coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0005-T05: lane verified from policy and role; owner-run check script; Forgejo case plan rendered

Browse source 
Live policy and role equal the approved spec, 8 agent denies present, custody
at coulomb v1. verify-fluid-telegram-lane.sh lets the founder prove member
capabilities and non-member refusal without printing a token. T06 entry
proposed to ops-warden. plans/case-forgejo-netkingdom-oidc.md: reviewed,
no collisions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 19:47:45 +02:00
parent e10bc2b82b
commit cd251f7c2e
4 changed files with 214 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
View file

@ -215,10 +215,10 @@ metadata deleted. fluid-telegram must set
```task
id: MASON-WP-0005-T05
status: wait
status: progress
depends_on: [MASON-WP-0005-T04]
blocked_on: human
blocking_reason: "Lane built 2026-10-09; verification needs a survey grant (positive matrix, sibling/parent/agent denial via policy text and capabilities). Non-member refusal and the salt CAS probe are owner-run (FT-WP-0002)."
blocking_reason: "ops-mason checks pass (2026-10-09). Founder runs scripts/verify-fluid-telegram-lane.sh member, then non-member, and shares the two receipts; fluid-telegram runs the salt create-once probe (FT-WP-0002)."
priority: high
state_hub_task_id: "4c205be7-4f1f-5dd1-aafa-fc112fdd640e"
```
@ -239,6 +239,17 @@ capabilities, audit request ids/timestamps, versions/timestamps, and pass/fail.
Any value-side create/update test must be performed by the sanctioned
operator/platform flow and return metadata-only evidence to ops-mason.
2026-10-09 (grant `claude-MASON-WP-0005-T05`, revoked after): live policy
`workload-kv-fluid-telegram-hall-of-helix-operator` equals the approved matrix
exactly (so parent, sibling campaign and sibling workload are not granted);
the OIDC role equals the approved role document (groups + aal2, 15m/30m, no
default policy, three callbacks); `agent-high-risk-boundary` holds the 8
`deny` stanzas (data + metadata for the four entries); all four entries at the
`coulomb` path v1, the `infotech` ones gone. Owner-run remainder: a member
login and a non-member login with `scripts/verify-fluid-telegram-lane.sh`
(capabilities only, receipt under `~/.local/state/railiance/receipts/`), and
the salt create-once probe by fluid-telegram (message `f966db1c`).
## Hand off routing and keep the adapter lane separate
```task
@ -262,6 +273,10 @@ The adapter lane is tracked separately as `MASON-IN-0003`, tied to
must use the adapter's own runtime identity rather than this attended OIDC
role.
2026-10-09: entry proposed to ops-warden as pointer-only, `resolvable: false`,
`applied-pending-verify` (message `856bd6ba`); activation stays with
ops-warden after T05.
## Loose-end review — 2026-09-28
T01–T06 remain wait: accepted tenant/matrix, confirmed identity/MFA/callbacks, approved matching writer contracts, live survey, explicit construction approval and verification are outstanding. The platform design remains proposed. No lane was built or activated.

8
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -131,6 +131,14 @@ clean, 1 collisions, 2 refused. `tests/test_case_plan.py` (8, on a copy of the
type marked `implemented`); suite 167 passed. The live Forgejo case is refused
today, correctly: the type is `acknowledged`, not yet `implemented`.
2026-10-09: net-kingdom accepted the Forgejo case
(`net-kingdom/security-cases/forgejo-netkingdom-oidc.yaml`, message `d1bbcb44`).
As the reference case it renders with `--allow-unimplemented`, mirroring the
validator's flag: allowed only for an `acknowledged` type, marked
`reference_case: true`; and `reviewed` now requires a live survey. Rendered
live into `plans/case-forgejo-netkingdom-oidc.md`: status `reviewed`, no
collision, digest `sha256:fb8b114d…`.
```task
id: MASON-WP-0010-T03
status: wait