coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): sync task status from DB [auto]

Browse source 
Updated by fix-consistency on 2026-10-03:
  - update .custodian-brief.md for ops-mason

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
custodian-sync 2026-10-03 08:30:30 +02:00
parent 21f8b3754f
commit 96f8bffb3b
1 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

26
.custodian-brief.md
View file

@ -2,23 +2,11 @@
# Custodian Brief — ops-mason
**Domain:** infotech
**Last synced:** 2026-10-03 01:50 UTC
**Last synced:** 2026-10-03 06:30 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Project the tenant-engine audit-core sender token into its namespace
Progress: 2/6 done | workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
**Open tasks:**
- ! Manifests in the tenant-engine rApp repository `e56f0374`
*(wait: tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD.)*
- ! Attended seed of the dedicated KV path `1bb05319`
*(wait: Attended founder session: run railiance-platform scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role) under warden openbao-platform-admin-login, then a wrapped platform-admin process copies the tenant-engine token from the registry document to platform/workloads/tenant-engine/audit-core-sender without printing it; ops-mason-build is denied value reads, so only an attended admin lane can do it.)*
- ! Verify and hand off `84576093`
*(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)*
- · Complete the live survey and review the plan `1819909b`
### Describe every stored credential so the store is navigable
Progress: 0/4 done | workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
@ -32,6 +20,18 @@ Progress: 0/4 done | workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
- ! Make an undescribed path visible before it accumulates `9a0cea06`
*(wait: Blocked on T03.)*
### Project the tenant-engine audit-core sender token into its namespace
Progress: 2/6 done | workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
**Open tasks:**
- ! Manifests in the tenant-engine rApp repository `e56f0374`
*(wait: tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD.)*
- ! Attended seed of the dedicated KV path `1bb05319`
*(wait: Attended founder sitting, reviewed sequence in railiance-platform docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md (commit e7eb9db): 1) scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role), 2) scripts/tenant_engine_audit_core_sender_seed.py --dry-run, 3) the same helper without --dry-run, each under warden openbao-platform-admin-login. Silent CAS-0 copy of the tenant-engine token from the registry; never overwrites. Founder approves as one memo.)*
- ! Verify and hand off `84576093`
*(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)*
- · Complete the live survey and review the plan `1819909b`
### Construct the fluid-telegram operator credential lane
Progress: 0/6 done | workplan_id: `483e56d6-6601-5377-9066-66225214c046`