From 78a31e14448d2b13424097304f5af1ffd1fb3d85 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 00:02:06 +0200 Subject: [PATCH] MASON-WP-0014: record MAS sync evidence and teardown intake KV metadata stays unconfirmed without an ops-mason-survey grant, so T04 stays wait. ExternalSecret mas-relay is Ready/SecretSynced by name only. MASON-IN-0007 holds plan rows 6-7 for MAS-WP-0003 close. MASON-WP-0013 T02-T04 stay wait and the private-reader plan stays draft. plan-survey refused before any OpenBao call. The Forgejo Q1-Q3 citation and the existing CCR and founder decision are not this plan's approval. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a --- WORK-RECORDS.md | 1 + intakes/intakes.md | 26 ++++ plans/mas-tem-relay-smtp.md | 29 ++-- plans/reuse-surface-private-source-reader.md | 31 +++- tests/test_wp_0013_0014_evidence.py | 136 ++++++++++++++++++ ...013-reuse-surface-private-source-reader.md | 27 +++- workplans/MASON-WP-0014-mas-tem-relay-smtp.md | 19 ++- 7 files changed, 258 insertions(+), 11 deletions(-) create mode 100644 tests/test_wp_0013_0014_evidence.py diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 3a928c0..d0fcf31 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -108,3 +108,4 @@ | intake | MASON-IN-0004 | closed | — | intakes/intakes.md | | intake | MASON-IN-0005 | open | — | intakes/intakes.md | | intake | MASON-IN-0006 | open | — | intakes/intakes.md | +| intake | MASON-IN-0007 | open | green | intakes/intakes.md | diff --git a/intakes/intakes.md b/intakes/intakes.md index bc03286..5c7aebf 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -272,3 +272,29 @@ options: >- updated: '2026-10-18T00:00:00Z' state_hub_intake_id: "01a14ea8-3bd8-7da1-b51e-849067a39aff" ``` + +## MASON-IN-0007 — Tear down the temporary MAS TEM relay lane when MAS-WP-0003 closes + +```yaml +id: MASON-IN-0007 +kind: intake +title: Tear down the temporary MAS TEM relay lane when MAS-WP-0003 closes +lane: green +status: open +origin: residual +origin_ref: MASON-WP-0014 +priority: medium +owner: ops-mason +requested_by: ops-mason +description: >- + Due at MAS-WP-0003 close. Recorded from plans/mas-tem-relay-smtp.md rows 6–7. + This intake does not perform the teardown. + Delete Kubernetes auth role external-secrets-mas-tem-relay. + Delete policy workload-kv-read-mas-tem-relay. + Delete KV path platform/suppliers/scaleway/mas-tem-relay by metadata delete. + The founder revokes the Scaleway API key. + No values are stored in this record. +created: '2026-10-21T21:55:39Z' +updated: '2026-10-21T21:55:39Z' +state_hub_intake_id: "01a1607a-a17f-7936-9f9d-82c379891457" +``` diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md index d5adf33..65f4594 100644 --- a/plans/mas-tem-relay-smtp.md +++ b/plans/mas-tem-relay-smtp.md @@ -7,7 +7,7 @@ status: built approved_by: "Bernd Worsch" approved_at: "2026-10-18" created: "2026-10-18" -updated: "2026-10-18" +updated: "2026-10-21" --- # Construction plan: MAS live-test TEM SMTP relay credential @@ -277,12 +277,25 @@ Built 2026-10-18 by ops-mason under `ops-mason-construct` `approved` **Deviation:** platform's condition was apply after `confirm-binding`. The -role was applied before it, while SA `mas-tem-relay-eso` does not exist yet, -so no login is possible until the MAS side creates it. `confirm-binding` -(and `bound_claims_confirmed: true`) follows once the SA exists. This was -reported to railiance-platform. +role was applied before it, while SA `mas-tem-relay-eso` did not exist yet +on 2026-10-18, so no login was possible until the MAS side created it. +`confirm-binding` (and `bound_claims_confirmed: true`) follows once the SA +exists. This was reported to railiance-platform. -**Remaining:** the MAS side applies SA, SecretStore and ExternalSecret; -confirm-binding; check that Secret `mas/mas-relay` syncs (names only); -teardown at MAS-WP-0003 close (rows 6–7). No catalog entry (temporary). +**2026-10-21 name-only delivery check.