coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0004-T02: founder accepts the 29 complete custody descriptions

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 11:29:57 +02:00
parent 7d54d049c1
commit c2b6bd5ef3
1 changed files with 29 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

58
manifests/custody-descriptions.yaml
View file

@ -30,7 +30,7 @@ platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets:
on_loss: 'Re-issue per rotation: Replace OPENROUTER_API_KEY directly in OpenBao and record non-secret
rotation evidence.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml#lifecycle.rotate
sources:
- CCR-2026-0003-llm-connect-openrouter-api-key.yaml
@ -43,7 +43,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance
on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml#lifecycle.rotate
sources:
- CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml
@ -56,7 +56,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01:
on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml#lifecycle.rotate
sources:
- CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml
@ -82,7 +82,7 @@ platform/workloads/approval-engine/audit-sender:
only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
helper refuses rotation and unexpected existing values.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml#lifecycle.rotate
sources:
- CCR-2026-0021-approval-engine-audit.yaml
@ -96,7 +96,7 @@ platform/workloads/approval-engine/operator-client:
on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
KV version under the same attended authority. Rotation is independent of CCR-2026-0017.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml#lifecycle.rotate;
railiance-platform/credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml#lifecycle.rotate
sources:
@ -113,7 +113,7 @@ platform/workloads/audit-core/senders:
on_loss: audit-core re-mints sender tokens and every projected copy is reseeded; senders queue to their
local outboxes meanwhile. See ops-mason/plans/audit-core-openbao-runtime-custody.md.
owner: ops-mason
review: draft
review: accepted
rotation: ops-warden/wiki/playbooks/audit-core-senders.md#worker-checklist
sources:
- ops-warden catalog audit-core-senders
@ -129,7 +129,7 @@ platform/workloads/core-hub/forgejo-source-read:
PAT for core-hub-source, write it to OpenBao from stdin, let ESO refresh (5m), pass make verify-publisher,
then revoke the predecessor PAT and record evidence.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml#lifecycle.rotate
sources:
- CCR-2026-0031-core-hub-forgejo-source-read.yaml
@ -147,7 +147,7 @@ platform/workloads/core-hub/runtime:
the OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers, verify
protected calls, then invalidate the old token.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml#lifecycle.rotate
sources:
- CCR-2026-0013-core-hub-runtime-api-token.yaml
@ -162,7 +162,7 @@ platform/workloads/coulomb-social/backup-primary:
required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
acceptance, then revoke predecessor at provider.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml#lifecycle.rotate
sources:
- CCR-2026-0036-coulomb-social-backup-primary.yaml
@ -188,7 +188,7 @@ platform/workloads/email-connect/backup-primary:
required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
acceptance, then revoke predecessor at provider.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml#lifecycle.rotate
sources:
- CCR-2026-0037-email-connect-backup-primary.yaml
@ -202,7 +202,7 @@ platform/workloads/email-connect/transactional:
wait for ESO refresh (or force sync); roll email-connect and user-engine as needed; revoke old provider
password / retire old bearer.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml#lifecycle.rotate
sources:
- CCR-2026-0010-email-connect-transactional.yaml
@ -219,7 +219,7 @@ platform/workloads/forgejo/forgejo-admin:
on_loss: 'Re-issue per rotation: Mint a new PAT in Forgejo, update API_TOKEN in OpenBao, record non-secret
rotation evidence, and restart dependent automation after downstream consumers load from OpenBao.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml#lifecycle.rotate
sources:
- CCR-2026-0006-forgejo-admin-api-token-lane.yaml
@ -234,7 +234,7 @@ platform/workloads/glas-harness/claude-agent-dev:
stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove
its denial.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml#lifecycle.rotate
sources:
- CCR-2026-0016-glas-claude-anthropic.yaml
@ -246,7 +246,7 @@ platform/workloads/inbound-library/imap:
on_loss: 'rotate by ops-mason: bao write -f auth/approle/role/inbound-library/secret-id -> new secret_id;
deliver mode-0600 to ~/.local/inbound-library/approle; shred old secret_id file.'
owner: ops-mason
review: draft
review: accepted
rotation: ops-warden/wiki/playbooks/inbound-library-imap-approle.md#worker-checklist
sources:
- ops-warden catalog inbound-library-imap-approle
@ -261,7 +261,7 @@ platform/workloads/informed-decision/audit-sender:
only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
helper refuses rotation and unexpected existing values.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml#lifecycle.rotate
sources:
