From ede8aee129844d12229a85f9015be3624dd8e5c7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 08:28:06 +0200 Subject: [PATCH] MASON-WP-0015-T06: record founder choice (b) for the kube identity Bernd Worsch resolved 30d29060-8d14-4a8e-9cde-34aa826eb8d1 as option (b). The task stays wait on railiance-platform to install the scoped identity and the attended admin lane. Cluster RBAC is unchanged. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a --- INTENT.md | 2 +- intakes/intakes.md | 10 +++++++--- workplans/MASON-WP-0015-construct-grant.md | 19 ++++++++++++------- 3 files changed, 20 insertions(+), 11 deletions(-) diff --git a/INTENT.md b/INTENT.md index e21af03..405a57c 100644 --- a/INTENT.md +++ b/INTENT.md @@ -164,7 +164,7 @@ tooling_contacts: until: "2026-12-21" rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding." relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision." - identity_gap: "2026-10-22 (MASON-IN-0006, still open): context default, name-only kubectl auth can-i --all-namespaces at 2026-10-21T23:55:17Z returned yes for create serviceaccounts/token, yes for create pods, and yes for impersonate serviceaccounts. The kube identity applied with is still system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit; the identity can mint any ServiceAccount token. Options (a), (b), and (c) are unchanged and unchosen. T06 waits on founder decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1." + identity_gap: "2026-10-22: founder chose MASON-IN-0006 (b), decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. A scoped ops-mason identity will apply the plane, and the admin kubeconfig will be an attended warden lane. That identity is not installed. Context default, name-only kubectl auth can-i --all-namespaces at 2026-10-21T23:55:17Z returned yes for create serviceaccounts/token, yes for create pods, and yes for impersonate serviceaccounts. The kube identity applied with is still system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit. T06 waits on railiance-platform to install (b)." enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS." - id: bao-session-grant shape: "5.2" diff --git a/intakes/intakes.md b/intakes/intakes.md index 4d8a527..a08dd6c 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -256,9 +256,13 @@ description: >- queries only; not exercised. Fresh check 2026-10-22 (captured 2026-10-21T23:55:17Z), context default, name-only, all namespaces: create serviceaccounts/token yes, create pods - yes, impersonate serviceaccounts yes. Still cluster-admin. Options (a), - (b), and (c) below are unchanged and unchosen. MASON-WP-0015-T06 waits on - founder decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. + yes, impersonate serviceaccounts yes. Still cluster-admin. + 2026-10-22: founder Bernd Worsch chose (b), hub decision + 30d29060-8d14-4a8e-9cde-34aa826eb8d1. The scoped identity in (a), with the + admin kubeconfig reachable only through an attended warden access lane. + Cluster RBAC was not changed. This intake stays open until + railiance-platform installs that identity and the three checks are no. + MASON-WP-0015-T06 waits on railiance-platform. Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing is listening, but the railiance-platform runbooks still reference it. options: >- diff --git a/workplans/MASON-WP-0015-construct-grant.md b/workplans/MASON-WP-0015-construct-grant.md index 5a62ea5..b71adf7 100644 --- a/workplans/MASON-WP-0015-construct-grant.md +++ b/workplans/MASON-WP-0015-construct-grant.md @@ -115,9 +115,8 @@ only. They edit their own files. id: MASON-WP-0015-T06 status: wait priority: medium -needs_human: true -decision_id: "30d29060-8d14-4a8e-9cde-34aa826eb8d1" -intervention_note: "Founder chooses MASON-IN-0006 option (a), (b), or (c). ops-mason did not choose and did not change cluster RBAC." +blocked_on: message-from:railiance-platform +blocking_reason: "Founder chose MASON-IN-0006 (b) on 2026-10-22, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. railiance-platform installs the scoped kube identity and moves the admin kubeconfig to an attended warden lane. The three can-i checks are still yes." state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05" ``` @@ -135,10 +134,16 @@ cluster-wide. Raised as MASON-IN-0006. Result 2026-10-22, context `default`, captured 2026-10-21T23:55:17Z, `--all-namespaces`, name-only: create serviceaccounts/token **yes**, create pods **yes**, impersonate serviceaccounts **yes**. The identity is still -cluster-admin. MASON-IN-0006 stays the open residual and still names options -(a), (b), and (c). This task does not choose one and does not change cluster -RBAC. It waits on founder decision -`30d29060-8d14-4a8e-9cde-34aa826eb8d1` (open, pending). +cluster-admin. + +2026-10-22: founder Bernd Worsch chose **(b)** on decision +`30d29060-8d14-4a8e-9cde-34aa826eb8d1`. The autonomous builder gets a scoped +kube identity limited to the kinds `kubernetes_plane` applies. The admin +kubeconfig is reachable only through an attended warden access lane, the same +pattern as the OpenBao platform-admin login. Cluster RBAC is unchanged. +railiance-platform installs that identity. Asked in message +`c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`. This task stays `wait` until the +three checks are no. ## Submit CCRs from approved plans (RPF-WP-0061)