** A scoped survey or construct grant +was not present, so KV metadata was not re-read and the 2026-10-18 +`current_version=2` line is not a new confirm. `scripts/plan-survey.py` +exited 2 (`no ops-mason-survey grant`). A non-grant token received HTTP 403 +on the platform mount lookup. No data body was returned. + +Kubernetes context `default`, namespace `mas`: ServiceAccount +`mas-tem-relay-eso` is present, SecretStore `openbao-mas-tem-relay` is +present, and ExternalSecret `mas-relay` is Ready True, reason SecretSynced, +binding name `mas-relay`. The Secret object was not read. `confirm-binding` +was not re-checked. + +**Remaining:** metadata confirm under an `ops-mason-survey` or +`ops-mason-construct` grant; `confirm-binding` once that grant exists. +Teardown at MAS-WP-0003 close is intake `MASON-IN-0007` (rows 6–7) and is +not executed here. No catalog entry (temporary). diff --git a/plans/reuse-surface-private-source-reader.md b/plans/reuse-surface-private-source-reader.md index 0ac705b..62ab749 100644 --- a/plans/reuse-surface-private-source-reader.md +++ b/plans/reuse-surface-private-source-reader.md @@ -9,7 +9,7 @@ status: draft approved_by: null approved_at: null created: "2026-10-15" -updated: "2026-10-15" +updated: "2026-10-21" construction_inputs: builds/reuse-surface-private-source-reader/construction-inputs.json candidate_spec_sha256: 59a7334eb58135790547fab0a8c8e8debb94cc7acaae88d30654c9ae887d6732 approved_spec_sha256: null @@ -53,6 +53,35 @@ arguments, or a platform-owned sanitized equivalent. Refused queries stay incomplete rather than being described as absence. No operator/admin session may be substituted for the ops-mason survey grant. +### 2026-10-21 survey attempt + +`./scripts/bao-session.sh status` at 2026-10-21T21:55:29Z: operator session +none or expired; `~/.claude-bao-token` absent. `scripts/plan-survey.py` +`--kv-path platform/workloads/reuse/reuse-surface/forgejo-source-read` +`--policy workload-kv-read-reuse-surface-runtime-eso` +`--k8s-role reuse-surface-runtime-eso` `--consumer reuse-surface` exited 2: + +`no ops-mason-survey grant (~/.claude-bao-token absent and BAO_TOKEN unset)` + +The command made no OpenBao call. There is no sanitized platform-owned +metadata survey to paste. Installed path, policy text, Kubernetes role, and +whether an existing identity already matches stay unconfirmed. This plan +stays `draft`. + +### Forgejo-owner Q1–Q3 citation (does not close the survey) + +`the-custodian` `owner-assembly/forge-final-r2/review/forge-owner-review-r2.json`, +reviewer `railiance-forge-owner (agent railiance-forge, codex)`, +`reviewed_at` 2026-10-14T23:08:34Z, records `sec_dsm_order`: + +- Q1: no direct Kubernetes identity accepted by the current raw HTTP route is demonstrated. +- Q2: KeyCape human login does not establish machine API federation; no installed workload JWT trust is demonstrated. +- Q3: upstream Forgejo OAuth can issue expiring access tokens, but only `authorization_code` and `refresh_token`; no viable workload `client_credentials` or token exchange is demonstrated. A static fallback is conditional. + +That review says it is not founder authorization or authenticated live proof, +and `live_effective_grants_verified` is false. It is owner-authored hierarchy +text. It is not an ops-mason survey and it does not move this plan to `reviewed`. + Local source observations from the pinned preparation and checked files: - `railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl` diff --git a/tests/test_wp_0013_0014_evidence.py b/tests/test_wp_0013_0014_evidence.py new file mode 100644 index 0000000..356715b --- /dev/null +++ b/tests/test_wp_0013_0014_evidence.py @@ -0,0 +1,136 @@ +"""MASON-WP-0013 and MASON-WP-0014 evidence stays name-only and fail-closed.""" + +import importlib.util +import re +import sys +from pathlib import Path + +import pytest +import yaml + +ROOT = Path(__file__).parents[1] +spec = importlib.util.spec_from_file_location( + "plan_survey", ROOT / "scripts" / "plan-survey.py" +) +survey = importlib.util.module_from_spec(spec) +sys.modules["plan_survey"] = survey +spec.loader.exec_module(survey) + +READER_ARGS = [ + "--kv-path", + "platform/workloads/reuse/reuse-surface/forgejo-source-read", + "--policy", + "workload-kv-read-reuse-surface-runtime-eso", + "--k8s-role", + "reuse-surface-runtime-eso", + "--consumer", + "reuse-surface", + "--keyword", + "forgejo", +] +MAS_ARGS = [ + "--kv-path", + "platform/suppliers/scaleway/mas-tem-relay", + "--policy", + "workload-kv-read-mas-tem-relay", + "--k8s-role", + "external-secrets-mas-tem-relay", + "--consumer", + "mail-address-semantics", +] + + +def _task_status(text: str, task_id: str) -> str: + match = re.search(rf"id: {re.escape(task_id)}\nstatus: (\w+)", text) + assert match, task_id + return match.group(1) + + +def _frontmatter(text: str) -> dict: + return yaml.safe_load(text.split("---", 2)[1]) + + +def _flat(text: str) -> str: + return re.sub(r"\s+", " ", text) + + +def _intake(intake_id: str) -> dict: + text = (ROOT / "intakes" / "intakes.md").read_text() + blocks = re.findall(r"```yaml\n(.