MASON-WP-0014-T02: live survey; MAS TEM plan reviewed
No existing lane reads platform/suppliers/scaleway/mas-tem-relay. The SMTP ESO lanes read the IONOS mailbox and are not reused. The founder wrote the TEM value (v2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
parent
e5b72a6b30
commit
9ef2a7031e
4 changed files with 141 additions and 34 deletions
|
|
@ -2,17 +2,15 @@
|
|||
# Custodian Brief — ops-mason
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-18 09:50 UTC
|
||||
**Last synced:** 2026-10-18 10:05 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant
|
||||
Progress: 2/6 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804`
|
||||
Progress: 4/6 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Live negative and positive tests `8b512822`
|
||||
- · Install the policy (founder act) `1c8893bd`
|
||||
- · Executor and post-build check `7b7a436f`
|
||||
- · Close the Kubernetes variant `feb17422`
|
||||
|
||||
|
|
|
|||
|
|
@ -96,8 +96,8 @@
|
|||
| task | MASON-WP-0014-T03 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
|
||||
| task | MASON-WP-0014-T04 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
|
||||
| task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T02 | todo | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T03 | wait | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T02 | done | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T03 | done | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T04 | todo | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T05 | done | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
| task | MASON-WP-0015-T06 | todo | — | workplans/MASON-WP-0015-construct-grant.md |
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ id: mas-tem-relay-smtp
|
|||
demand_source: mail-address-semantics/workplans/MAS-WP-0003-T03
|
||||
consumer_repo: mail-address-semantics
|
||||
credential_type: openbao-kv-founder-provision
|
||||
status: draft
|
||||
status: reviewed
|
||||
approved_by: null
|
||||
approved_at: null
|
||||
created: "2026-10-18"
|
||||
|
|
@ -31,33 +31,133 @@ This plan keeps the shape but adapts it to the current conventions (§3).
|
|||
|
||||
## 2. Existing-structure survey
|
||||
|
||||
Checked 2026-10-18 from repo sources only. **Live survey pending:** no
|
||||
`ops-mason-survey` grant was active (`bao-session.sh status`: none). Run
|
||||
before review:
|
||||
Generated by `scripts/plan-survey.py` at 2026-10-18T10:13:55Z against `BAO_ADDR=http://127.0.0.1:18200`, token display_name `token-claude-MASON-WP-0014-T02` (policies: default, ops-mason-survey). Metadata only: no `kv get` and no `*/data/*` read was issued; policy bodies were read with `bao policy read` for name-matched candidates only.
|
||||
|
||||
```bash
|
||||
./scripts/plan-survey.py --kv-path platform/suppliers/scaleway/mas-tem-relay \
|
||||
--policy workload-kv-read-mas-tem-relay \
|
||||
--k8s-role external-secrets-mas-tem-relay \
|
||||
--consumer mail-address-semantics --keyword tem --keyword smtp
|
||||
Demand: KV path `platform/suppliers/scaleway/mas-tem-relay`, proposed policy `workload-kv-read-mas-tem-relay`, AppRole `-`, Kubernetes role `external-secrets-mas-tem-relay`, consumer `mail-address-semantics`. Match terms: `mail-address-semantics`, `external-secrets-mas-tem-relay`, `tem`, `smtp`, `mas`, `suppliers`, `scaleway`, `mas-tem-relay`.
|
||||
|
||||
### `bao secrets list` (10 mounts, 1 relevant)
|
||||
|
||||
```text
|
||||
platform/ kv version=2
|
||||
```
|
||||
|
||||
- **Catalog** (`ops-warden/registry/routing/catalog.yaml`): no entry for
|
||||
`mas`, TEM or SMTP relay. Entry `platform-supplier-credentials` fixes
|
||||
the path shape: a Scaleway API key is a supplier account credential, so it
|
||||
lives at `platform/suppliers/scaleway/<account>`, not under `workloads/`.
|
||||
- **railiance-platform:** no CCR, policy or store mentions `mas` or
|
||||
`tem.scaleway`. The latest CCR is `CCR-2026-0050`.
|
||||
- **Nearest lane:** `openbao-email-connect` (CCR-2026-0010) is a TEM-adjacent
|
||||
sender for namespace `email-connect`. It is a separate product with its own
|
||||
Scaleway key. Reusing it would give the throwaway test MX a production
|
||||
sender's key, so it is not reused.
|
||||
- **Store pattern:** new lanes use Kubernetes auth bound to one namespace
|
||||
and one ServiceAccount, with no static ESO token (RPF-WP-0045,
|
||||
CCR-2026-0050). Older AppRole/token stores, such as
|
||||
`openbao-backup-object-storage`, are being migrated away from.
