coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0014: executive summary for founder decision

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 12:15:56 +02:00
parent 9ef2a7031e
commit e850cbfeff
2 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -92,7 +92,7 @@
| task | MASON-WP-0013-T03 | wait | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
| task | MASON-WP-0013-T04 | wait | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
| task | MASON-WP-0014-T01 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
| task | MASON-WP-0014-T02 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
| task | MASON-WP-0014-T02 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
| task | MASON-WP-0014-T03 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
| task | MASON-WP-0014-T04 | wait | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
| task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md |

24
plans/mas-tem-relay-smtp.md
View file

@ -228,4 +228,26 @@ No catalog entry: the lane is temporary and has a single consumer.
## 5. Executive summary
*(Generated after review.)*
**One-line ask:** let the temporary MAS test mail server read its TEM SMTP
login from OpenBao, and nothing else, until MAS-WP-0003 ends.
**Who gets access:** the External Secrets reader in namespace `mas`, and
only when it signs in as ServiceAccount `mas-tem-relay-eso`. No person, no
agent, no other namespace.
**To what:** read on `platform/suppliers/scaleway/mas-tem-relay`
(`username`, `password`), delivered as Secret `mas/mas-relay` to the `mas-mx`
container at `/etc/mas-relay`.
**For how long:** 15-minute OpenBao sessions, renewed by ESO, until teardown
at MAS-WP-0003 close. The Scaleway key's own expiry is the hard stop.
**Blast radius if the credential leaks:** someone can send mail as your TEM
project, which risks reputation, quota and cost, until you revoke the key in
the Scaleway console. If the key is TEM-only it gives no other Scaleway
access.
**Cost to reverse:** low. Delete the role, the policy and the KV path, then
revoke the key. Nothing else depends on it.
**Decision:** pending.