Updated by fix-consistency on 2026-08-27:
- update .custodian-brief.md for ops-mason
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Policy workload-kv-read-state-hub-forge-derivation and Kubernetes auth
role state-hub-forge-derivation, verified both directions through a
2-minute test token that was revoked after use: read on its own path;
deny on forgejo-admin, on the shared llm-connect provider secrets, and
on the parent metadata path.
Kubernetes auth replaces the approved AppRole. The plan's §2 survey was
written from disk with no OpenBao session and could not see that
kubernetes/ auth is enabled on this cluster; the plan's own phase-4
instruction to re-verify against live state is what surfaced it. Ruled
by the founder at phase 4. No static credential is created, so nothing
has to be delivered into the cluster or rotated.
The live survey also re-checked reuse: workload-kv-read-agent-harness-
forgejo grants one repository deploy key, not organisation-wide read, so
§2's rejection of reuse stands.
ops-mason handled no secret value. The KV path does not exist until
paste_once_provision writes the token.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Updated by fix-consistency on 2026-08-26:
- update .custodian-brief.md for ops-mason
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Plan approved 2026-08-26, breadth organisation-wide repository read. The
§4 contingency was satisfied first: STATE-WP-0084-T01 landed the same
day, so a missing grant now surfaces as a named unreadable condition
rather than as silence — which is what the breadth argument rested on.
T01 done. T03 drafted in ops-warden on a branch (entry + playbook +
regenerated high-risk artifact). T02 needs an operator: no valid OpenBao
session here, and the token is the forge owner's to mint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Trim MASON-WP-0003 to T01-T03 — decide, build the AppRole/policy/KV path
structure, register the catalog entry — and route it through the
four-phase pipeline via plans/state-hub-forge-derivation-read.md, which
supplies the phase-3 executive summary the workplan was bypassing.
T02 no longer mints or holds the token value: SCOPE.md puts secret
values out of scope, so the forge owner mints and ops-warden's
paste_once_provision desk delivers.
Deployment plumbing, derive_from_forge(), and the fleet re-run move to
state-hub/STATE-WP-0084.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Nine private repositories are invisible to the hub's derivation: the pod clones
Forgejo anonymously, so ADR-012's premise that the forge is the projection
source holds only for repositories central can read.
warden route find returns no lane for this need, and the nearest entry is an
operator admin PAT owned by railiance-platform — more authority than derivation
requires. ops-mason owns AppRoles, policies and KV paths, which is what is
missing.
Six tasks: settle scope and breadth, create the AppRole and KV path, register
the routing entry, deliver the credential to the pod, teach the derivation to
use it, and confirm the nine. Token creation stays operator-executed; this
workplan describes the lane rather than performing it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
These files carried no type field at all. Selection is by 'type: workplan', so
they were invisible to every projection while the hub held a record for each —
and a forge-derived reset read those correct records as no longer deriving and
queued them for retirement.
Only the type line is added.
Refs STATE-WP-0083-T05
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
The remote row pointed at 127.0.0.1:18000, a reverse tunnel back to the
workstation. On railiance01 the State Hub runs in the cluster on that same
machine, so the request left the box and came back to reach a local service.
Refs CUST-WP-0067-T07
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's preliminary governing license, per target-revenue's workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full specialist legal review is deferred until out of beta (target-revenue SCOPE.md section 1). No Phase is yet declared for this repo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Two more real bugs found completing this lane for real:
1. platform-admin's own policy had no entry for the new reins/ mount --
the founder's paste-once-provision write 403'd because the admin
identity that created the mount was never granted access to operate
on it. Fixed live (added path "reins/*" matching every other mount
already in that policy).
2. _policy_hcl wrote the bare KV-v1-shaped path
(reins/rein-openweights/openrouter) instead of KV v2's data/+metadata/
sub-paths -- bao token capabilities on the bare path even reported
full access, but the actual kv get still 403'd, because OpenBao
evaluates the real request against the data/-prefixed path. Caught
when the AppRole's own read failed during live verification. Fixed
in code (now emits both data/ and metadata/ paths), locked in with a
dedicated unit test, and re-applied to the live policy.
Live end-to-end verification succeeded after both fixes: real AppRole
login, real KV v2 read via the corrected policy, real OpenRouter call,
real commit -- with OPENROUTER_API_KEY unset the whole time. Plan status:
catalogued. glas-harness/GLAS-WP-0002-T02 is closed by this.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
