coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0010-T01: review oidc-browser-relying-party materialization section

Browse source 
Six refinements: fix the custody path in the type, reuse the
workload-kv-read-keycape-* policy family, template policy bodies, add the
ESO role, align catalog naming, collapse duplicate rollback steps.
T02 now waits on NK-WP-0048-T05. Also commits pending sync output
(WP-0009-T05 task id, WORK-RECORDS refresh).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-08 23:21:03 +02:00
parent 812839e2b6
commit fdc0e578c0
3 changed files with 46 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
WORK-RECORDS.md
View file

@ -18,6 +18,7 @@
| workplan | MASON-WP-0007 | blocked | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
| workplan | MASON-WP-0008 | finished | — | workplans/MASON-WP-0008-plan-survey.md |
| workplan | MASON-WP-0009 | blocked | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| workplan | MASON-WP-0010 | ready | — | workplans/MASON-WP-0010-security-case-materialization.md |
| task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
| task | MASON-0001-T02 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
| task | MASON-0001-T03 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
@ -63,8 +64,13 @@
| task | MASON-WP-0009-T01 | done | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0009-T02 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0009-T03 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0009-T04 | todo | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0009-T04 | done | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0009-T05 | wait | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
| task | MASON-WP-0010-T01 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md |
| task | MASON-WP-0010-T02 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md |
| task | MASON-WP-0010-T03 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md |
| task | MASON-WP-0010-T04 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md |
| intake | MASON-IN-0001 | closed | green | intakes/intakes.md |
| intake | MASON-IN-0002 | closed | — | intakes/intakes.md |
| intake | MASON-IN-0003 | open | — | intakes/intakes.md |
| intake | MASON-IN-0004 | open | — | intakes/intakes.md |
| intake | MASON-IN-0004 | closed | — | intakes/intakes.md |

1
workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
View file

@ -117,6 +117,7 @@ status: wait
blocked_on: message-from:railiance-platform
blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route."
priority: medium
state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
```
Once the service-JWT lane exists: re-run invariant (ii) against its policy,

41
workplans/MASON-WP-0010-security-case-materialization.md
View file

@ -42,9 +42,8 @@ of work this replaces. It becomes a reference instance for the first type.
```task
id: MASON-WP-0010-T01
status: wait
status: done
depends_on: [NK-WP-0048-T03]
blocking_reason: "The materialization section follows the type schema and template."
priority: high
state_hub_task_id: "3382ea7b-65ca-59a9-97ae-273455af44c2"
```
@ -58,11 +57,45 @@ case parameters, with naming rules. These must respect ops-mason's existing
template sprawl. Write it for the first type, `oidc-browser-relying-party`, from
MASON-WP-0009 and the existing key-cape client custody paths.
**Review (2026-10-08) of net-kingdom `security-case-types/oidc-browser-relying-party/type.yaml` 1.0.**
The structure (four items, all but the catalog entry conditional on
`confidential`) is right. The names add three new families where existing ones
cover the need, so they fail "respect, extend or compact before adding".
Requested refinements, each from the live CCR-2026-0033 placement
(`plans/keycape-secrets-engine-openbao-client-custody.md`):
1. **Fix the path in the type.** `secret_ref` should not be case-settable; a
free pattern under `platform/workloads/` lets every case pick its own layout.
Derive it: `platform/workloads/keycape/{client_id}` (field `CLIENT_SECRET`),
as for `secrets-engine-openbao`.
2. **Reuse the policy family.** Existing readers are
`workload-kv-read-keycape-<client>-<reader>`. Rename
`keycape-client-{client_id}-read` to `workload-kv-read-keycape-{client_id}-eso`
(KeyCape reads its client secret only through ESO), and
`{consuming_service}-oidc-client-{client_id}-read` to
`workload-kv-read-keycape-{client_id}-{consuming_service}`. Update
verification `custody-allowed-to-consumer` and rollback to match.
3. **Template the policy body, not just its name.** An `openbao_policy` item
needs its rules (`read` on `platform/data/workloads/keycape/{client_id}`,
nothing else: no metadata, list, parent or sibling), or the review cannot
check invariant (ii) and a rendered plan is not buildable.
4. **Add the missing ESO role.** `deliver-secret` needs a Kubernetes-auth role
`external-secrets-keycape-{client_id}` (kind `openbao_role`, bound to the
ESO service account, policy from item 2, 15m TTL, no default policy), as
the reference placement has.
5. **Catalog naming.** The one existing entry is `rapp-qonto-keycape-client`;
prefer `{consuming_service}-keycape-client` over `oidc-client-{client_id}`.
6. **Rollback order.** `mint-secret` "destroy" and `client-secret-path`
"remove" act on the same KV path; collapse to one step (metadata delete
after the ExternalSecret is gone) so rollback cannot fail on a missing path.
With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05.
```task
id: MASON-WP-0010-T02
status: wait
depends_on: [MASON-WP-0010-T01]
blocking_reason: "Rendering needs the agreed materialization section."
depends_on: [MASON-WP-0010-T01, NK-WP-0048-T05]
blocking_reason: "Rendering waits for net-kingdom to fold in the T01 review and acknowledge the type (NK-WP-0048-T05)."
priority: high
state_hub_task_id: "fd385537-7378-5539-8a6e-f45851296f42"
```