coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T04: note verification runs under ops-mason-survey

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-07 10:44:38 +02:00
parent e70725077b
commit 989236a36c
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -82,3 +82,8 @@ After platform applies the objects: a live metadata-only survey and the
plan's six verification checks (capabilities and metadata only). Then a
pointer-only ops-warden entry for the operator lane (`resolvable: false`
until the checks pass).
Note (2026-10-07, MASON-IN-0004): the capability verification runs under the
read-only `ops-mason-survey` grant, which replaces `ops-mason-build`. Installing
that policy is a founder act (AGENTS.md, "Installing the survey policy");
ops-mason cannot install or widen it.