From d5ae2d492401ae778f15c1d65e10dc19b3947029 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 5 Oct 2026 01:41:25 +0200
Subject: [PATCH] MASON-WP-0005-T02: close the OIDC KV matrix source contract

Lock exact data-path capabilities and the absence of parent and sibling
paths in the unit test, and mark T02 done after those tests passed.

Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6c2d3e14d0b
---
 tests/test_oidc_matrix.py                     | 17 +++++++++-----
 ...fluid-telegram-operator-credential-lane.md | 23 +++++++++++++++++--
 2 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/tests/test_oidc_matrix.py b/tests/test_oidc_matrix.py
index 7c2a4a0..af2f0bd 100644
--- a/tests/test_oidc_matrix.py
+++ b/tests/test_oidc_matrix.py
@@ -17,13 +17,18 @@ def spec(tmp_path):
 
 def test_matrix_has_exact_data_scope_and_write_once_salt(tmp_path):
     s=spec(tmp_path);h=oidc_policy_hcl(s)
-    assert h.count('platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/')==4
+    prefix='platform/data/workloads/coulomb/fluid-telegram/hall-of-helix/'
+    paths=[line.split('"')[1] for line in h.splitlines() if line.startswith('path ')]
+    assert paths==[prefix+'operator-app',prefix+'operator-session',prefix+'bot-token',prefix+'redaction-salt','auth/token/revoke-self']
     assert 'metadata/' not in h and '*' not in h and '/destroy/' not in h
-    salt=h.split('/redaction-salt"')[1].split('}')[0]
-    assert '"create", "read"' in salt and '"update"' not in salt
-    app=h.split('/operator-app"')[1].split('}')[0]
-    assert '"read"' in app and '"create"' not in app
-    assert 'auth/token/revoke-self' in h
+    assert 'platform/data/workloads/coulomb/fluid-telegram"' not in h
+    assert 'platform/data/workloads/coulomb/another-workload' not in h
+    def caps(entry):
+        return h.split(prefix+entry+'"')[1].split('}')[0]
+    assert caps('operator-app').strip()=='{\n  capabilities = ["read"]'
+    assert caps('operator-session').strip()==caps('bot-token').strip()=='{\n  capabilities = ["create", "read", "update"]'
+    salt=caps('redaction-salt')
+    assert '"create", "read"' in salt and all(x not in salt for x in ('"update"','"patch"','"delete"','"list"'))
 
 
 @pytest.mark.parametrize('field,value',[
diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
index b222fc3..e8a6851 100644
--- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
+++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
@@ -9,7 +9,7 @@ flavor: planning
 owner: codex
 topic_slug: helix-forge
 created: "2026-09-04"
-updated: "2026-10-04"
+updated: "2026-10-05"
 state_hub_workstream_id: "483e56d6-6601-5377-9066-66225214c046"
 ---
 
@@ -76,7 +76,7 @@ side. Re-qualified from `message-from:railiance-platform` to
 
 ```task
 id: MASON-WP-0005-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "69c558d9-664f-5ce0-80b2-d2e7544353a3"
 ```
@@ -103,6 +103,20 @@ has one. The platform-side wait is gone, so the task moves from `wait` to
 then send the matrix to railiance-platform for review. Binding the confirmed
 claim still needs T01. Not built in this sweep.
 
+2026-10-05 done: source contract checked against this task, not against the
+prior progress note. `python3 -m pytest tests/test_oidc_matrix.py` — 20 passed.
+Named tests: `test_draft_and_changed_approval_never_execute` (approval
+refusal, no bao call); `test_matrix_has_exact_data_scope_and_write_once_salt`
+(four exact KV-v2 data-path capabilities, no sibling or parent path,
+create-only salt); `test_refuses_unsafe_matrix_before_bao` (wildcard and
+parent scopes refused); `test_exact_role_binding_and_value_free_build` (one
+`groups` claim parameter, policy/auth writes only, metadata-only audit);
+`test_failure_suppresses_output_and_never_claims_success` (no value in the
+failure). No OpenBao run and no plan approval. The confirmed claim value
+remains T01. Matrix paths sent to railiance-platform for RPF-WP-0035-T03
+review (message `79570eb8-2107-4f75-b463-a45c2a70b7bf`):
+`src/ops_mason/executor.py` and `tests/test_oidc_matrix.py`.
+
 ## Review the plan and obtain the decision
 
 ```task
@@ -230,3 +244,8 @@ in the closed MASON-0001 bootstrap source. Removed only the repeated identical
 fence, preserving the single logical task, label, existing UUID, title, status
 and every prose section; no record migration or task deletion. Retry normal
 Forge receiving after this source-level duplicate repair.
+
+2026-10-05: T02 is done on the source contract and the unit tests named in
+that task. Platform review of the matrix is the RPF-WP-0035-T03 handoff, not
+an open ops-mason code gap. T01 and T03–T06 stay wait. This workplan stays
+blocked. The construction plan stays draft.