coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name a dedicated reuse-surface hub-writer caller.

Browse source 
CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
tegwick 2026-10-14 18:19:14 +02:00
parent 6434877a44
commit fd2c5a5904
12 changed files with 841 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/MASON-WP-0004-credential-inventory-descriptions.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: codex
topic_slug: custodian
created: "2026-08-28"
updated: "2026-10-03"
updated: "2026-10-14"
related:
- MASON-WP-0003
- NK-WP-0033
@ -149,7 +149,7 @@ id: MASON-WP-0004-T03
status: wait
depends_on: [MASON-WP-0004-T01]
blocked_on: owners
blocking_reason: "Owners fill the gaps in manifests/custody-descriptions.yaml for the 9 draft entries (asked 2026-10-09)."
blocking_reason: "operators/nextcloud base entry removed 2026-10-14 after the founder retired it. Remaining draft gaps still need their owners."
priority: low
state_hub_task_id: "fff26914-d854-5854-b350-d7241812fb04"
```
@ -203,6 +203,18 @@ fluid-telegram four from the approved plan (draft until fluid-telegram confirms,
message `da7e711c`); asked email-connect for its new path (message
`acb3ff22`).
2026-10-10: railiance-platform (message `389906a5`) confirmed `operators/*`
metadata writes are refused on purpose. Descriptions for that mount stay in
this file and are not mirrored into OpenBao. `operators/nextcloud/backup`
keeps the file-backed fields.
2026-10-14: railiance-platform (message `f67d4dea`) said the founder deleted
`operators/nextcloud` on 2026-10-10. Removed that draft from
`manifests/custody-descriptions.yaml`. `operators/nextcloud/backup` stays.
Still open: `keycape-factor-issuer` rotation and `user-engine/runtime`
on_loss, plus any undescribed paths from the 2026-10-10 inventory whose
owners have not answered.
## Make an undescribed path visible before it accumulates
```task

11
workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: codex
topic_slug: helix-forge
created: "2026-09-04"
updated: "2026-10-05"
updated: "2026-10-14"
state_hub_workstream_id: "483e56d6-6601-5377-9066-66225214c046"
---
@ -218,7 +218,7 @@ id: MASON-WP-0005-T05
status: progress
depends_on: [MASON-WP-0005-T04]
blocked_on: human
blocking_reason: "ops-mason checks and the non-member refusal pass (2026-10-09). tegwick has no MFA factor: it enrolls through user-engine self-service MFA (message ab89a591, USER-WP-0028-T03), then the founder runs scripts/verify-fluid-telegram-lane.sh member; fluid-telegram runs the salt create-once probe (FT-WP-0002)."
blocking_reason: "ops-mason checks and the non-member refusal pass. tegwick enrolled TOTP on 2026-10-11 (message 36b443ab). The founder still runs scripts/verify-fluid-telegram-lane.sh member via the 127.0.0.1:18200 tunnel. fluid-telegram runs the salt create-once probe (FT-WP-0002)."
priority: high
state_hub_task_id: "4c205be7-4f1f-5dd1-aafa-fc112fdd640e"
```
@ -266,6 +266,13 @@ deliver it (USER-WP-0028-T03 / USER-WP-0027-T04, decision cef97ccd), with
`tegwick` as the first attended real-user acceptance, and to reply when
`tegwick` has an active factor.
2026-10-14: user-engine reports the factor is active (message `36b443ab`).
`tegwick` enrolled TOTP at 22:22 on 2026-10-11 and passed the portal half of
U07 at 22:30. The OpenBao half is still the founder running
`scripts/verify-fluid-telegram-lane.sh member` through
`http://127.0.0.1:18200`. `coulomb-social` has `mfaRequired: false`, so it is
not the check. This session did not start that login.
## Hand off routing and keep the adapter lane separate
```task

98
workplans/MASON-WP-0011-reuse-surface-hub-writer.md Normal file
View file

@ -0,0 +1,98 @@
---
id: MASON-WP-0011
type: workplan
title: "Name a dedicated caller for the reuse-surface hub writer token"
domain: infotech
repo: ops-mason
status: active
flavor: planning
owner: codex
topic_slug: custodian
created: "2026-10-14"
updated: "2026-10-14"
---
# Name a dedicated caller for the reuse-surface hub writer token
## Goal
Give CUST-WP-0081 an attended OpenBao caller whose token carries only
`workload-kv-read-reuse-surface-runtime` on the exact runtime-secrets data
and metadata paths, with parent and sibling paths denied. The platform-admin
entity `4a1f663c-0621-0483-edd0-f852274f4b6b` is not that caller.
Demand: State Hub message `08b254af-59d4-4d1a-9544-fed3dcaaf213` from
the-custodian, workplan CUST-WP-0081.
## Boundaries
- ops-mason writes the plan, the draft CCR, the role document, and the
verifier. It does not install a policy or a role, and it does not read
`REUSE_SURFACE_TOKEN`.
- railiance-platform owns the OpenBao apply. CCR-2026-0005 stays the
authority for the existing secret and the ESO lane.
- key-cape owns group `reuse-surface-hub-writers` and the member principal.
- ops-warden keeps catalog `reuse-surface-hub-write-token`. It does not
receive a secret value. It names the role only after both verifier modes
pass.
## Write the caller plan
```task
id: MASON-WP-0011-T01
status: done
priority: high
```
Record why the admin entity cannot carry the workload policy, reuse the
existing KV path and policy, and publish the draft role, CCR, and verifier.
Done 2026-10-14. Plan `plans/reuse-surface-hub-writer.md` (status draft).
Bundle `builds/reuse-surface-hub-writer/`. Verifier
`scripts/verify-reuse-surface-hub-writer.py`. No live login and no KV read.
## Confirm the group and the member entity
```task
id: MASON-WP-0011-T02
status: wait
depends_on: [MASON-WP-0011-T01]
blocked_on: message-from:key-cape
blocking_reason: "key-cape confirms group reuse-surface-hub-writers and a member entity that is not 4a1f663c-0621-0483-edd0-f852274f4b6b and has no platform-admin or operator-custody identity policy."
priority: high
```
Ask key-cape to create or confirm the group and to name the member entity
id without sending a credential. `bound_claims_confirmed` stays false until
that reply. railiance-platform's two approvers still have to accept the CCR.
## Apply the role without a KV write
```task
id: MASON-WP-0011-T03
status: wait
depends_on: [MASON-WP-0011-T02]
blocked_on: human
blocking_reason: "After T02. Founder applies the CCR through the delegated applier. No bao kv put. Do not attach the policy to the admin entity."
priority: high
```
railiance-platform assigns the real CCR id, copies the policy file over the
existing `workload-kv-read-reuse-surface-runtime` policy, and applies the
role. The KV value is already present under CCR-2026-0005.
## Record the sanitized receipt
```task
id: MASON-WP-0011-T04
status: wait
depends_on: [MASON-WP-0011-T03]
blocked_on: human
blocking_reason: "After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet."
priority: high
```
Both modes must pass. Copy the mode-0600 receipts into `docs/evidence/`
with no token and no field value, reply to message `08b254af`, and tell
ops-warden the role name for `auth_method`. Hub registration itself stays
with the-custodian.