coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T04: structure-only AppRole build, post-build policy check

Browse source 
build_approle_kv_lane no longer reads role-id or mints secret-id;
deliver_approle_credentials is the separate founder/applier step. New
policies are read back and compared before the role is written. The
Kubernetes build uses token_policies/token_ttl (legacy policies is denied
by ops-mason-construct).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 12:52:57 +02:00
parent d19e6b1633
commit 91c4e7b527
6 changed files with 144 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

2
INTENT.md
View file

@ -91,7 +91,7 @@ tooling_contacts:
- id: openbao-approle-credential-delivery
shape: "5.3"
module: src/ops_mason/executor.py
symbol: build_approle_kv_lane
symbol: deliver_approle_credentials
tooling: OpenBao
operation: "bao read auth/approle/role/*/role-id; bao write -f auth/approle/role/*/secret-id"
write: true