coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T07: track CCR submission from plans (RPF-WP-0061)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 12:30:47 +02:00
parent 2f7237fe01
commit 7b553bea25
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/MASON-WP-0015-construct-grant.md
View file

@ -118,3 +118,21 @@ applies with cannot `create serviceaccounts/token` or Pods in namespaces it
binds roles to (`kubectl auth can-i`). `kubernetes_plane` already refuses
the Pod and Secret kinds. Record the result in INTENT.md's
`kubernetes-plane-apply` entry.
## Submit CCRs from approved plans (RPF-WP-0061)
```task
id: MASON-WP-0015-T07
status: wait
priority: medium
```
railiance-platform RPF-WP-0061 makes ops-mason the only CCR submitter
(`credential-change.py submit`). ops-mason's side:
- generate the CCR draft and policy file from the plan, using platform's
generator once it is exposed;
- take plan approval from the single hub decision after `sync-decision`;
- compare the built policy with the CCR policy file, then `record-evidence`.
Comment sent 2026-10-18, as a reply to `f49ddd0d`. This waits on
RPF-WP-0061-T03 and T04.