MASON-WP-0015-T06: record the profile builder identity

Login shells export KUBECONFIG to the builder file. The 2026-10-22T07:11:18Z
login-shell capture is no for token mint, pod create, and impersonation.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a

INTENT.md

@@ -164,7 +164,7 @@ tooling_contacts:
         until: "2026-12-21"
         rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding."
       relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision."
-      identity_gap: "2026-10-22: founder choice (b) is installed, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Context default is user ops-mason-builder. Captured 2026-10-22T06:56:46Z: create serviceaccounts --subresource=token no, create pods no, impersonate serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a ServiceAccount named token, so that form stays yes; the token subresource is the mint check. The admin path is attended warden lane kubernetes-railiance01-admin, which was resolvable before the default path stopped being cluster-admin. The admin file /home/worsch/.kube/config-railiance01 still answers as system:admin. Refusing Pod and Secret kinds remains a code limit in kubernetes_plane as well as an RBAC limit. T06 is done."
+      identity_gap: "2026-10-22: founder choice (b) is installed, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Login shells export KUBECONFIG to ~/.kube/config-ops-mason-builder. Captured 2026-10-22T07:11:18Z from bash --login -i with that value left set: user ops-mason-builder, create serviceaccounts --subresource=token no, create pods no, impersonate serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a ServiceAccount named token, so that form stays yes; the token subresource is the mint check. The admin path is attended warden lane kubernetes-railiance01-admin. The admin file ~/.kube/config-railiance01 still answers as system:admin. Refusing Pod and Secret kinds remains a code limit in kubernetes_plane as well as an RBAC limit. T06 is done."
       enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS."
   - id: bao-session-grant
     shape: "5.2"

intakes/intakes.md

@@ -259,13 +259,15 @@ description: >-
   name-only, all namespaces: create serviceaccounts/token yes, create pods
   yes, impersonate serviceaccounts yes. Still cluster-admin.
   2026-10-22: founder Bernd Worsch chose (b), hub decision
-  30d29060-8d14-4a8e-9cde-34aa826eb8d1. Installed the same day. Context default
-  is user ops-mason-builder. Captured 2026-10-22T06:56:46Z: create
-  serviceaccounts --subresource=token no, create pods no, impersonate
-  serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a
-  ServiceAccount named token, so that form stays yes; the token subresource
-  is the mint check. The admin path is attended warden lane
-  kubernetes-railiance01-admin. This is not an open unimplemented
+  30d29060-8d14-4a8e-9cde-34aa826eb8d1. Installed the same day. Login shells
+  export KUBECONFIG to ~/.kube/config-ops-mason-builder. Captured
+  2026-10-22T07:11:18Z from bash --login -i with that value left set: user
+  ops-mason-builder, create serviceaccounts --subresource=token no, create
+  pods no, impersonate serviceaccounts no. The attended file
+  ~/.kube/config-railiance01 answers as system:admin. kubectl 1.35 parses
+  serviceaccounts/token as a ServiceAccount named token, so that form stays
+  yes; the token subresource is the mint check. The admin path is attended
+  warden lane kubernetes-railiance01-admin. This is not an open unimplemented
   cluster-admin gap. Certificate renewal is MASON-IN-0008.
   Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing
   is listening, but the railiance-platform runbooks still reference it.
@@ -282,7 +284,7 @@ options: >-
   date.
   Cluster RBAC and the kubeconfig distribution belong to railiance-platform
   (and railiance-infra for node credentials); this is a founder decision.
-updated: '2026-10-22T06:56:46Z'
+updated: '2026-10-22T07:11:18Z'
 state_hub_intake_id: "01a14ea8-3bd8-7da1-b51e-849067a39aff"
 ```
 

workplans/MASON-WP-0015-construct-grant.md

@@ -142,18 +142,18 @@ pattern as the OpenBao platform-admin login. Cluster RBAC is unchanged.
 railiance-platform installs that identity. Asked in message
 `c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`.
 
-2026-10-22: **done.** User `ops-mason-builder`, context `default`, captured
-2026-10-22T06:56:46Z. `create serviceaccounts --subresource=token` **no**,
-`create pods` **no**, `impersonate serviceaccounts` **no**. kubectl 1.35
+2026-10-22: **done.** Login shells export `KUBECONFIG` to
+`~/.kube/config-ops-mason-builder`. Captured 2026-10-22T07:11:18Z from
+`bash --login -i` with that value left set: user `ops-mason-builder`,
+`create serviceaccounts --subresource=token` **no**, `create pods` **no**,
+`impersonate serviceaccounts` **no**. The same shell's attended file
+`~/.kube/config-railiance01` answers as `system:admin`. kubectl 1.35
 parses `serviceaccounts/token` as a ServiceAccount named `token`, so that
 form stays yes; the token subresource is the mint check and is no. Choice
 (b) on decision `30d29060-8d14-4a8e-9cde-34aa826eb8d1`. railiance-platform
 commits `bd6660a` and `e594350` hold the ClusterRole. The attended lane is
 ops-warden `kubernetes-railiance01-admin` (`537d551`), resolvable before the
-default path changed. The admin file stays
-`/home/worsch/.kube/config-railiance01` and still answers as `system:admin`
-through that lane. The default path is the builder. Client certificate
-renewal is MASON-IN-0008.
+default path changed. Client certificate renewal is MASON-IN-0008.
 
 ## Submit CCRs from approved plans (RPF-WP-0061)