coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-IN-0005: restore ops-mason as the OpenBao builder (ops-mason-construct)

Browse source 
Founder decision 2026-10-18, "build, but never log in": a plan-scoped grant
that writes workload-kv-read-* policies, external-secrets-* and AppRole role
definitions, and create-only placeholder KV under platform/{workloads,suppliers},
and denies role-id, secret-id, token creation and all value reads, so the
MASON-IN-0004 chain stays broken. Adds bao-session.sh build, policy tests,
INTENT/AGENTS alignment and MASON-WP-0015. Not installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 11:48:27 +02:00
parent e2ac6448c2
commit e7a368af0f
7 changed files with 406 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/bao-session.sh
View file

@ -4,6 +4,7 @@
# ./scripts/bao-session.sh status what session exists, if any
# ./scripts/bao-session.sh login refresh YOUR operator session (OIDC)
# ./scripts/bao-session.sh grant <task> mint a scoped, time-boxed token for Claude
# ./scripts/bao-session.sh build <task> same, with ops-mason-construct (approved plan only)
# ./scripts/bao-session.sh revoke end the granted token immediately
#
# Why `grant` exists
@ -16,8 +17,12 @@
# and read mounts, auth methods, policies, auth role definitions
# and KV *metadata*, and query capabilities. It cannot write a
# policy or role, mint a secret-id or a token, or read a secret
# value (MASON-IN-0004, founder decision 2026-10-07). Builds go
# through the founder-attended railiance-platform applier.
# value (MASON-IN-0004, founder decision 2026-10-07).
# `build` carries ops-mason-construct instead (MASON-IN-0005,
# 2026-10-18): it writes workload-kv-read-* policies, ESO/AppRole
# role definitions and placeholder KV structure, and still cannot
# read a role-id, mint a secret-id or token, or read a value.
# Mint it only after the plan is approved.
# * bounded — 45 minutes, no renewal past one hour.
# * named — display_name claude-<task>, so the audit log says which task an
# action belonged to, not just that platform-root did it.
@ -130,6 +135,7 @@ case "${1:-status}" in
status) cmd_status ;;
login) cmd_login ;;
grant) shift; cmd_grant "${1:-}" ;;
build) shift; GRANT_POLICY=ops-mason-construct; cmd_grant "${1:-}" ;;
revoke) cmd_revoke ;;
*) echo "usage: $0 status|login|grant <task>|revoke" >&2; exit 2 ;;
*) echo "usage: $0 status|login|grant <task>|build <task>|revoke" >&2; exit 2 ;;
esac