coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare typed structural evidence without credential success circularity

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:42:57 +02:00
parent 247c829569
commit f52c94cd4e
7 changed files with 1094 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: claude-code
topic_slug: netkingdom
created: "2026-10-08"
updated: "2026-10-09"
updated: "2026-10-11"
depends_on: []
related_repos:
- net-kingdom
@ -144,7 +144,7 @@ id: MASON-WP-0010-T03
status: progress
depends_on: [MASON-WP-0010-T02]
blocked_on: message-from:railiance-platform
blocking_reason: "Built 2026-10-09 (builds/case-forgejo-netkingdom-oidc). Acceptance waits on railiance-platform filing the CCR drafts and the founder applying them, plus mint-secret; then the Forgejo case is live."
blocking_reason: "Typed exact structural evidence request is prepared. Native materialization waits on independently authenticated policy/role/layout/catalog observations and CCR42 consumer binding/application. Mint, delivery and first live verification are follow-through, not structural prerequisites."
priority: high
state_hub_task_id: "56cea6be-c613-586c-80cd-125340b374da"
```
@ -228,3 +228,22 @@ re-pinned to @1.1. The live re-render above was already 1.1. Bundle rebuilt
from it (`builds/case-forgejo-netkingdom-oidc/`, platform validation pass);
the ESO policy is unchanged against the applied CCR-2026-0041, so 1.1 changes
no OpenBao object.
2026-10-11 accepted-architecture source implementation: materialization is
structure only under the already accepted canon; the stale mint-before-
materialization blocker is removed, not replaced by a fake status label.
`src/ops_mason/case_structure.py` and read-only `ops-mason structure-request`
validate a separate current structural projection against the hashed bundle
and prepare typed per-owner observations. Full execution drift remains visible:
35880bb adds --check-config to register-client, changing full render af1f4f81
→ e64b56e4 while materialization/composition/verification/rollback remain equal.
No prior execution approval is carried forward. Candidate receipt verification
requires independent owner/manual provenance and derives undo only from
verified creation receipts; planned rollback identities are not ownership.
Thirty-three relevant tests and ruff pass. Status-only raw-hash binding previews
accepted→materialized only after independent observations, preserving every
parameter/acceptance field; it writes and signs nothing. Details and exact native owner seams:
`docs/forgejo-structural-materialization-source-v1.md`. T03 remains progress;
case remains accepted@1.1, not materialized/live. CCR42 consumer auth remains
in_flight, and native owner evidence is not manufactured by source preparation.