|
||||
- **Does an existing lane already satisfy this?** No (draft; confirm with
|
||||
the live survey).
|
||||
### `bao auth list` (6 auth mounts, 2 relevant)
|
||||
|
||||
```text
|
||||
approle/ approle
|
||||
kubernetes/ kubernetes
|
||||
```
|
||||
|
||||
### `bao policy list` (94 policies, 5 relevant)
|
||||
|
||||
```text
|
||||
authelia-smtp-eso matches: smtp
|
||||
operator-kv-scaleway-bootstrap matches: scaleway
|
||||
ops-mason-construct matches: mas
|
||||
ops-mason-survey matches: mas
|
||||
telemetry-smtp-eso matches: smtp
|
||||
```
|
||||
|
||||
### `bao list auth/approle/role` (approle) (14 roles, 0 relevant)
|
||||
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
### `bao list auth/kubernetes/role` (kubernetes) (35 roles, 2 relevant)
|
||||
|
||||
```text
|
||||
authelia-smtp-eso matches: smtp
|
||||
token_policies=['authelia-smtp-eso']
|
||||
token_ttl=900
|
||||
token_max_ttl=900
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['authelia-smtp-eso']
|
||||
bound_service_account_namespaces=['sso']
|
||||
audience=openbao
|
||||
telemetry-smtp-eso matches: smtp
|
||||
token_policies=['telemetry-smtp-eso']
|
||||
token_ttl=900
|
||||
token_max_ttl=900
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['telemetry-smtp-eso']
|
||||
bound_service_account_namespaces=['telemetry']
|
||||
audience=openbao
|
||||
```
|
||||
|
||||
### `bao policy read` of name-matched candidates (target `platform/data/suppliers/scaleway/mas-tem-relay`)
|
||||
|
||||
```text
|
||||
authelia-smtp-eso: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay
|
||||
operator-kv-scaleway-bootstrap: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay
|
||||
ops-mason-construct: path "platform/data/suppliers/*" capabilities=['create']
|
||||
ops-mason-construct: path "platform/metadata/suppliers/*" capabilities=['create', 'read', 'update', 'delete', 'list']
|
||||
ops-mason-construct: path "platform/metadata/*" capabilities=['read', 'list']
|
||||
ops-mason-construct: path "platform/data/*" capabilities=['deny']
|
||||
ops-mason-survey: not permitted by ops-mason-survey
|
||||
telemetry-smtp-eso: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay
|
||||
```
|
||||
|
||||
### `bao kv metadata get` / `bao kv list` (metadata only)
|
||||
|
||||
```text
|
||||
platform/suppliers/scaleway/mas-tem-relay: exists, current_version=2, created=2026-10-18, updated=2026-10-18
|
||||
owner: railiance-platform
|
||||
platform/suppliers/scaleway/: backup, bootstrap, mas-tem-relay
|
||||
```
|
||||
|
||||
### ops-warden routing catalog `/home/worsch/ops-warden/registry/routing/catalog.yaml` (48 entries, 10 relevant)
|
||||
|
||||
```text
|
||||
state-hub-forge-derivation-read owner=ops-mason status=active matches: mas
|
||||
path_template: platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN)
|
||||
auth_method: Kubernetes auth (role state-hub-forge-derivation, ServiceAccount state-hub/state-hub) from the in-cluster state-hub workload
|
||||
object-storage-sts owner=net-kingdom status=draft matches: tem
|
||||
rein-openweights-openrouter-approle owner=ops-mason status=active matches: mas
|
||||
path_template: reins/rein-openweights/openrouter
|
||||
auth_method: AppRole login role=rein-openweights (role_id+secret_id via REIN_OPENWEIGHTS_APPROLE_DIR)
|
||||
inbound-library-imap-approle owner=ops-mason status=active matches: mas
|
||||
path_template: platform/workloads/inbound-library/imap
|
||||
auth_method: AppRole login role=inbound-library (role_id+secret_id in ~/.local/inbound-library/approle, config/library.json credential.approle_dir)
|
||||
audit-core-senders owner=ops-mason status=active matches: mas
|
||||
path_template: platform/workloads/audit-core/senders
|
||||
policy_ref: external-secrets-audit-core
|
||||
auth_method: OpenBao KV v2 custody; audit-core reads via ESO (policy external-secrets-audit-core, token auth). Operators and agents never read the registry; a sender gets its own exact-path projection.
