coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(mason): operators/ custody mount and its access policy

Browse source 
operators/ enabled as KV v2; operator-custody grants read/write on it.

Kept separate from platform-admin rather than folded in, though that
would have been one stanza. platform-admin lists the mounts an
administrator operates *on*; operators/ is the one mount an
administrator keeps things *in*. Separating them lets custody move
independently of administration, which is what the S6 trust stage
(two-of-three independent recovery control) requires and which cannot be
retrofitted once the grant is buried inside platform-admin.

Delete is deliberately absent from the policy. A credential is retired
by writing its successor, and KV v2 keeps the prior version — the
history that did not exist when the LLDAP predecessor was overwritten in
a browser password manager on 2026-08-27 and lost for good.

ops-mason-build verified behaviourally, not just by capability strings:
metadata reads succeed, `kv get` on the forge token returns permission
denied, and enabling a mount returns permission denied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
This commit is contained in:
tegwick 2026-08-28 11:18:06 +02:00
parent 680fe471c5
commit 7bd230c06a
1 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

30
policies/operator-custody.hcl Normal file
View file

@ -0,0 +1,30 @@
# operator-custody — human operators' own credentials.
#
# Distinct from platform-admin on purpose. platform-admin lists the mounts an
# administrator operates *on*; this is the one mount an administrator keeps
# things *in*. Separating them means custody can move independently of
# administration — which is exactly what the S6 trust stage (two-of-three
# independent recovery control) requires, and it cannot be done later if the
# grant is buried inside platform-admin.
#
# Holds: service account passwords, provider PATs, LLDAP admin bind,
# privacyIDEA pi-admin, machine identities. See
# net-kingdom/docs/platform-root-custody.md, "Operator Credential Custody".
#
# Does NOT hold, and must never: platform-root's own password, unseal shares,
# the break-glass password. Those live in the offline packet — putting them
# here is a circular dependency, since you would need this store to reach the
# credential that opens it.
path "operators/data/*" {
capabilities = ["create", "read", "update", "list"]
}
path "operators/metadata/*" {
capabilities = ["read", "list"]
}
# Delete is deliberately absent. A credential is retired by writing its
# successor — KV v2 keeps the prior version, which is the history that did not
# exist when the LLDAP predecessor was overwritten on 2026-08-27 and lost.
# Destroying a version is a separate, deliberate act under a broader identity.