coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(mason): describe stored credentials, and stop the grant rewriting itself

Browse source 
custody-inventory.py walks operators/ and platform/workloads/, prints
each path's description, owner, consumers and recovery path, and marks
any missing them. Metadata only, never a value, so it runs under
ops-mason-build and can be handed to anyone orienting themselves. First
run: 21 paths, 17 undescribed.

Described the four this session touched, including on_loss — the field
whose absence meant the LLDAP predecessor's recovery path had to be
worked out from first principles while locked out.

ops-mason-build gains create/update on */metadata/*, since a description
is documentation rather than a value. delete stays absent: deleting a
metadata entry destroys every version of the secret beneath it.

It also now denies itself sys/policies/acl/ops-mason-build. Without that
the policy was advisory — a token that can write policies can delete its
own denials, so the claim that OpenBao enforces "never read a value" was
not true as written. An exact path outranks the glob, so changing what
ops-mason may do is now an operator act, visible as one in the audit log.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
This commit is contained in:
tegwick 2026-08-28 11:43:08 +02:00
parent 7bd230c06a
commit d020413d7a
2 changed files with 110 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

19
policies/ops-mason-build.hcl
View file

@ -43,12 +43,15 @@ path "auth/approle/role/*" {
# Metadata carries versions, timestamps and custom_metadata — enough to confirm
# a path exists and that a paste-once delivery landed. It does not carry the
# value.
# create/update so a path can be *described* — custom_metadata is documentation,
# not a value. delete is absent: deleting a metadata entry destroys every
# version of the secret under it, which is a destructive act, not a build one.
path "platform/metadata/*" {
capabilities = ["read", "list"]
capabilities = ["create", "read", "update", "list"]
}
path "operators/metadata/*" {
capabilities = ["read", "list"]
capabilities = ["create", "read", "update", "list"]
}
# --- verification ----------------------------------------------------------
@ -74,6 +77,18 @@ path "sys/capabilities-self" {
capabilities = ["create", "update"]
}
# --- the grant cannot rewrite its own scope --------------------------------
# Without this, everything below is advisory: a token that can write policies
# can delete its own denials and then read anything. An exact path outranks the
# sys/policies/acl/* glob above, so this stanza wins.
#
# The consequence is deliberate — changing what ops-mason may do is an operator
# act, performed with an operator session, and visible as such in the audit log.
# It cannot be done quietly from inside a build.
path "sys/policies/acl/ops-mason-build" {
capabilities = ["read", "deny"]
}
# --- the line, stated as a denial ------------------------------------------
# Explicit deny outranks any grant, including one added here later by mistake.
# If ops-mason needs to prove a credential works, the consumer proves it, or a