coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T02/T03 done; record net-kingdom fold-in for WP-0010-T01

Browse source 
WP-0009: founder approvals and owner changes are applied live per key-cape
(KEY-WP-0037 finished 2026-10-07); only T05 (service-JWT lane proof) remains.
WP-0010: net-kingdom 074b3a0 adopted all six T01 refinements.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-08 23:43:13 +02:00
parent 5290ca1970
commit bc5c99797c
2 changed files with 23 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -51,24 +51,37 @@ deferred to T04 (no bao access in this task).
```task
id: MASON-WP-0009-T02
status: wait
blocked_on: founder-approval
blocking_reason: "Founder must give A1 (this plan), A2 (revised CCR-2026-0033 with the operator reader and confirmed bound claims) and A3 (custody-child decision id); see plan section 5."
status: done
priority: high
state_hub_task_id: "4329bcd1-d42f-56a3-92cb-63b36d79549e"
```
2026-10-08 (inbox sweep): given and acted on. key-cape reported 2026-10-07
(message `dc8b5d3b`) that the founder applied CCR-2026-0033 (amended under
decision `1fdd993b` with `token_self_lifecycle`) and CCR-2026-0034; the custody
location decision is `2ab717e1`; the client was registered under live go
`caafe4be`.
## Owner changes delivered
```task
id: MASON-WP-0009-T03
status: wait
blocked_on: message-from:railiance-platform
blocking_reason: "railiance-platform revises CCR-2026-0033 and its custody child; secrets-engine replaces the file provider for this profile; key-cape confirms the groups claim and MFA assurance for the OpenBao OIDC client."
status: done
priority: high
state_hub_task_id: "f59fae58-397a-5bf5-9d1d-a33dc4aaa2ac"
```
2026-10-08 (inbox sweep): all three owners delivered. railiance-platform
revised CCR-2026-0033 (`4a284f0`, message `7e96e835`); secrets-engine replaced
the consumer file with an in-memory OpenBao read (`b8094f7`, message
`c84fb5ba`); key-cape confirmed `groups` and the `aal2` assurance binding
(`7d96ee4`, message `71a31d0d`). Live result (key-cape `e0b5fae`, KEY-WP-0037
finished 2026-10-07): ESO `sso/keycape-secrets-engine-openbao-client` synced,
verify-client 10/10 with excess scope and wrong secret refused, founder
operator OIDC login (net-kingdom-admins, aal2) and revoke-self worked.
Evidence: key-cape `docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`.
Only T05 (service-JWT lane proof, RPF-WP-0035-T02) remains.
## Verify and propose the route
```task

4
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -91,6 +91,10 @@ Requested refinements, each from the live CCR-2026-0033 placement
With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05.
2026-10-08: net-kingdom folded in all six (net-kingdom `074b3a0`, message
`508e2a12`); its schema/validator now require a body on policy and role items.
NK-WP-0048-T05 still waits on WARDEN-WP-0044-T01 and a founder answer.
```task
id: MASON-WP-0010-T02
status: wait