coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T06: record founder choice (b) for the kube identity

Browse source 
Bernd Worsch resolved 30d29060-8d14-4a8e-9cde-34aa826eb8d1 as option (b).
The task stays wait on railiance-platform to install the scoped identity
and the attended admin lane. Cluster RBAC is unchanged.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 08:28:06 +02:00
parent 0f183d509f
commit ede8aee129
3 changed files with 20 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
INTENT.md
View file

@ -164,7 +164,7 @@ tooling_contacts:
until: "2026-12-21"
rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding."
relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision."
identity_gap: "2026-10-22 (MASON-IN-0006, still open): context default, name-only kubectl auth can-i --all-namespaces at 2026-10-21T23:55:17Z returned yes for create serviceaccounts/token, yes for create pods, and yes for impersonate serviceaccounts. The kube identity applied with is still system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit; the identity can mint any ServiceAccount token. Options (a), (b), and (c) are unchanged and unchosen. T06 waits on founder decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1."
identity_gap: "2026-10-22: founder chose MASON-IN-0006 (b), decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. A scoped ops-mason identity will apply the plane, and the admin kubeconfig will be an attended warden lane. That identity is not installed. Context default, name-only kubectl auth can-i --all-namespaces at 2026-10-21T23:55:17Z returned yes for create serviceaccounts/token, yes for create pods, and yes for impersonate serviceaccounts. The kube identity applied with is still system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit. T06 waits on railiance-platform to install (b)."
enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS."
- id: bao-session-grant
shape: "5.2"

10
intakes/intakes.md
View file

@ -256,9 +256,13 @@ description: >-
queries only; not exercised.
Fresh check 2026-10-22 (captured 2026-10-21T23:55:17Z), context default,
name-only, all namespaces: create serviceaccounts/token yes, create pods
yes, impersonate serviceaccounts yes. Still cluster-admin. Options (a),
(b), and (c) below are unchanged and unchosen. MASON-WP-0015-T06 waits on
founder decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1.
yes, impersonate serviceaccounts yes. Still cluster-admin.
2026-10-22: founder Bernd Worsch chose (b), hub decision
30d29060-8d14-4a8e-9cde-34aa826eb8d1. The scoped identity in (a), with the
admin kubeconfig reachable only through an attended warden access lane.
Cluster RBAC was not changed. This intake stays open until
railiance-platform installs that identity and the three checks are no.
MASON-WP-0015-T06 waits on railiance-platform.
Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing
is listening, but the railiance-platform runbooks still reference it.
options: >-

19
workplans/MASON-WP-0015-construct-grant.md
View file

@ -115,9 +115,8 @@ only. They edit their own files.
id: MASON-WP-0015-T06
status: wait
priority: medium
needs_human: true
decision_id: "30d29060-8d14-4a8e-9cde-34aa826eb8d1"
intervention_note: "Founder chooses MASON-IN-0006 option (a), (b), or (c). ops-mason did not choose and did not change cluster RBAC."
blocked_on: message-from:railiance-platform
blocking_reason: "Founder chose MASON-IN-0006 (b) on 2026-10-22, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. railiance-platform installs the scoped kube identity and moves the admin kubeconfig to an attended warden lane. The three can-i checks are still yes."
state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05"
```
@ -135,10 +134,16 @@ cluster-wide. Raised as MASON-IN-0006.
Result 2026-10-22, context `default`, captured 2026-10-21T23:55:17Z,
`--all-namespaces`, name-only: create serviceaccounts/token **yes**, create
pods **yes**, impersonate serviceaccounts **yes**. The identity is still
cluster-admin. MASON-IN-0006 stays the open residual and still names options
(a), (b), and (c). This task does not choose one and does not change cluster
RBAC. It waits on founder decision
`30d29060-8d14-4a8e-9cde-34aa826eb8d1` (open, pending).
cluster-admin.
2026-10-22: founder Bernd Worsch chose **(b)** on decision
`30d29060-8d14-4a8e-9cde-34aa826eb8d1`. The autonomous builder gets a scoped
kube identity limited to the kinds `kubernetes_plane` applies. The admin
kubeconfig is reachable only through an attended warden access lane, the same
pattern as the OpenBao platform-admin login. Cluster RBAC is unchanged.
railiance-platform installs that identity. Asked in message
`c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`. This task stays `wait` until the
three checks are no.
## Submit CCRs from approved plans (RPF-WP-0061)