- CCR-2026-0022-informed-decision-audit.yaml
@ -275,7 +275,7 @@ platform/workloads/informed-decision/sitting-requester:
on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
refusal proof.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml#lifecycle.rotate;
railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml#lifecycle.rotate
sources:
@ -289,7 +289,7 @@ platform/workloads/issue-core/issue-core/issue-core-runtime:
on_loss: 'Re-issue per rotation: Replace issue-core runtime secret values directly in OpenBao and record
non-secret rotation evidence.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0002-issue-core-ingestion-api-key.yaml#lifecycle.rotate
sources:
- CCR-2026-0002-issue-core-ingestion-api-key.yaml
@ -304,7 +304,7 @@ platform/workloads/keycape/secrets-engine-openbao:
under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an
old version'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0033.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0034.yaml#lifecycle.rotate
sources:
- CCR-2026-0033.yaml
@ -330,7 +330,7 @@ platform/workloads/net-kingdom/keycape-factor-read:
on_loss: 'Re-issue per rotation: Issue replacement before expiry, CAS update exact KV, verify ESO projection
and consumer acceptance; retain no plaintext artifacts.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0023-keycape-factor-read.yaml#lifecycle.rotate
sources:
- CCR-2026-0023-keycape-factor-read.yaml
@ -343,7 +343,7 @@ platform/workloads/policy-nexus/forgejo-source-read:
on_loss: 'Re-issue per rotation: Mint a replacement read:repository-only PAT, update OpenBao and the
Actions secret through attended custody, pass one candidate build, then revoke the predecessor.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml#lifecycle.rotate
sources:
- CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
@ -357,7 +357,7 @@ platform/workloads/railiance-clock/authority-signing:
on_loss: 'Re-issue per rotation: Stop authority, perform separately versioned attended CAS rotation
and atomic host replacement, then admit new public key and epoch for consumers.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml#lifecycle.rotate
sources:
- CCR-2026-0028-railiance-clock-authority-signing.yaml
@ -380,7 +380,7 @@ platform/workloads/railiance/backup/object-storage:
on_loss: 'Re-issue per rotation: Overlap-first. Put a new key in OpenBao, wait for ESO refresh, revoke
the old Scaleway key.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0012-backup-object-storage.yaml#lifecycle.rotate
sources:
- CCR-2026-0012-backup-object-storage.yaml
@ -395,7 +395,7 @@ platform/workloads/railiance/backup/offsite-lane:
on_loss: 'Re-issue per rotation: Mint a new Nextcloud upload token, update NC_WEBDAV_TOKEN in OpenBao,
and record non-secret rotation evidence.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml#lifecycle.rotate
sources:
- CCR-2026-0004-railiance-backup-offsite-lane.yaml
@ -407,7 +407,7 @@ platform/workloads/railiance/scaleway/bootstrap:
missing: []
on_loss: 'Re-issue per rotation: Put a new bootstrap key; do not reuse the scoped backup key.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml#lifecycle.rotate
sources:
- CCR-2026-0011-scaleway-object-storage-bootstrap.yaml
@ -431,7 +431,7 @@ platform/workloads/reuse/reuse-surface/runtime-secrets:
on_loss: 'Re-issue per rotation: Replace field values directly in OpenBao, wait for ESO refresh, rollout
reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml#lifecycle.rotate
sources:
- CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml
@ -448,7 +448,7 @@ platform/workloads/secrets-engine/approval-client:
KV version under the same attended authority; ESO refresh delivers it and KeyCape restarts or re-reads.
Rotation is independent of the operator client.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml#lifecycle.rotate;
railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml#lifecycle.rotate
sources:
@ -466,7 +466,7 @@ platform/workloads/secrets-engine/approval-requester:
on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
refusal proof.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0024-t03-requester-verifier.yaml#lifecycle.rotate;
railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml#lifecycle.rotate
sources:
@ -480,7 +480,7 @@ platform/workloads/state-hub/repository-rename-preflight:
on_loss: 'Re-issue per rotation: Stop every API replica and verify no matching pods before CAS rotation;
wait ESO, recreate API replicas with one version, verify old token invalidation and health.'
owner: railiance-platform
review: draft
review: accepted
rotation: railiance-platform/credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml#lifecycle.rotate
sources:
- CCR-2026-0015-state-hub-preflight-signing.yaml
@ -507,7 +507,7 @@ platform/workloads/tenant-engine/audit-core-sender:
audit-core re-mints if the registry entry is also gone; emission waits in tenant-engine's local outbox
meanwhile.
owner: railiance-platform
review: draft
review: accepted
rotation: ops-mason/plans/tenant-engine-audit-core-sender-projection.md; reseed with railiance-platform/scripts/tenant_engine_audit_core_sender_seed.py
sources:
- ops-mason plan (hand-filled 2026-10-09)