
+**2026-10-21 name-only delivery check.** A scoped survey or construct grant
+was not present, so KV metadata was not re-read and the 2026-10-18
+`current_version=2` line is not a new confirm. `scripts/plan-survey.py`
+exited 2 (`no ops-mason-survey grant`). A non-grant token received HTTP 403
+on the platform mount lookup. No data body was returned.
+
+Kubernetes context `default`, namespace `mas`: ServiceAccount
+`mas-tem-relay-eso` is present, SecretStore `openbao-mas-tem-relay` is
+present, and ExternalSecret `mas-relay` is Ready True, reason SecretSynced,
+binding name `mas-relay`. The Secret object was not read. `confirm-binding`
+was not re-checked.
+
+**Remaining:** metadata confirm under an `ops-mason-survey` or
+`ops-mason-construct` grant; `confirm-binding` once that grant exists.
+Teardown at MAS-WP-0003 close is intake `MASON-IN-0007` (rows 6–7) and is
+not executed here. No catalog entry (temporary).

--- a/plans/reuse-surface-private-source-reader.md
+++ b/plans/reuse-surface-private-source-reader.md
@ -9,7 +9,7 @@ status: draft
 approved_by: null
 approved_at: null
 created: "2026-10-15"
-updated: "2026-10-15"
+updated: "2026-10-21"
 construction_inputs: builds/reuse-surface-private-source-reader/construction-inputs.json
 candidate_spec_sha256: 59a7334eb58135790547fab0a8c8e8debb94cc7acaae88d30654c9ae887d6732
 approved_spec_sha256: null
@ -53,6 +53,35 @@ arguments, or a platform-owned sanitized equivalent. Refused queries stay
 incomplete rather than being described as absence. No operator/admin session may
 be substituted for the ops-mason survey grant.

+### 2026-10-21 survey attempt
+
+`./scripts/bao-session.sh status` at 2026-10-21T21:55:29Z: operator session
+none or expired; `~/.claude-bao-token` absent. `scripts/plan-survey.py`
+`--kv-path platform/workloads/reuse/reuse-surface/forgejo-source-read`
+`--policy workload-kv-read-reuse-surface-runtime-eso`
+`--k8s-role reuse-surface-runtime-eso` `--consumer reuse-surface` exited 2:
+
+`no ops-mason-survey grant (~/.claude-bao-token absent and BAO_TOKEN unset)`
+
+The command made no OpenBao call. There is no sanitized platform-owned
+metadata survey to paste. Installed path, policy text, Kubernetes role, and
+whether an existing identity already matches stay unconfirmed. This plan
+stays `draft`.
+
+### Forgejo-owner Q1–Q3 citation (does not close the survey)
+
+`the-custodian` `owner-assembly/forge-final-r2/review/forge-owner-review-r2.json`,
+reviewer `railiance-forge-owner (agent railiance-forge, codex)`,
+`reviewed_at` 2026-10-14T23:08:34Z, records `sec_dsm_order`:
+
+- Q1: no direct Kubernetes identity accepted by the current raw HTTP route is demonstrated.
+- Q2: KeyCape human login does not establish machine API federation; no installed workload JWT trust is demonstrated.
+- Q3: upstream Forgejo OAuth can issue expiring access tokens, but only `authorization_code` and `refresh_token`; no viable workload `client_credentials` or token exchange is demonstrated. A static fallback is conditional.
+
+That review says it is not founder authorization or authenticated live proof,
+and `live_effective_grants_verified` is false. It is owner-authored hierarchy
+text. It is not an ops-mason survey and it does not move this plan to `reviewed`.
+
 Local source observations from the pinned preparation and checked files:

