coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0005-T02: close the OIDC KV matrix source contract

Browse source 
Lock exact data-path capabilities and the absence of parent and sibling
paths in the unit test, and mark T02 done after those tests passed.

Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6c2d3e14d0b
This commit is contained in:
tegwick 2026-10-05 01:41:25 +02:00
parent 2549d8636a
commit d5ae2d4924
2 changed files with 32 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tests/test_oidc_matrix.py
View file

@ -17,13 +17,18 @@ def spec(tmp_path):
def test_matrix_has_exact_data_scope_and_write_once_salt(tmp_path):
s=spec(tmp_path);h=oidc_policy_hcl(s)
assert h.count('platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/')==4
prefix='platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/'
paths=[line.split('"')[1] for line in h.splitlines() if line.startswith('path ')]
assert paths==[prefix+'operator-app',prefix+'operator-session',prefix+'bot-token',prefix+'redaction-salt','auth/token/revoke-self']
assert 'metadata/' not in h and '*' not in h and '/destroy/' not in h
salt=h.split('/redaction-salt"')[1].split('}')[0]
assert '"create", "read"' in salt and '"update"' not in salt
app=h.split('/operator-app"')[1].split('}')[0]
assert '"read"' in app and '"create"' not in app
assert 'auth/token/revoke-self' in h
assert 'platform/data/workloads/coulomb/fluid-telegram"' not in h
assert 'platform/data/workloads/coulomb/another-workload' not in h
def caps(entry):
return h.split(prefix+entry+'"')[1].split('}')[0]
assert caps('operator-app').strip()=='{\n capabilities = ["read"]'
assert caps('operator-session').strip()==caps('bot-token').strip()=='{\n capabilities = ["create", "read", "update"]'
salt=caps('redaction-salt')
assert '"create", "read"' in salt and all(x not in salt for x in ('"update"','"patch"','"delete"','"list"'))
@pytest.mark.parametrize('field,value',[

23
workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: codex
topic_slug: helix-forge
created: "2026-09-04"
updated: "2026-10-04"
updated: "2026-10-05"
state_hub_workstream_id: "483e56d6-6601-5377-9066-66225214c046"
---
@ -76,7 +76,7 @@ side. Re-qualified from `message-from:railiance-platform` to
```task
id: MASON-WP-0005-T02
status: progress
status: done
priority: high
state_hub_task_id: "69c558d9-664f-5ce0-80b2-d2e7544353a3"
```
@ -103,6 +103,20 @@ has one. The platform-side wait is gone, so the task moves from `wait` to
then send the matrix to railiance-platform for review. Binding the confirmed
claim still needs T01. Not built in this sweep.
2026-10-05 done: source contract checked against this task, not against the
prior progress note. `python3 -m pytest tests/test_oidc_matrix.py` — 20 passed.
Named tests: `test_draft_and_changed_approval_never_execute` (approval
refusal, no bao call); `test_matrix_has_exact_data_scope_and_write_once_salt`
(four exact KV-v2 data-path capabilities, no sibling or parent path,
create-only salt); `test_refuses_unsafe_matrix_before_bao` (wildcard and
parent scopes refused); `test_exact_role_binding_and_value_free_build` (one
`groups` claim parameter, policy/auth writes only, metadata-only audit);
`test_failure_suppresses_output_and_never_claims_success` (no value in the
failure). No OpenBao run and no plan approval. The confirmed claim value
remains T01. Matrix paths sent to railiance-platform for RPF-WP-0035-T03
review (message `79570eb8-2107-4f75-b463-a45c2a70b7bf`):
`src/ops_mason/executor.py` and `tests/test_oidc_matrix.py`.
## Review the plan and obtain the decision
```task
@ -230,3 +244,8 @@ in the closed MASON-0001 bootstrap source. Removed only the repeated identical
fence, preserving the single logical task, label, existing UUID, title, status
and every prose section; no record migration or task deletion. Retry normal
Forge receiving after this source-level duplicate repair.
2026-10-05: T02 is done on the source contract and the unit tests named in
that task. Platform review of the matrix is the RPF-WP-0035-T03 handoff, not
an open ops-mason code gap. T01 and T03–T06 stay wait. This workplan stays
blocked. The construction plan stays draft.