From 7b553bea25594d5d13af5c26ff654fabaf8de761 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 12:30:47 +0200 Subject: [PATCH] MASON-WP-0015-T07: track CCR submission from plans (RPF-WP-0061) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f --- workplans/MASON-WP-0015-construct-grant.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/workplans/MASON-WP-0015-construct-grant.md b/workplans/MASON-WP-0015-construct-grant.md index 26331ea..9bb60ec 100644 --- a/workplans/MASON-WP-0015-construct-grant.md +++ b/workplans/MASON-WP-0015-construct-grant.md @@ -118,3 +118,21 @@ applies with cannot `create serviceaccounts/token` or Pods in namespaces it binds roles to (`kubectl auth can-i`). `kubernetes_plane` already refuses the Pod and Secret kinds. Record the result in INTENT.md's `kubernetes-plane-apply` entry. + +## Submit CCRs from approved plans (RPF-WP-0061) + +```task +id: MASON-WP-0015-T07 +status: wait +priority: medium +``` + +railiance-platform RPF-WP-0061 makes ops-mason the only CCR submitter +(`credential-change.py submit`). ops-mason's side: +- generate the CCR draft and policy file from the plan, using platform's + generator once it is exposed; +- take plan approval from the single hub decision after `sync-decision`; +- compare the built policy with the CCR policy file, then `record-evidence`. + +Comment sent 2026-10-18, as a reply to `f49ddd0d`. This waits on +RPF-WP-0061-T03 and T04.