 - `railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl`
--- a/tests/test_wp_0013_0014_evidence.py
+++ b/tests/test_wp_0013_0014_evidence.py
@ -0,0 +1,136 @@
+"""MASON-WP-0013 and MASON-WP-0014 evidence stays name-only and fail-closed."""
+
+import importlib.util
+import re
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).parents[1]
+spec = importlib.util.spec_from_file_location(
+    "plan_survey", ROOT / "scripts" / "plan-survey.py"
+)
+survey = importlib.util.module_from_spec(spec)
+sys.modules["plan_survey"] = survey
+spec.loader.exec_module(survey)
+
+READER_ARGS = [
+    "--kv-path",
+    "platform/workloads/reuse/reuse-surface/forgejo-source-read",
+    "--policy",
+    "workload-kv-read-reuse-surface-runtime-eso",
+    "--k8s-role",
+    "reuse-surface-runtime-eso",
+    "--consumer",
+    "reuse-surface",
+    "--keyword",
+    "forgejo",
+]
+MAS_ARGS = [
+    "--kv-path",
+    "platform/suppliers/scaleway/mas-tem-relay",
+    "--policy",
+    "workload-kv-read-mas-tem-relay",
+    "--k8s-role",
+    "external-secrets-mas-tem-relay",
+    "--consumer",
+    "mail-address-semantics",
+]
+
+
+def _task_status(text: str, task_id: str) -> str:
+    match = re.search(rf"id: {re.escape(task_id)}\nstatus: (\w+)", text)
+    assert match, task_id
+    return match.group(1)
+
+
+def _frontmatter(text: str) -> dict:
+    return yaml.safe_load(text.split("---", 2)[1])
+
+
+def _flat(text: str) -> str:
+    return re.sub(r"\s+", " ", text)
+
+
+def _intake(intake_id: str) -> dict:
+    text = (ROOT / "intakes" / "intakes.md").read_text()
+    blocks = re.findall(r"```yaml\n(.*?)```", text, re.S)
+    for block in blocks:
+        data = yaml.safe_load(block)
+        if isinstance(data, dict) and data.get("id") == intake_id:
+            return data
+    raise AssertionError(intake_id)
+
+
+@pytest.mark.parametrize("args", [READER_ARGS, MAS_ARGS])
+def test_plan_survey_refuses_without_grant(args, monkeypatch, tmp_path, capsys):
+    monkeypatch.delenv("BAO_TOKEN", raising=False)
+    monkeypatch.setattr(survey, "GRANT_FILE", str(tmp_path / "absent-grant"))
+    calls = []
+
+    def runner(argv, env):
+        calls.append(argv)
+        raise AssertionError("survey must not call bao without a grant")
+
+    with pytest.raises(survey.SurveyError, match="no ops-mason-survey grant"):
+        survey.main(args, runner=runner, environ={"BAO_ADDR": "http://127.0.0.1:18200"})
+    assert calls == []
+    assert capsys.readouterr().out == ""
+
+
+def test_mas_teardown_intake_is_residual_and_value_free():
+    data = _intake("MASON-IN-0007")
+    description = data["description"]
+    assert data["origin"] == "residual"
+    assert data["origin_ref"] == "MASON-WP-0014"
+    assert data["status"] == "open"
+    assert "external-secrets-mas-tem-relay" in description
+    assert "workload-kv-read-mas-tem-relay" in description
+    assert "platform/suppliers/scaleway/mas-tem-relay" in description
+    assert "metadata delete" in description
+    assert "Scaleway API key" in description
+    assert "MAS-WP-0003" in description
+    lowered = description.lower()
+    for banned in ("password", "username", "hvs.", "token=", "begin private"):
+        assert banned not in lowered
+
+
+def test_mas_delivery_check_stays_wait_until_metadata_grant():
+    workplan = (ROOT / "workplans" / "MASON-WP-0014-mas-tem-relay-smtp.md").read_text()
+    plan = (ROOT / "plans" / "mas-tem-relay-smtp.md").read_text()
+    assert _frontmatter(workplan)["status"] == "proposed"
+    assert _task_status(workplan, "MASON-WP-0014-T04") == "wait"
+    assert _task_status(workplan, "MASON-WP-0014-T01") == "done"
+    for text in (workplan, plan):
+        flat = _flat(text)
+        assert "no ops-mason-survey grant" in flat
+        assert "SecretSynced" in flat
+        assert "binding name `mas-relay`" in flat
+        assert "MASON-IN-0007" in flat
+    assert "current_version" not in workplan.split("2026-10-21 check", 1)[1]
+
+
+def test_private_reader_stays_draft_without_survey_or_success():
+    workplan = (
+        ROOT / "workplans" / "MASON-WP-0013-reuse-surface-private-source-reader.md"
+    ).read_text()
+    plan = (ROOT / "plans" / "reuse-surface-private-source-reader.md").read_text()
+    assert _frontmatter(workplan)["status"] == "proposed"
+    assert _frontmatter(plan)["status"] == "draft"
+    for task_id in (
+        "MASON-WP-0013-T02",
+        "MASON-WP-0013-T03",
+        "MASON-WP-0013-T04",
+    ):
+        assert _task_status(workplan, task_id) == "wait"
+    flat_plan = _flat(plan)
+    flat_workplan = _flat(workplan)
+    assert "no ops-mason-survey grant" in flat_plan
+    assert "Q1:" in flat_plan and "Q2:" in flat_plan and "Q3:" in flat_plan
+    assert "9833715e-a22a-45c0-ab6c-881f0f4f1a0e" in flat_workplan
+    assert "CCR-2026-0046" in flat_workplan
+    assert "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" in flat_workplan
+    assert "RPF-WP-0058-T05" in flat_workplan
+    assert "not an ops-mason success publication" in flat_workplan
--- a/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
+++ b/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
@ -8,7 +8,7 @@ status: proposed
 owner: codex
 topic_slug: netkingdom-security-architecture
 created: "2026-10-15"
-updated: "2026-10-15"
+updated: "2026-10-21"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
@ -52,11 +52,18 @@ handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective gra
 across all API pages, secret lifecycle, negative tests and caller/ESO separation.
 Do not use operator tokens or another agent supervision record.

