diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 6502fc1..903a718 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -16,6 +16,8 @@ | workplan | MASON-WP-0005 | blocked | — | workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md | | workplan | MASON-WP-0006 | blocked | — | workplans/MASON-WP-0006-readiness-tier-check.md | | workplan | MASON-WP-0007 | blocked | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | +| workplan | MASON-WP-0008 | finished | — | workplans/MASON-WP-0008-plan-survey.md | +| workplan | MASON-WP-0009 | blocked | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md | | task | MASON-0001-T02 | done | — | workplans/MASON-0001-statehub-bootstrap.md | | task | MASON-0001-T03 | done | — | workplans/MASON-0001-statehub-bootstrap.md | @@ -53,6 +55,16 @@ | task | MASON-WP-0007-T04 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | | task | MASON-WP-0007-T05 | done | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | | task | MASON-WP-0007-T06 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | +| task | MASON-WP-0008-T01 | done | — | workplans/MASON-WP-0008-plan-survey.md | +| task | MASON-WP-0008-T02 | done | — | workplans/MASON-WP-0008-plan-survey.md | +| task | MASON-WP-0008-T03 | done | — | workplans/MASON-WP-0008-plan-survey.md | +| task | MASON-WP-0008-T04 | done | — | workplans/MASON-WP-0008-plan-survey.md | +| task | MASON-WP-0008-T05 | done | — | workplans/MASON-WP-0008-plan-survey.md | +| task | MASON-WP-0009-T01 | done | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0009-T02 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0009-T03 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | +| task | MASON-WP-0009-T04 | todo | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | | intake | MASON-IN-0001 | closed | green | intakes/intakes.md | | intake | MASON-IN-0002 | closed | — | intakes/intakes.md | | intake | MASON-IN-0003 | open | — | intakes/intakes.md | +| intake | MASON-IN-0004 | open | — | intakes/intakes.md | diff --git a/intakes/intakes.md b/intakes/intakes.md index 56c9178..30b3410 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -70,6 +70,31 @@ notes: >- and the founder-accepted plan-approval exception. The declaration request is fulfilled; the accepted conformance gaps and their 2026-12-21 review remain declared and are not marked conformant by this intake closure. +state_hub_intake_id: "01a06e68-575c-714f-b572-79bcd739c3a0" +``` + +## MASON-IN-0003 — Construct the fluid-telegram adapter read lane + +```yaml +id: MASON-IN-0003 +kind: intake +title: Construct the fluid-telegram adapter read lane +status: open +origin: cross-repo +origin_ref: FT-WP-0002-T06 +priority: high +owner: ops-mason +requested_by: ops-warden +description: Design and construct a runtime identity for the fluid-telegram adapter + after its deployment identity is declared. The lane may read only the campaign's + bot-token and redaction-salt entries. It must be denied operator-app and + operator-session, must not reuse the attended provisioner OIDC role, and must pass + positive plus sibling-workload/campaign and operator-credential negative checks + before ops-warden activation. Demand message 287cf897-7f47-4bcc-87d6-085f43d5f03e; + parent construction workplan MASON-WP-0005. +created: '2026-09-04T21:55:00+02:00' +updated: '2026-09-04T21:55:00+02:00' +state_hub_intake_id: "01a06e68-8c29-7230-b0dc-88f1e374afa4" ``` ## MASON-IN-0004 — Close the policy-plus-AppRole escalation path in ops-mason-build @@ -127,4 +152,5 @@ notes: >- A survey needs only (c)'s read-only grant. Today MASON-WP-0008 plan-survey runs under the full build grant, so separating them also reduces what a survey session can do. +state_hub_intake_id: "01a11118-1f35-7ad5-ad51-65dd785c932f" ``` diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md index c6b2fc4..ff721f5 100644 --- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md +++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md @@ -10,6 +10,7 @@ owner: claude topic_slug: netkingdom created: "2026-10-06" updated: "2026-10-06" +state_hub_workstream_id: "d9be08f5-a0f5-5cd1-8f87-0a6868661d77" --- # MASON-WP-0009 — Place the KeyCape `secrets-engine-openbao` client secret in OpenBao @@ -40,6 +41,7 @@ secrets-engine D1–D4. id: MASON-WP-0009-T01 status: done priority: high +state_hub_task_id: "67e6b80b-3d21-5d19-80e9-23afb2453d0a" ``` Plan written and reviewed from source state. The live `bao` survey is @@ -53,6 +55,7 @@ status: wait blocked_on: founder-approval blocking_reason: "Founder must give A1 (this plan), A2 (revised CCR-2026-0033 with the operator reader and confirmed bound claims) and A3 (custody-child decision id); see plan section 5." priority: high +state_hub_task_id: "4329bcd1-d42f-56a3-92cb-63b36d79549e" ``` ## Owner changes delivered @@ -63,6 +66,7 @@ status: wait blocked_on: message-from:railiance-platform blocking_reason: "railiance-platform revises CCR-2026-0033 and its custody child; secrets-engine replaces the file provider for this profile; key-cape confirms the groups claim and MFA assurance for the OpenBao OIDC client." priority: high +state_hub_task_id: "f59fae58-397a-5bf5-9d1d-a33dc4aaa2ac" ``` ## Verify and propose the route @@ -71,6 +75,7 @@ priority: high id: MASON-WP-0009-T04 status: todo priority: medium +state_hub_task_id: "01f55a4d-06de-5d48-a3db-a0746dcf9892" ``` After platform applies the objects: a live metadata-only survey and the