From 9ef2a7031e7bcaeb1375c25e242c1f9d219d5eae Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 12:14:46 +0200 Subject: [PATCH] MASON-WP-0014-T02: live survey; MAS TEM plan reviewed No existing lane reads platform/suppliers/scaleway/mas-tem-relay. The SMTP ESO lanes read the IONOS mailbox and are not reused. The founder wrote the TEM value (v2). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f --- .custodian-brief.md | 6 +- WORK-RECORDS.md | 4 +- plans/mas-tem-relay-smtp.md | 161 +++++++++++++++--- workplans/MASON-WP-0014-mas-tem-relay-smtp.md | 4 +- 4 files changed, 141 insertions(+), 34 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index dcf104a..a050618 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,15 @@ # Custodian Brief — ops-mason **Domain:** infotech -**Last synced:** 2026-10-18 09:50 UTC +**Last synced:** 2026-10-18 10:05 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant -Progress: 2/6 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804` +Progress: 4/6 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804` **Open tasks:** -- ! Live negative and positive tests `8b512822` -- · Install the policy (founder act) `1c8893bd` - · Executor and post-build check `7b7a436f` - · Close the Kubernetes variant `feb17422` diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index be00d07..bd3ae55 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -96,8 +96,8 @@ | task | MASON-WP-0014-T03 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md | | task | MASON-WP-0014-T04 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md | | task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md | -| task | MASON-WP-0015-T02 | todo | — | workplans/MASON-WP-0015-construct-grant.md | -| task | MASON-WP-0015-T03 | wait | — | workplans/MASON-WP-0015-construct-grant.md | +| task | MASON-WP-0015-T02 | done | — | workplans/MASON-WP-0015-construct-grant.md | +| task | MASON-WP-0015-T03 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T04 | todo | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T05 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T06 | todo | — | workplans/MASON-WP-0015-construct-grant.md | diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md index 1cde581..f6f8999 100644 --- a/plans/mas-tem-relay-smtp.md +++ b/plans/mas-tem-relay-smtp.md @@ -3,7 +3,7 @@ id: mas-tem-relay-smtp demand_source: mail-address-semantics/workplans/MAS-WP-0003-T03 consumer_repo: mail-address-semantics credential_type: openbao-kv-founder-provision -status: draft +status: reviewed approved_by: null approved_at: null created: "2026-10-18" @@ -31,33 +31,133 @@ This plan keeps the shape but adapts it to the current conventions (§3). ## 2. Existing-structure survey -Checked 2026-10-18 from repo sources only. **Live survey pending:** no -`ops-mason-survey` grant was active (`bao-session.sh status`: none). Run -before review: +Generated by `scripts/plan-survey.py` at 2026-10-18T10:13:55Z against `BAO_ADDR=http://127.0.0.1:18200`, token display_name `token-claude-MASON-WP-0014-T02` (policies: default, ops-mason-survey). Metadata only: no `kv get` and no `*/data/*` read was issued; policy bodies were read with `bao policy read` for name-matched candidates only. -```bash -./scripts/plan-survey.py --kv-path platform/suppliers/scaleway/mas-tem-relay \ - --policy workload-kv-read-mas-tem-relay \ - --k8s-role external-secrets-mas-tem-relay \ - --consumer mail-address-semantics --keyword tem --keyword smtp +Demand: KV path `platform/suppliers/scaleway/mas-tem-relay`, proposed policy `workload-kv-read-mas-tem-relay`, AppRole `-`, Kubernetes role `external-secrets-mas-tem-relay`, consumer `mail-address-semantics`. Match terms: `mail-address-semantics`, `external-secrets-mas-tem-relay`, `tem`, `smtp`, `mas`, `suppliers`, `scaleway`, `mas-tem-relay`. + +### `bao secrets list` (10 mounts, 1 relevant) + +```text +platform/ kv version=2 ``` -- **Catalog** (`ops-warden/registry/routing/catalog.yaml`): no entry for - `mas`, TEM or SMTP relay. Entry `platform-supplier-credentials` fixes - the path shape: a Scaleway API key is a supplier account credential, so it - lives at `platform/suppliers/scaleway/`, not under `workloads/`. -- **railiance-platform:** no CCR, policy or store mentions `mas` or - `tem.scaleway`. The latest CCR is `CCR-2026-0050`. -- **Nearest lane:** `openbao-email-connect` (CCR-2026-0010) is a TEM-adjacent - sender for namespace `email-connect`. It is a separate product with its own - Scaleway key. Reusing it would give the throwaway test MX a production - sender's key, so it is not reused. -- **Store pattern:** new lanes use Kubernetes auth bound to one namespace - and one ServiceAccount, with no static ESO token (RPF-WP-0045, - CCR-2026-0050). Older AppRole/token stores, such as - `openbao-backup-object-storage`, are being migrated away from. -- **Does an existing lane already satisfy this?** No (draft; confirm with - the live survey). +### `bao auth list` (6 auth mounts, 2 relevant) + +```text +approle/ approle +kubernetes/ kubernetes +``` + +### `bao policy list` (94 policies, 5 relevant) + +```text +authelia-smtp-eso matches: smtp +operator-kv-scaleway-bootstrap matches: scaleway +ops-mason-construct matches: mas +ops-mason-survey matches: mas +telemetry-smtp-eso matches: smtp +``` + +### `bao list auth/approle/role` (approle) (14 roles, 0 relevant) + +```text +(no relevant entries) +``` + +### `bao list auth/kubernetes/role` (kubernetes) (35 roles, 2 relevant) + +```text +authelia-smtp-eso matches: smtp + token_policies=['authelia-smtp-eso'] + token_ttl=900 + token_max_ttl=900 + token_num_uses=0 + bound_service_account_names=['authelia-smtp-eso'] + bound_service_account_namespaces=['sso'] + audience=openbao +telemetry-smtp-eso matches: smtp + token_policies=['telemetry-smtp-eso'] + token_ttl=900 + token_max_ttl=900 + token_num_uses=0 + bound_service_account_names=['telemetry-smtp-eso'] + bound_service_account_namespaces=['telemetry'] + audience=openbao +``` + +### `bao policy read` of name-matched candidates (target `platform/data/suppliers/scaleway/mas-tem-relay`) + +```text +authelia-smtp-eso: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay +operator-kv-scaleway-bootstrap: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay +ops-mason-construct: path "platform/data/suppliers/*" capabilities=['create'] +ops-mason-construct: path "platform/metadata/suppliers/*" capabilities=['create', 'read', 'update', 'delete', 'list'] +ops-mason-construct: path "platform/metadata/*" capabilities=['read', 'list'] +ops-mason-construct: path "platform/data/*" capabilities=['deny'] +ops-mason-survey: not permitted by ops-mason-survey +telemetry-smtp-eso: no stanza covers platform/data/suppliers/scaleway/mas-tem-relay +``` + +### `bao kv metadata get` / `bao kv list` (metadata only) + +```text +platform/suppliers/scaleway/mas-tem-relay: exists, current_version=2, created=2026-10-18, updated=2026-10-18 + owner: railiance-platform +platform/suppliers/scaleway/: backup, bootstrap, mas-tem-relay +``` + +### ops-warden routing catalog `/home/worsch/ops-warden/registry/routing/catalog.yaml` (48 entries, 10 relevant) + +```text +state-hub-forge-derivation-read owner=ops-mason status=active matches: mas + path_template: platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN) + auth_method: Kubernetes auth (role state-hub-forge-derivation, ServiceAccount state-hub/state-hub) from the in-cluster state-hub workload +object-storage-sts owner=net-kingdom status=draft matches: tem +rein-openweights-openrouter-approle owner=ops-mason status=active matches: mas + path_template: reins/rein-openweights/openrouter + auth_method: AppRole login role=rein-openweights (role_id+secret_id via REIN_OPENWEIGHTS_APPROLE_DIR) +inbound-library-imap-approle owner=ops-mason status=active matches: mas + path_template: platform/workloads/inbound-library/imap + auth_method: AppRole login role=inbound-library (role_id+secret_id in ~/.local/inbound-library/approle, config/library.json credential.approle_dir) +audit-core-senders owner=ops-mason status=active matches: mas + path_template: platform/workloads/audit-core/senders + policy_ref: external-secrets-audit-core + auth_method: OpenBao KV v2 custody; audit-core reads via ESO (policy external-secrets-audit-core, token auth). Operators and