+2026-10-21: still `wait`. Plan §2 records the grant refusal
+(`no ops-mason-survey grant`) and cites Forgejo-owner `sec_dsm_order` Q1–Q3
+from `forge-owner-review-r2.json` (2026-10-14T23:08:34Z). That citation is not
+a metadata survey. Exact installed path, policy, and role remain unconfirmed.
+Plan status stays `draft`.
+
 ## Bind owner CCR and executable inputs to founder decision

 ```task
 id: MASON-WP-0013-T03
 status: wait
+depends_on: [MASON-WP-0013-T02]
 priority: high
 state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
 ```
@ -68,11 +75,21 @@ warden owns pointer review. Obtain separate founder decision on exact credential
 and live-change revision/digests. Existing disclosure consent cannot approve
 repository-wide credential grant. Requires T02.

+2026-10-21: still `wait` because T02 is not done. Observed elsewhere, and not
+adopted as this task's completion: platform CCR-2026-0046, and founder
+decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` (resolved 2026-10-15, Bernd
+Worsch, binds execution revision SHA256
+`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`). The
+disclosure-consent digest
+`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
+different record. ops-mason does not approve, mint, or apply from this note.
+
 ## Verify the authorized owner build and routing handoff

 ```task
 id: MASON-WP-0013-T04
 status: wait
+depends_on: [MASON-WP-0013-T03]
 priority: high
 state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
 ```
@ -83,3 +100,11 @@ native seven-index positive and least-privilege negative checks, propose draft
 catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
 success before actual receipt or finish while unresolved lifecycle work is only
 in prose.
+
+2026-10-21: still `wait`. This session has no scoped metadata receipt. No
+draft catalog route is added; ops-warden catalog has no
+`reuse-surface-forgejo-source-read` entry. Platform's hosted receipt
+`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json`
+is an external claim of seven native indexes and 70 reviewed ids, not an
+ops-mason success publication. Lifecycle rotation is already the live task
+`RPF-WP-0058-T05` (due 2027-01-13). No second rotation intake is opened here.
--- a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
+++ b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
@ -8,7 +8,7 @@ status: proposed
 owner: claude
 topic_slug: netkingdom-security-architecture
 created: "2026-10-18"
-updated: "2026-10-18"
+updated: "2026-10-21"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "1df71ade-cb20-5eae-8f6b-bae416058970"
@ -73,3 +73,20 @@ state_hub_task_id: "75eb71c8-5ac4-5512-bee3-6c0e4bee4dfd"

 Confirm KV metadata exists and that Secret `mas/mas-relay` syncs (names only).
 Record the teardown steps (plan rows 6–7) as a residual against MAS-WP-0003 close.
+
+2026-10-21 check, names and status only. T04 stays `wait`. The workplan stays
+`proposed`.
+
+- OpenBao metadata was not re-read. `./scripts/bao-session.sh status` reported
+  the operator session none or expired and `~/.claude-bao-token` absent.
+  `scripts/plan-survey.py` for `platform/suppliers/scaleway/mas-tem-relay`,
+  policy `workload-kv-read-mas-tem-relay`, and role
+  `external-secrets-mas-tem-relay` exited 2 with `no ops-mason-survey grant`.
+  A non-grant token against `http://127.0.0.1:18200` received HTTP 403
+  `permission denied` on the mount lookup. No `kv get` and no data body.
+- Kubernetes context `default`: ServiceAccount `mas-tem-relay-eso` and
+  SecretStore `openbao-mas-tem-relay` are present in namespace `mas`.
+  ExternalSecret `mas-relay` is Ready True, reason SecretSynced, binding name
+  `mas-relay`. The Secret object was not read.
+- Teardown rows 6–7 are live intake `MASON-IN-0007` (`origin: residual`,
+  `origin_ref: MASON-WP-0014`), due at MAS-WP-0003 close. Not executed.