coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015: gate CCR evidence and qualify the kube wait

Browse source 
T07 generates a CCR policy through the platform generator and refuses
record-evidence unless the built policy matches the CCR file. T06 stays
wait on the open founder decision after a fresh can-i of yes, yes, yes.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 01:59:49 +02:00
parent 4e46aa3b4f
commit 9b705ec62c
6 changed files with 385 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

38
workplans/MASON-WP-0015-construct-grant.md
View file

@ -8,7 +8,7 @@ status: active
owner: claude
topic_slug: netkingdom-security-architecture
created: "2026-10-18"
updated: "2026-10-18"
updated: "2026-10-22"
flavor: implementation
depends_on: []
state_hub_workstream_id: "384b3efc-f9a5-5ea9-b224-0ce900e79804"
@ -115,6 +115,9 @@ only. They edit their own files.
id: MASON-WP-0015-T06
status: wait
priority: medium
needs_human: true
decision_id: "30d29060-8d14-4a8e-9cde-34aa826eb8d1"
intervention_note: "Founder chooses MASON-IN-0006 option (a), (b), or (c). ops-mason did not choose and did not change cluster RBAC."
state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05"
```
@ -127,24 +130,37 @@ the Pod and Secret kinds. Record the result in INTENT.md's
Result 2026-10-18: **open.** The kube identity is system:admin
(system:masters). It can create serviceaccounts/token, pods and impersonate,
cluster-wide. Raised as MASON-IN-0006; this waits on the founder's decision
there.
cluster-wide. Raised as MASON-IN-0006.
Result 2026-10-22, context `default`, captured 2026-10-21T23:55:17Z,
`--all-namespaces`, name-only: create serviceaccounts/token **yes**, create
pods **yes**, impersonate serviceaccounts **yes**. The identity is still
cluster-admin. MASON-IN-0006 stays the open residual and still names options
(a), (b), and (c). This task does not choose one and does not change cluster
RBAC. It waits on founder decision
`30d29060-8d14-4a8e-9cde-34aa826eb8d1` (open, pending).
## Submit CCRs from approved plans (RPF-WP-0061)
```task
id: MASON-WP-0015-T07
status: wait
status: done
priority: medium
state_hub_task_id: "ebc420c6-be1a-5abb-b766-fda0bdf2680b"
```
railiance-platform RPF-WP-0061 makes ops-mason the only CCR submitter
(`credential-change.py submit`). ops-mason's side:
- generate the CCR draft and policy file from the plan, using platform's
generator once it is exposed;
- take plan approval from the single hub decision after `sync-decision`;
- compare the built policy with the CCR policy file, then `record-evidence`.
(`credential-change.py submit`). RPF-WP-0061-T03 and T04 are done, so this
no longer waits on them. RPF-WP-0061-T05 still waits for a first live
self-service submission; none was filed here because no approved plan is
waiting.
Comment sent 2026-10-18, as a reply to `f49ddd0d`. This waits on
RPF-WP-0061-T03 and T04.
2026-10-22: ops-mason generates the CCR draft and its policy from the plan
through the platform generator (`credential-change.py render-policy`,
`src/ops_mason/ccr_gate.py` `draft_from_plan`). Plan approval is the single
hub decision recorded on the draft (`state_hub.decision_id`). ops-mason did
not run `sync-decision`; that stays a platform or founder step. Before
`record-evidence`, `record_evidence` compares the built policy text with the
CCR policy file and refuses the call unless they match, with a trailing
newline normalised. The draft, the policy, and the evidence contain no
secret value. Tests: `tests/test_ccr_gate.py` and `tests/test_construct_policy.py`.