From 958a667dd6d2ec465340d89d4aafd1db6abc8262 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 28 Aug 2026 11:50:50 +0200 Subject: [PATCH] feat(workplan): open MASON-WP-0004 for credential descriptions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit custody-inventory.py reports 21 paths, 17 undescribed. An undescribed credential is one nobody can identify without reading it, so orientation needs the access the store exists to control — and both of the week's failure modes stay available: no used_by list, so a rotation misses a consumer; no on_loss line, so recovery is improvised under pressure. Sequenced so ops-mason does not guess. T01 establishes owners, because a confidently wrong used_by is worse than an empty one — a rotation will trust it. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 --- ...-0004-credential-inventory-descriptions.md | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 workplans/MASON-WP-0004-credential-inventory-descriptions.md diff --git a/workplans/MASON-WP-0004-credential-inventory-descriptions.md b/workplans/MASON-WP-0004-credential-inventory-descriptions.md new file mode 100644 index 0000000..c543db9 --- /dev/null +++ b/workplans/MASON-WP-0004-credential-inventory-descriptions.md @@ -0,0 +1,117 @@ +--- +id: MASON-WP-0004 +type: workplan +title: "Describe every stored credential so the store is navigable" +domain: infotech +repo: ops-mason +status: proposed +owner: codex +topic_slug: custodian +created: "2026-08-28" +related: + - MASON-WP-0003 + - NK-WP-0033 +--- + +# Describe every stored credential so the store is navigable + +## Goal + +Give all 21 credential paths in `operators/` and `platform/workloads/` the five +`custom_metadata` fields the custody standard requires, so an operator can find +out what a credential is without reading it. + +## Why this exists + +`custody-inventory.py` reported 21 paths on 2026-08-28. Four carry descriptions +— the ones `MASON-WP-0003` touched. **Seventeen carry none.** + +An undescribed credential is one nobody can identify without reading it, which +means orientation requires the very access the store exists to control. It also +means the two failure modes of the previous week stay available: no `used_by` +list, so a rotation misses a consumer the way privacyIDEA's resolver was missed +for four days; and no `on_loss` line, so recovery gets improvised under pressure +the way the LLDAP predecessor's did. + +This is not urgent the way a broken login is urgent. It is the difference +between a secret store and a drawer of unmarked keys. + +## What "described" means + +Five fields, per `net-kingdom/docs/platform-root-custody.md`: `description`, +`owner`, `used_by`, `rotation`, `on_loss`. Metadata only — no path's value is +read, and `ops-mason-build` cannot read one. + +## Establish owners before writing anything + +```task +id: MASON-WP-0004-T01 +status: todo +priority: medium +``` + +Most of the seventeen predate this repository and ops-mason cannot invent what +they are for. Group them by mount prefix, propose an owning repo for each from +the ops-warden catalog and the paths themselves, and take the founder's ruling +on the ones that are genuinely unclear. + +Guessing is the failure mode to avoid: a confidently wrong `used_by` is worse +than an empty one, because a rotation will trust it. + +Acceptance: every one of the seventeen has a named owner, or is explicitly +listed as unknown with the question that would settle it. + +## Describe the paths whose purpose is already documented + +```task +id: MASON-WP-0004-T02 +status: todo +priority: medium +``` + +Several are covered by an existing ops-warden catalog entry, playbook, or +construction plan in `plans/` — `railiance/backup/*`, `rapp-qonto/*`, +`user-engine/runtime`, `reuse-surface/runtime-secrets` among them. For those the +five fields can be written from documents that already exist, with `rotation` +pointing at the real procedure rather than paraphrasing it. + +Acceptance: `custody-inventory.py` reports these paths without a `!`, and each +`rotation` field names a document that exists. + +## Resolve the rest with their owners + +```task +id: MASON-WP-0004-T03 +status: wait +priority: low +``` + +Blocked on T01. What remains after T02 are paths whose purpose is not written +down anywhere. Each needs its owner to answer three questions: what is this, what +breaks when it changes, and what do you do when it is lost. + +A path whose owner cannot answer the third question is a finding in its own +right — it is a credential with no recovery story, and that is worth knowing +before it is lost rather than after. + +Acceptance: `custody-inventory.py` exits 0 across both mounts, or the remainder +is a short list with a recorded reason each. + +## Make an undescribed path visible before it accumulates + +```task +id: MASON-WP-0004-T04 +status: wait +priority: low +``` + +Blocked on T03. Seventeen accumulated because nothing ever looked. Wire +`custody-inventory.py --undescribed` into whatever already runs regularly +against this repo, so a new undescribed path is noticed in days rather than +discovered in a year. + +The check must not fail a build for a path someone else owns; it reports, and +the report has a reader. + +Acceptance: an undescribed path added today surfaces without anyone +remembering to look.