coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015: gate CCR evidence and qualify the kube wait

Browse source 
T07 generates a CCR policy through the platform generator and refuses
record-evidence unless the built policy matches the CCR file. T06 stays
wait on the open founder decision after a fresh can-i of yes, yes, yes.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 01:59:49 +02:00
parent 4e46aa3b4f
commit 9b705ec62c
6 changed files with 385 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
intakes/intakes.md
View file

@ -254,6 +254,11 @@ description: >-
The only control against Secret reads is the guard-secret-reads transcript
hook, which is a convention, not access control. Checked by capability
queries only; not exercised.
Fresh check 2026-10-22 (captured 2026-10-21T23:55:17Z), context default,
name-only, all namespaces: create serviceaccounts/token yes, create pods
yes, impersonate serviceaccounts yes. Still cluster-admin. Options (a),
(b), and (c) below are unchanged and unchosen. MASON-WP-0015-T06 waits on
founder decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1.
Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing
is listening, but the railiance-platform runbooks still reference it.
options: >-
@ -269,7 +274,7 @@ options: >-
date.
Cluster RBAC and the kubeconfig distribution belong to railiance-platform
(and railiance-infra for node credentials); this is a founder decision.
updated: '2026-10-18T00:00:00Z'
updated: '2026-10-22T00:00:00Z'
state_hub_intake_id: "01a14ea8-3bd8-7da1-b51e-849067a39aff"
```