*?)```", text, re.S) + for block in blocks: + data = yaml.safe_load(block) + if isinstance(data, dict) and data.get("id") == intake_id: + return data + raise AssertionError(intake_id) + + +@pytest.mark.parametrize("args", [READER_ARGS, MAS_ARGS]) +def test_plan_survey_refuses_without_grant(args, monkeypatch, tmp_path, capsys): + monkeypatch.delenv("BAO_TOKEN", raising=False) + monkeypatch.setattr(survey, "GRANT_FILE", str(tmp_path / "absent-grant")) + calls = [] + + def runner(argv, env): + calls.append(argv) + raise AssertionError("survey must not call bao without a grant") + + with pytest.raises(survey.SurveyError, match="no ops-mason-survey grant"): + survey.main(args, runner=runner, environ={"BAO_ADDR": "http://127.0.0.1:18200"}) + assert calls == [] + assert capsys.readouterr().out == "" + + +def test_mas_teardown_intake_is_residual_and_value_free(): + data = _intake("MASON-IN-0007") + description = data["description"] + assert data["origin"] == "residual" + assert data["origin_ref"] == "MASON-WP-0014" + assert data["status"] == "open" + assert "external-secrets-mas-tem-relay" in description + assert "workload-kv-read-mas-tem-relay" in description + assert "platform/suppliers/scaleway/mas-tem-relay" in description + assert "metadata delete" in description + assert "Scaleway API key" in description + assert "MAS-WP-0003" in description + lowered = description.lower() + for banned in ("password", "username", "hvs.", "token=", "begin private"): + assert banned not in lowered + + +def test_mas_delivery_check_stays_wait_until_metadata_grant(): + workplan = (ROOT / "workplans" / "MASON-WP-0014-mas-tem-relay-smtp.md").read_text() + plan = (ROOT / "plans" / "mas-tem-relay-smtp.md").read_text() + assert _frontmatter(workplan)["status"] == "proposed" + assert _task_status(workplan, "MASON-WP-0014-T04") == "wait" + assert _task_status(workplan, "MASON-WP-0014-T01") == "done" + for text in (workplan, plan): + flat = _flat(text) + assert "no ops-mason-survey grant" in flat + assert "SecretSynced" in flat + assert "binding name `mas-relay`" in flat + assert "MASON-IN-0007" in flat + assert "current_version" not in workplan.split("2026-10-21 check", 1)[1] + + +def test_private_reader_stays_draft_without_survey_or_success(): + workplan = ( + ROOT / "workplans" / "MASON-WP-0013-reuse-surface-private-source-reader.md" + ).read_text() + plan = (ROOT / "plans" / "reuse-surface-private-source-reader.md").read_text() + assert _frontmatter(workplan)["status"] == "proposed" + assert _frontmatter(plan)["status"] == "draft" + for task_id in ( + "MASON-WP-0013-T02", + "MASON-WP-0013-T03", + "MASON-WP-0013-T04", + ): + assert _task_status(workplan, task_id) == "wait" + flat_plan = _flat(plan) + flat_workplan = _flat(workplan) + assert "no ops-mason-survey grant" in flat_plan + assert "Q1:" in flat_plan and "Q2:" in flat_plan and "Q3:" in flat_plan + assert "9833715e-a22a-45c0-ab6c-881f0f4f1a0e" in flat_workplan + assert "CCR-2026-0046" in flat_workplan + assert "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" in flat_workplan + assert "RPF-WP-0058-T05" in flat_workplan + assert "not an ops-mason success publication" in flat_workplan diff --git a/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md b/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md index 1d86427..e03e776 100644 --- a/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md +++ b/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md @@ -8,7 +8,7 @@ status: proposed owner: codex topic_slug: netkingdom-security-architecture created: "2026-10-15" -updated: "2026-10-15" +updated: "2026-10-21" flavor: implementation depends_on: [] state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c" @@ -52,11 +52,18 @@ handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective gra across all API pages, secret lifecycle, negative tests and caller/ESO separation. Do not use operator tokens or another agent supervision record. +2026-10-21: still `wait`. Plan §2 records the grant refusal +(`no ops-mason-survey grant`) and cites Forgejo-owner `sec_dsm_order` Q1–Q3 +from `forge-owner-review-r2.json` (2026-10-14T23:08:34Z). That citation is not +a metadata survey. Exact installed path, policy, and role remain unconfirmed. +Plan status stays `draft`. + ## Bind owner CCR and executable inputs to founder decision ```task id: MASON-WP-0013-T03 status: wait +depends_on: [MASON-WP-0013-T02] priority: high state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4" ``` @@ -68,11 +75,21 @@ warden owns pointer review. Obtain separate founder decision on exact credential and live-change revision/digests. Existing disclosure consent cannot approve repository-wide credential grant. Requires T02. +2026-10-21: still `wait` because T02 is not done. Observed elsewhere, and not +adopted as this task's completion: platform CCR-2026-0046, and founder +decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` (resolved 2026-10-15, Bernd +Worsch, binds execution revision SHA256 +`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`). The +disclosure-consent digest +`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a +different record. ops-mason does not approve, mint, or apply from this note. + ## Verify the authorized owner build and routing handoff ```task id: MASON-WP-0013-T04 status: wait +depends_on: [MASON-WP-0013-T03] priority: high state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f" ``` @@ -83,3 +100,11 @@ native seven-index positive and least-privilege negative checks, propose draft catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish success before actual receipt or finish while unresolved lifecycle work is only in prose. + +2026-10-21: still `wait`. This session has no scoped metadata receipt. No +draft catalog route is added; ops-warden catalog has no +`reuse-surface-forgejo-source-read` entry. Platform's hosted receipt +`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json` +is an external claim of seven native indexes and 70 reviewed ids, not an +ops-mason success publication. Lifecycle rotation is already the live task +`RPF-WP-0058-T05` (due 2027-01-13). No second rotation intake is opened here. diff --git a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md index f1df19c..276100e 100644 --- a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md +++ b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md @@ -8,7 +8,7 @@ status: proposed owner: claude topic_slug: netkingdom-security-architecture created: "2026-10-18" -updated: "2026-10-18" +updated: "2026-10-21" flavor: implementation depends_on: [] state_hub_workstream_id: "1df71ade-cb20-5eae-8f6b-bae416058970" @@ -73,3 +73,20 @@ state_hub_task_id: "75eb71c8-5ac4-5512-bee3-6c0e4bee4dfd" Confirm KV metadata exists and that Secret `mas/mas-relay` syncs (names only). Record the teardown steps (plan rows 6–7) as a residual against MAS-WP-0003 close. + +2026-10-21 check, names and status only. T04 stays `wait`. The workplan stays +`proposed`. + +- OpenBao metadata was not re-read. `./scripts/bao-session.sh status` reported + the operator session none or expired and `~/.claude-bao-token` absent. + `scripts/plan-survey.py` for `platform/suppliers/scaleway/mas-tem-relay`, + policy `workload-kv-read-mas-tem-relay`, and role + `external-secrets-mas-tem-relay` exited 2 with `no ops-mason-survey grant`. + A non-grant token against `http://127.0.0.1:18200` received HTTP 403 + `permission denied` on the mount lookup. No `kv get` and no data body. +- Kubernetes context `default`: ServiceAccount `mas-tem-relay-eso` and + SecretStore `openbao-mas-tem-relay` are present in namespace `mas`. + ExternalSecret `mas-relay` is Ready True, reason SecretSynced, binding name + `mas-relay`. The Secret object was not read. +- Teardown rows 6–7 are live intake `MASON-IN-0007` (`origin: residual`, + `origin_ref: MASON-WP-0014`), due at MAS-WP-0003 close. Not executed.