coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0014-T03: MAS TEM lane built under ops-mason-construct

Browse source 
Policy and kubernetes role built per CCR-2026-0051, verified against it.
Applied before confirm-binding (SA not yet created); recorded as a deviation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 12:44:51 +02:00
parent c4b887940a
commit d19e6b1633
2 changed files with 35 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
plans/mas-tem-relay-smtp.md
View file

@ -3,7 +3,7 @@ id: mas-tem-relay-smtp
demand_source: mail-address-semantics/workplans/MAS-WP-0003-T03
consumer_repo: mail-address-semantics
credential_type: openbao-kv-founder-provision
status: approved
status: built
approved_by: "Bernd Worsch"
approved_at: "2026-10-18"
created: "2026-10-18"
@ -255,3 +255,32 @@ revoke the key. Nothing else depends on it.
**Decision:** approved in chat on 2026-10-18 ("approved"), covering this plan and
CCR-2026-0051. The founder records the CCR approval with railiance-platform's
`credential-change.py approve`.
## 6. Build result
Built 2026-10-18 by ops-mason under `ops-mason-construct`
(`claude-MASON-WP-0014-T03`, revoked afterwards):
- policy `workload-kv-read-mas-tem-relay`, written from CCR-2026-0051's policy
file and read back byte-equal (read on
`platform/data/suppliers/scaleway/mas-tem-relay`, plus lookup-self and
revoke-self)
- Kubernetes role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`,
ns `mas`, audience `openbao`, `token_policies`
`[workload-kv-read-mas-tem-relay]`, ttl/max/explicit-max 15m,
`token_no_default_policy`; read back matches the CCR
- KV `platform/suppliers/scaleway/mas-tem-relay`: placeholder v1 by
ops-mason, value v2 by the founder; never read
- evidence on CCR-2026-0051 (`railiance-platform@102668f`), status left
`approved`
**Deviation:** platform's condition was apply after `confirm-binding`. The
role was applied before it, while SA `mas-tem-relay-eso` does not exist yet,
so no login is possible until the MAS side creates it. `confirm-binding`
(and `bound_claims_confirmed: true`) follows once the SA exists. This was
reported to railiance-platform.
**Remaining:** the MAS side applies SA, SecretStore and ExternalSecret;
confirm-binding; check that Secret `mas/mas-relay` syncs (names only);
teardown at MAS-WP-0003 close (rows 6–7). No catalog entry (temporary).

6
workplans/MASON-WP-0014-mas-tem-relay-smtp.md
View file

@ -49,7 +49,7 @@ was written by the founder as v2.
```task
id: MASON-WP-0014-T03
status: wait
status: done
priority: high
state_hub_task_id: "f9c89f3b-6c07-560b-abd0-7c9c83940e83"
```
@ -58,6 +58,10 @@ railiance-platform allocates the CCR for plan rows 1–3. The founder approves
the plan and the CCR, applies them through the delegated applier, and fills
`password` in the OpenBao UI.
Done 2026-10-18: the founder wrote the value (v2) and approved the plan and
CCR-2026-0051. ops-mason built the policy and role under `ops-mason-construct`
(plan §6). The build happened before `confirm-binding`; see the deviation note.
## Verify delivery and record teardown
```task