coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T05: CCR-2026-0038 already applied (2026-10-08); waits on login proof

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 14:41:48 +02:00
parent da222857da
commit dc5a71bf07
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -127,8 +127,8 @@ exist yet" whenever `bao policy read` failed, including when the founder's
```task
id: MASON-WP-0009-T05
status: wait
blocked_on: human
blocking_reason: "Founder applies CCR-2026-0038 (railiance-platform 0b2e7dd: mount auth/keycape-services, role secrets-engine-openbao, policy secrets-engine-login-self); then SECRETS-WP-0012-T03 login proof; then checks 1-3 and 6, invariant (ii) (expect deny on both guarded paths), pointer-only route."
blocked_on: message-from:secrets-engine
blocking_reason: "CCR-2026-0038 applied by the founder 2026-10-08T22:42Z (readback matched). Waits on the login proof with a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao); then ops-mason checks 1-3 and 6 and invariant (ii) (deny on both guarded paths) and proposes the pointer-only route."
priority: medium
state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
```
@ -147,3 +147,8 @@ explicit deny on `platform/data/` and `platform/metadata/` for
`workloads/keycape/secrets-engine-openbao`, so invariant (ii) holds by
construction). New `service-jwt-login` applier with read-back; 8 tests. Waits
on the founder's approve, confirm-binding and delegated apply.
2026-10-09: already applied. railiance-platform `1b36e14` records the founder's
approval, binding confirmation and delegated apply at 2026-10-08T22:42Z, with a
matching value-free readback (evidence in the CCR). RPF-WP-0035-T02 now waits
only on the login proof (SECRETS-WP-0012-T03).