agents never read the registry; a sender gets its own exact-path projection. +email-connect-transactional owner=railiance-platform status=active matches: smtp + path_template: platform/workloads/email-connect/transactional + policy_ref: flex-auth check secret.read:email-connect + auth_method: caller's own OpenBao token (operator OIDC, or ESO child token openbao-email-connect-eso-token) +scaleway-bootstrap owner=railiance-platform status=draft matches: mas, scaleway + path_template: platform/workloads/railiance/scaleway/bootstrap + auth_method: caller's own OpenBao token (founder / operator workstation) +openbao-structure-survey owner=ops-mason status=active matches: mas + auth_method: founder-minted scoped grant: ops-mason scripts/bao-session.sh grant (policy ops-mason-survey, 45m, display_name claude-) +platform-supplier-credentials owner=railiance-platform status=active matches: suppliers + path_template: platform/suppliers// + auth_method: railiance-platform delegated credential change (CCR); founder-attended provision from a mode-0600 file +fluid-telegram-operator owner=ops-mason status=draft matches: mas + path_template: platform/workloads/coulomb/fluid-telegram/hall-of-helix/{operator-app,operator-session,bot-token,redaction-salt} + auth_method: bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv (members of fluid-telegram-operators, aal2, 15m token) +``` + + +### Does an existing lane already satisfy this demand? + +**Decision (review 2026-10-18): no.** Edited from the generated "partial". + +- The KV path exists because ops-mason created the placeholder (v1, + 10:03Z), and the founder wrote the TEM value as v2 (10:11Z). That is the + home this plan builds, not an existing lane. +- No policy or role reads `platform/data/suppliers/scaleway/mas-tem-relay`. + The only name-matched policy that touches the path is `ops-mason-construct`, + which has create-only access and cannot read. +- The two SMTP ESO lanes, `authelia-smtp-eso` and `telemetry-smtp-eso`, both + read `platform/data/workloads/railiance-telemetry/smtp`, which is the IONOS + mailbox `platform@coulomb.social` (CCR-2026-0035). That is a different + supplier and belongs to production senders, so it is not reused. +- Repo sources (checked earlier the same day): no catalog entry or CCR for + `mas` or TEM. `openbao-email-connect` is a separate production sender. +- Not detected by design: a policy with an unrelated name covering the path. ## 3. Proposed changes @@ -116,8 +216,15 @@ No catalog entry: the lane is temporary and has a single consumer. namespaced store (easier to retire). The consumer applies rows 4 itself. - **Secret values:** ops-mason neither reads nor writes them. The policy grants `read` only to the ESO role. -- **Open:** live survey (§2); CCR number from railiance-platform; - `bound_claims_confirmed` after the SA exists. +- **Naming vs existing SMTP lanes:** `authelia-smtp-eso` and + `telemetry-smtp-eso` use one name for role, policy and SA. This lane keeps + the `external-secrets-*` / `workload-kv-read-*` shape, which is what + `ops-mason-construct` may build (MASON-IN-0005). +- **Build path:** after approval, ops-mason applies rows 2–3 itself under + `bao-session.sh build`. Row 1 is done: the placeholder came first and the + founder wrote the value on 2026-10-18. +- **Open:** CCR number from railiance-platform; `bound_claims_confirmed` + after the SA exists; founder approval. ## 5. Executive summary diff --git a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md index 1a2701f..ab86276 100644 --- a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md +++ b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md @@ -35,13 +35,15 @@ requester with the proposed path, role and store names. ```task id: MASON-WP-0014-T02 -status: wait +status: done priority: high state_hub_task_id: "cebd25bc-20eb-56ec-9802-e020ee1aa645" ``` Needs an `ops-mason-survey` grant (`bao-session.sh grant MASON-WP-0014-T02`). Run `plan-survey.py` as given in plan §2, then set the plan to `reviewed`. +Done 2026-10-18 (survey 10:13:55Z, decision: no existing lane). The KV value +was written by the founder as v2. ## CCR and founder approval