From bc5c99797ceeefc7df17a5f31092006dfff8de5d Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 23:43:13 +0200 Subject: [PATCH] MASON-WP-0009-T02/T03 done; record net-kingdom fold-in for WP-0010-T01 WP-0009: founder approvals and owner changes are applied live per key-cape (KEY-WP-0037 finished 2026-10-07); only T05 (service-JWT lane proof) remains. WP-0010: net-kingdom 074b3a0 adopted all six T01 refinements. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- ...e-secrets-engine-openbao-client-custody.md | 25 ++++++++++++++----- ...N-WP-0010-security-case-materialization.md | 4 +++ 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md index ce80e7d..bc50382 100644 --- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md +++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md @@ -51,24 +51,37 @@ deferred to T04 (no bao access in this task). ```task id: MASON-WP-0009-T02 -status: wait -blocked_on: founder-approval -blocking_reason: "Founder must give A1 (this plan), A2 (revised CCR-2026-0033 with the operator reader and confirmed bound claims) and A3 (custody-child decision id); see plan section 5." +status: done priority: high state_hub_task_id: "4329bcd1-d42f-56a3-92cb-63b36d79549e" ``` +2026-10-08 (inbox sweep): given and acted on. key-cape reported 2026-10-07 +(message `dc8b5d3b`) that the founder applied CCR-2026-0033 (amended under +decision `1fdd993b` with `token_self_lifecycle`) and CCR-2026-0034; the custody +location decision is `2ab717e1`; the client was registered under live go +`caafe4be`. + ## Owner changes delivered ```task id: MASON-WP-0009-T03 -status: wait -blocked_on: message-from:railiance-platform -blocking_reason: "railiance-platform revises CCR-2026-0033 and its custody child; secrets-engine replaces the file provider for this profile; key-cape confirms the groups claim and MFA assurance for the OpenBao OIDC client." +status: done priority: high state_hub_task_id: "f59fae58-397a-5bf5-9d1d-a33dc4aaa2ac" ``` +2026-10-08 (inbox sweep): all three owners delivered. railiance-platform +revised CCR-2026-0033 (`4a284f0`, message `7e96e835`); secrets-engine replaced +the consumer file with an in-memory OpenBao read (`b8094f7`, message +`c84fb5ba`); key-cape confirmed `groups` and the `aal2` assurance binding +(`7d96ee4`, message `71a31d0d`). Live result (key-cape `e0b5fae`, KEY-WP-0037 +finished 2026-10-07): ESO `sso/keycape-secrets-engine-openbao-client` synced, +verify-client 10/10 with excess scope and wrong secret refused, founder +operator OIDC login (net-kingdom-admins, aal2) and revoke-self worked. +Evidence: key-cape `docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`. +Only T05 (service-JWT lane proof, RPF-WP-0035-T02) remains. + ## Verify and propose the route ```task diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md index 488023a..72c7d0b 100644 --- a/workplans/MASON-WP-0010-security-case-materialization.md +++ b/workplans/MASON-WP-0010-security-case-materialization.md @@ -91,6 +91,10 @@ Requested refinements, each from the live CCR-2026-0033 placement With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05. +2026-10-08: net-kingdom folded in all six (net-kingdom `074b3a0`, message +`508e2a12`); its schema/validator now require a body on policy and role items. +NK-WP-0048-T05 still waits on WARDEN-WP-0044-T01 and a founder answer. + ```task id: MASON-WP-0010-T02 status: wait