|
||||
email-connect-transactional owner=railiance-platform status=active matches: smtp
|
||||
path_template: platform/workloads/email-connect/transactional
|
||||
policy_ref: flex-auth check secret.read:email-connect
|
||||
auth_method: caller's own OpenBao token (operator OIDC, or ESO child token openbao-email-connect-eso-token)
|
||||
scaleway-bootstrap owner=railiance-platform status=draft matches: mas, scaleway
|
||||
path_template: platform/workloads/railiance/scaleway/bootstrap
|
||||
auth_method: caller's own OpenBao token (founder / operator workstation)
|
||||
openbao-structure-survey owner=ops-mason status=active matches: mas
|
||||
auth_method: founder-minted scoped grant: ops-mason scripts/bao-session.sh grant <task> (policy ops-mason-survey, 45m, display_name claude-<task>)
|
||||
platform-supplier-credentials owner=railiance-platform status=active matches: suppliers
|
||||
path_template: platform/suppliers/<supplier>/<account>
|
||||
auth_method: railiance-platform delegated credential change (CCR); founder-attended provision from a mode-0600 file
|
||||
fluid-telegram-operator owner=ops-mason status=draft matches: mas
|
||||
path_template: platform/workloads/coulomb/fluid-telegram/hall-of-helix/{operator-app,operator-session,bot-token,redaction-salt}
|
||||
auth_method: bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv (members of fluid-telegram-operators, aal2, 15m token)
|
||||
```
|
||||
|
||||
|
||||
### Does an existing lane already satisfy this demand?
|
||||
|
||||
**Decision (review 2026-10-18): no.** Edited from the generated "partial".
|
||||
|
||||
- The KV path exists because ops-mason created the placeholder (v1,
|
||||
10:03Z), and the founder wrote the TEM value as v2 (10:11Z). That is the
|
||||
home this plan builds, not an existing lane.
|
||||
- No policy or role reads `platform/data/suppliers/scaleway/mas-tem-relay`.
|
||||
The only name-matched policy that touches the path is `ops-mason-construct`,
|
||||
which has create-only access and cannot read.
|
||||
- The two SMTP ESO lanes, `authelia-smtp-eso` and `telemetry-smtp-eso`, both
|
||||
read `platform/data/workloads/railiance-telemetry/smtp`, which is the IONOS
|
||||
mailbox `platform@coulomb.social` (CCR-2026-0035). That is a different
|
||||
supplier and belongs to production senders, so it is not reused.
|
||||
- Repo sources (checked earlier the same day): no catalog entry or CCR for
|
||||
`mas` or TEM. `openbao-email-connect` is a separate production sender.
|
||||
- Not detected by design: a policy with an unrelated name covering the path.
|
||||
|
||||
## 3. Proposed changes
|
||||
|
||||
|
|
@ -116,8 +216,15 @@ No catalog entry: the lane is temporary and has a single consumer.
|
|||
namespaced store (easier to retire). The consumer applies rows 4 itself.
|
||||
- **Secret values:** ops-mason neither reads nor writes them. The policy
|
||||
grants `read` only to the ESO role.
|
||||
- **Open:** live survey (§2); CCR number from railiance-platform;
|
||||
`bound_claims_confirmed` after the SA exists.
|
||||
- **Naming vs existing SMTP lanes:** `authelia-smtp-eso` and
|
||||
`telemetry-smtp-eso` use one name for role, policy and SA. This lane keeps
|
||||
the `external-secrets-*` / `workload-kv-read-*` shape, which is what
|
||||
`ops-mason-construct` may build (MASON-IN-0005).
|
||||
- **Build path:** after approval, ops-mason applies rows 2–3 itself under
|
||||
`bao-session.sh build`. Row 1 is done: the placeholder came first and the
|
||||
founder wrote the value on 2026-10-18.
|
||||
- **Open:** CCR number from railiance-platform; `bound_claims_confirmed`
|
||||
after the SA exists; founder approval.
|
||||
|
||||
## 5. Executive summary
|
||||
|
||||
|
|
|
|||
|
|
@ -35,13 +35,15 @@ requester with the proposed path, role and store names.
|
|||
|
||||
```task
|
||||
id: MASON-WP-0014-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "cebd25bc-20eb-56ec-9802-e020ee1aa645"
|
||||
```
|
||||
|
||||
Needs an `ops-mason-survey` grant (`bao-session.sh grant MASON-WP-0014-T02`).
|
||||
Run `plan-survey.py` as given in plan §2, then set the plan to `reviewed`.
|
||||
Done 2026-10-18 (survey 10:13:55Z, decision: no existing lane). The KV value
|
||||
was written by the founder as v2.
|
||||
|
||||
## CCR and founder approval
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue