MASON-WP-0013: record the survey, CCR, and founder decision
The ops-mason-survey grant confirmed the existing private-reader lane and the MAS delivery metadata. CCR-2026-0046 and founder decision 9833715e are recorded apart from the disclosure consent. The plan stays reviewed, and the draft catalog route is not activated. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
parent
ca5e98d4e4
commit
dee677f226
7 changed files with 378 additions and 165 deletions
|
|
@ -5,11 +5,11 @@ proposal_id: MASON-CUST81-PRIVATE-READER-R1
|
|||
demand_source: the-custodian/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
|
||||
consumer_repo: reuse-surface
|
||||
credential_type: forgejo-restricted-source-read-with-existing-kubernetes-eso
|
||||
status: draft
|
||||
status: reviewed
|
||||
approved_by: null
|
||||
approved_at: null
|
||||
created: "2026-10-15"
|
||||
updated: "2026-10-21"
|
||||
updated: "2026-10-22"
|
||||
construction_inputs: builds/reuse-surface-private-source-reader/construction-inputs.json
|
||||
candidate_spec_sha256: 59a7334eb58135790547fab0a8c8e8debb94cc7acaae88d30654c9ae887d6732
|
||||
approved_spec_sha256: null
|
||||
|
|
@ -37,81 +37,171 @@ disclosure packet SHA256 is
|
|||
The bundled construction-inputs retain all seven consented commits, index hashes
|
||||
and native raw API URLs. These references contain no credential values.
|
||||
|
||||
The delegated ops-mason preparation worker has no own supervision record or
|
||||
survey token. It is supervised for preparation only and borrows no custodian
|
||||
agent authority. No live OpenBao, Forgejo, Kubernetes or credential read was
|
||||
performed. This plan is deliberately **draft**, not reviewed or executable.
|
||||
The 2026-10-15 preparation did not survey OpenBao. Section 2 now records the
|
||||
2026-10-21T22:15:21Z metadata survey under grant
|
||||
`token-claude-MASON-WP-0014-T04` (policies `default`, `ops-mason-survey`).
|
||||
This file is `reviewed`. It is not an ops-mason approval to mint or apply.
|
||||
|
||||
## 2. Existing-structure survey
|
||||
|
||||
### Local evidence; live survey incomplete
|
||||
Generated by `scripts/plan-survey.py` at 2026-10-21T22:15:21Z against `BAO_ADDR=http://127.0.0.1:18200`, token display_name `token-claude-MASON-WP-0014-T04` (policies: default, ops-mason-survey). Metadata only: no `kv get` and no `*/data/*` read was issued; policy bodies were read with `bao policy read` for name-matched candidates only.
|
||||
|
||||
A live `scripts/plan-survey.py` result does not exist: no scoped ops-mason-survey
|
||||
grant was supplied. Do not treat source files as installed state. Before review,
|
||||
obtain an owner-scoped metadata survey with exact path/policy and Kubernetes-role
|
||||
arguments, or a platform-owned sanitized equivalent. Refused queries stay
|
||||
incomplete rather than being described as absence. No operator/admin session may
|
||||
be substituted for the ops-mason survey grant.
|
||||
Demand: KV path `platform/workloads/reuse/reuse-surface/forgejo-source-read`, proposed policy `workload-kv-read-reuse-surface-runtime-eso`, AppRole `-`, Kubernetes role `reuse-surface-runtime-eso`, consumer `reuse-surface`. Match terms: `reuse-surface`, `reuse-surface-runtime-eso`, `forgejo`, `reuse-surface-source`, `reuse`, `forgejo-source-read`.
|
||||
|
||||
### 2026-10-21 survey attempt
|
||||
### `bao secrets list` (10 mounts, 1 relevant)
|
||||
|
||||
`./scripts/bao-session.sh status` at 2026-10-21T21:55:29Z: operator session
|
||||
none or expired; `~/.claude-bao-token` absent. `scripts/plan-survey.py`
|
||||
`--kv-path platform/workloads/reuse/reuse-surface/forgejo-source-read`
|
||||
`--policy workload-kv-read-reuse-surface-runtime-eso`
|
||||
`--k8s-role reuse-surface-runtime-eso` `--consumer reuse-surface` exited 2:
|
||||
```text
|
||||
platform/ kv version=2
|
||||
```
|
||||
|
||||
`no ops-mason-survey grant (~/.claude-bao-token absent and BAO_TOKEN unset)`
|
||||
### `bao auth list` (6 auth mounts, 2 relevant)
|
||||
|
||||
The command made no OpenBao call. There is no sanitized platform-owned
|
||||
metadata survey to paste. Installed path, policy text, Kubernetes role, and
|
||||
whether an existing identity already matches stay unconfirmed. This plan
|
||||
stays `draft`.
|
||||
```text
|
||||
approle/ approle
|
||||
kubernetes/ kubernetes
|
||||
```
|
||||
|
||||
### Forgejo-owner Q1–Q3 citation (does not close the survey)
|
||||
### `bao policy list` (95 policies, 9 relevant)
|
||||
|
||||
`the-custodian` `owner-assembly/forge-final-r2/review/forge-owner-review-r2.json`,
|
||||
reviewer `railiance-forge-owner (agent railiance-forge, codex)`,
|
||||
`reviewed_at` 2026-10-14T23:08:34Z, records `sec_dsm_order`:
|
||||
```text
|
||||
workload-kv-read-agent-harness-forgejo matches: forgejo
|
||||
workload-kv-read-core-hub-forgejo-source matches: forgejo
|
||||
workload-kv-read-forgejo-admin matches: forgejo
|
||||
workload-kv-read-forgejo-mailer matches: forgejo
|
||||
workload-kv-read-forgejo-mailer-eso matches: forgejo
|
||||
workload-kv-read-keycape-forgejo-eso matches: forgejo
|
||||
workload-kv-read-policy-nexus-forgejo-source matches: forgejo
|
||||
workload-kv-read-reuse-surface-runtime matches: reuse-surface, reuse
|
||||
workload-kv-read-reuse-surface-runtime-eso matches: reuse-surface, reuse-surface-runtime-eso, reuse, proposed name
|
||||
```
|
||||
|
||||
### `bao list auth/approle/role` (approle) (14 roles, 0 relevant)
|
||||
|
||||
```text
|
||||
(no relevant entries)
|
||||
```
|
||||
|
||||
### `bao list auth/kubernetes/role` (kubernetes) (36 roles, 5 relevant)
|
||||
|
||||
```text
|
||||
external-secrets-core-hub-forgejo-source matches: forgejo
|
||||
token_policies=['workload-kv-read-core-hub-forgejo-source']
|
||||
policies=['workload-kv-read-core-hub-forgejo-source']
|
||||
token_ttl=900
|
||||
token_max_ttl=0
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['external-secrets']
|
||||
bound_service_account_namespaces=['external-secrets']
|
||||
external-secrets-keycape-forgejo matches: forgejo
|
||||
token_policies=['workload-kv-read-keycape-forgejo-eso']
|
||||
policies=['workload-kv-read-keycape-forgejo-eso']
|
||||
token_ttl=900
|
||||
token_max_ttl=900
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['external-secrets']
|
||||
bound_service_account_namespaces=['external-secrets']
|
||||
audience=openbao
|
||||
external-secrets-reuse-surface matches: reuse-surface, reuse
|
||||
token_policies=['workload-kv-read-reuse-surface-runtime']
|
||||
policies=['workload-kv-read-reuse-surface-runtime']
|
||||
token_ttl=900
|
||||
token_max_ttl=0
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['external-secrets']
|
||||
bound_service_account_namespaces=['external-secrets']
|
||||
forgejo-mailer-eso matches: forgejo
|
||||
token_policies=['workload-kv-read-forgejo-mailer-eso']
|
||||
token_ttl=900
|
||||
token_max_ttl=900
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['forgejo-mailer-eso']
|
||||
bound_service_account_namespaces=['forgejo']
|
||||
audience=openbao
|
||||
reuse-surface-runtime-eso matches: reuse-surface, reuse-surface-runtime-eso, reuse, proposed name
|
||||
token_policies=['workload-kv-read-reuse-surface-runtime-eso']
|
||||
token_ttl=900
|
||||
token_max_ttl=900
|
||||
token_num_uses=0
|
||||
bound_service_account_names=['reuse-surface-eso']
|
||||
bound_service_account_namespaces=['reuse']
|
||||
audience=openbao
|
||||
```
|
||||
|
||||
### `bao policy read` of name-matched candidates (target `platform/data/workloads/reuse/reuse-surface/forgejo-source-read`)
|
||||
|
||||
```text
|
||||
workload-kv-read-agent-harness-forgejo: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-core-hub-forgejo-source: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-forgejo-admin: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-forgejo-mailer: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-forgejo-mailer-eso: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-keycape-forgejo-eso: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-policy-nexus-forgejo-source: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-reuse-surface-runtime: no stanza covers platform/data/workloads/reuse/reuse-surface/forgejo-source-read
|
||||
workload-kv-read-reuse-surface-runtime-eso: path "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" capabilities=['read']
|
||||
```
|
||||
|
||||
### `bao kv metadata get` / `bao kv list` (metadata only)
|
||||
|
||||
```text
|
||||
platform/workloads/reuse/reuse-surface/forgejo-source-read: exists, current_version=1, created=2026-10-15, updated=2026-10-15
|
||||
platform/workloads/reuse/reuse-surface/: forgejo-source-read, runtime-secrets
|
||||
```
|
||||
|
||||
### ops-warden routing catalog `/home/worsch/ops-warden/registry/routing/catalog.yaml` (49 entries, 8 relevant)
|
||||
|
||||
```text
|
||||
whynot-design-npm-publish owner=railiance-platform status=active matches: forgejo
|
||||
path_template: platform/workloads/coulomb/whynot-design/npm-publish
|
||||
policy_ref: flex-auth check secret.read:whynot-design
|
||||
auth_method: bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read
|
||||
policy-nexus-forgejo-source-read owner=railiance-platform status=active matches: forgejo, forgejo-source-read
|
||||
path_template: platform/workloads/policy-nexus/forgejo-source-read
|
||||
policy_ref: flex-auth check secret.read:policy-nexus
|
||||
auth_method: bao login -method=oidc -path=netkingdom role=policy-nexus-forgejo-source-workload-kv-read
|
||||
core-hub-forgejo-source-read owner=railiance-platform status=active matches: forgejo, forgejo-source-read
|
||||
path_template: platform/workloads/core-hub/forgejo-source-read
|
||||
policy_ref: workload-kv-read-core-hub-forgejo-source
|
||||
auth_method: Kubernetes auth (mount kubernetes) role=external-secrets-core-hub-forgejo-source, bound to external-secrets/external-secrets; ESO delivery only (ClusterSecretStore openbao-core-hub-forgejo-source → ExternalSecret core-hub/repo-manager-forgejo-source)
|
||||
reuse-surface-hub-write-token owner=railiance-platform status=active matches: reuse-surface, forgejo, reuse
|
||||
path_template: platform/workloads/reuse/reuse-surface/runtime-secrets
|
||||
policy_ref: flex-auth check secret.read:reuse
|
||||
auth_method: bao login -method=oidc -path=netkingdom role=reuse-surface-hub-writer-workload-kv-read
|
||||
railiance-backup-offsite-lane owner=railiance-platform status=active matches: forgejo
|
||||
path_template: platform/workloads/railiance/backup/offsite-lane
|
||||
auth_method: caller's own OpenBao token (OIDC netkingdom role railiance-backup-workload-kv-read)
|
||||
state-hub-forge-derivation-read owner=ops-mason status=active matches: forgejo
|
||||
path_template: platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN)
|
||||
auth_method: Kubernetes auth (role state-hub-forge-derivation, ServiceAccount state-hub/state-hub) from the in-cluster state-hub workload
|
||||
forgejo-admin-api-token owner=railiance-platform status=active matches: forgejo
|
||||
path_template: platform/workloads/forgejo/forgejo-admin
|
||||
auth_method: caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)
|
||||
agent-harness-forgejo-deploy owner=railiance-platform status=active matches: forgejo
|
||||
path_template: platform/workloads/agent-harness/forgejo-deploy-key
|
||||
policy_ref: flex-auth check secret.read:agent-harness-forgejo
|
||||
auth_method: caller's own OpenBao token (policy workload-kv-read-agent-harness-forgejo) or host-local key at ~/.local/agent-harness/ssh/forgejo-deploy
|
||||
```
|
||||
|
||||
### Does an existing lane already satisfy this demand?
|
||||
|
||||
**Decision (survey 2026-10-21T22:15:21Z): the OpenBao delivery lane already matches.** Edited from the generated "yes".
|
||||
|
||||
- KV `platform/workloads/reuse/reuse-surface/forgejo-source-read` exists, `current_version=1`, created and updated 2026-10-15. No data body was read.
|
||||
- Policy `workload-kv-read-reuse-surface-runtime-eso` is the only name-matched policy that grants `read` on `platform/data/workloads/reuse/reuse-surface/forgejo-source-read`.
|
||||
- Kubernetes role `reuse-surface-runtime-eso` exists: `token_policies=['workload-kv-read-reuse-surface-runtime-eso']`, SA `reuse-surface-eso`, namespace `reuse`, audience `openbao`, ttl and max ttl 900.
|
||||
- The caller writer policy `workload-kv-read-reuse-surface-runtime` has no stanza for that path. The other name-matched Forgejo policies do not either. Catalog entries `core-hub-forgejo-source-read`, `policy-nexus-forgejo-source-read`, `reuse-surface-hub-write-token`, and `forgejo-admin-api-token` are different paths.
|
||||
- The survey grant's own capabilities on that data path and on `platform/data/workloads/reuse/reuse-surface/runtime-secrets` are `deny`. Metadata read on the reader path is `list, read`.
|
||||
- One grant file was present, display name `token-claude-MASON-WP-0014-T04`. It is an `ops-mason-survey` grant. It is not an operator or admin token. A second file named for MASON-WP-0013-T02 was not minted.
|
||||
|
||||
### Forgejo-owner Q1–Q3
|
||||
|
||||
`the-custodian` `owner-assembly/forge-final-r2/review/forge-owner-review-r2.json`, reviewer `railiance-forge-owner (agent railiance-forge, codex)`, `reviewed_at` 2026-10-14T23:08:34Z, `sec_dsm_order`:
|
||||
|
||||
- Q1: no direct Kubernetes identity accepted by the current raw HTTP route is demonstrated.
|
||||
- Q2: KeyCape human login does not establish machine API federation; no installed workload JWT trust is demonstrated.
|
||||
- Q3: upstream Forgejo OAuth can issue expiring access tokens, but only `authorization_code` and `refresh_token`; no viable workload `client_credentials` or token exchange is demonstrated. A static fallback is conditional.
|
||||
|
||||
That review says it is not founder authorization or authenticated live proof,
|
||||
and `live_effective_grants_verified` is false. It is owner-authored hierarchy
|
||||
text. It is not an ops-mason survey and it does not move this plan to `reviewed`.
|
||||
|
||||
Local source observations from the pinned preparation and checked files:
|
||||
|
||||
- `railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl`
|
||||
SHA256 `fab29572fe82fc6674837e430f616409070f97a3867a411b7e21b5141dfaba20`
|
||||
grants the existing runtime-secrets data path and lookup/revoke-self endpoints.
|
||||
- The caller policy `workload-kv-read-reuse-surface-runtime`, SHA256
|
||||
`53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257`,
|
||||
grants the existing runtime-secrets entry plus self-lifecycle/capability checks;
|
||||
it does not grant the proposed new source-reader path.
|
||||
- ClusterSecretStore `openbao-reuse` uses Kubernetes role
|
||||
`reuse-surface-runtime-eso`, SA `reuse/reuse-surface-eso`, audience `openbao`,
|
||||
conditions limited to namespace `reuse`. No new static ESO token is proposed.
|
||||
- `railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml` already maps
|
||||
writer/webhook fields to `reuse/reuse-surface-env`; Deployment uses envFrom.
|
||||
Its comments still describe a retired static ESO token; those comments must not
|
||||
be taken as a procedure or used to mint one. Apps owns correction on integration.
|
||||
- CCR-2026-0031 and `provision-core-hub-forgejo-source.py` demonstrate dedicated
|
||||
`read:repository` PAT custody. That script explicitly sets all-repository team
|
||||
membership and must **not** be executed unchanged for this demand.
|
||||
- Catalog `reuse-surface-hub-write-token` describes the caller writer lane;
|
||||
`forgejo-admin-api-token` is privileged bootstrap authority. Neither is the
|
||||
private-index consumer credential. The preparation found no dedicated private
|
||||
reader lane; installed absence has not been surveyed.
|
||||
|
||||
**Does an existing lane satisfy this demand?** Existing workload identity and
|
||||
ESO delivery can be reused. Existing writer credentials and all-repository
|
||||
source readers cannot satisfy the exact-seven grant. Propose a dedicated target
|
||||
identity and new exact KV entry, with one stanza added to the existing ESO policy.
|
||||
A differing existing user/team/path/policy must halt for reconciliation before
|
||||
any mutation. Matching names alone do not establish matching effective scope.
|
||||
That review is the Forgejo owner's hierarchy text. It is not founder authorization. Disclosure consent is a different record.
|
||||
|
||||
## 3. Proposed changes
|
||||
|
||||
|
|
@ -292,12 +382,10 @@ binds scope; it is neither approval nor an executable adapter. Platform must
|
|||
allocate CCR, own a silent idempotent provisioner and pin all execution/artifact
|
||||
inputs before phase 3. Approval of a construction plan does not supply a token.
|
||||
|
||||
This draft is not yet phase-3 ready. Gaps: scoped live structure survey, target
|
||||
Q1–Q3 confirmation, effective-access enumeration design, reviewed platform CCR
|
||||
and script, consumer raw-route/Bearer behavior, full authorization/redirect-fixed image and runtime allowlist proof plan, apps exact deployment
|
||||
and headroom/PVC rollback plan, independent owner reviews. No owner review is
|
||||
written on another repo's behalf. Only ops-mason's own preparation findings are
|
||||
recorded here. No own autopilot grant or monetary risk limit is claimed.
|
||||
The OpenBao structure survey and the Forgejo-owner Q1–Q3 citation are in §2.
|
||||
Platform CCR-2026-0046 and founder decision
|
||||
`9833715e-a22a-45c0-ab6c-881f0f4f1a0e` are recorded on MASON-WP-0013-T03.
|
||||
ops-mason does not mint, approve, or apply from this file.
|
||||
|
||||
## 5. Executive summary (candidate; not yet ready for approval)
|
||||
|
||||
|
|
@ -325,15 +413,20 @@ recorded here. No own autopilot grant or monetary risk limit is claimed.
|
|||
is proposed (incremental estimate EUR 0); labor and credible loss remain unpriced,
|
||||
so this stays supervised.
|
||||
|
||||
After the missing reviews and executable inputs are attached, the founder can
|
||||
**approve**, **reject**, or **send back to phase 1**. No founder disposition is
|
||||
recorded for this credential proposal. Existing metadata consent is retained as
|
||||
separate evidence and does not set status approved.
|
||||
Founder decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` (resolved 2026-10-15,
|
||||
Bernd Worsch) binds execution revision SHA256
|
||||
`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`.
|
||||
Disclosure-consent digest
|
||||
`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
|
||||
different record. This file stays `reviewed`. ops-mason does not set it
|
||||
`approved` and does not apply it.
|
||||
|
||||
## 6. Proposed verification and rollback contract
|
||||
|
||||
This section describes future acceptance, **not a build result**. Phase 4 has not
|
||||
run and no success evidence or active catalog entry exists.
|
||||
The contract below is the acceptance rule. The platform path already ran.
|
||||
ops-mason's 2026-10-21 metadata receipt and the cited platform and custodian
|
||||
receipts are recorded on MASON-WP-0013-T04. The draft catalog proposal is not
|
||||
activated. No secret value is in those records.
|
||||
|
||||
Before changes: exact CCR/plan/script/manifest digests, owner reviews and founder
|
||||
approved revision must match; metadata survey proves current path/policy/role;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue