Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Live policy and role equal the approved spec, 8 agent denies present, custody
at coulomb v1. verify-fluid-telegram-lane.sh lets the founder prove member
capabilities and non-member refusal without printing a token. T06 entry
proposed to ops-warden. plans/case-forgejo-netkingdom-oidc.md: reviewed,
no collisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Founder run 4 merged 27 accepted descriptions. Two failed with HTTP 400:
used_by was 514 bytes because clipping counted characters and appended a
3-byte ellipsis. Clip and check now count bytes; manifest re-clipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Third founder run: every write exited 2 (bao's generic error code), cause not
visible. The receipt now keeps only the HTTP status from stderr; on 403/405
for patch it reads metadata (never data), merges and writes it back whole,
preserving custom_metadata set by earlier CCRs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
The warden wrapper runs with a temporary HOME and without BAO_ADDR, so the
second founder run exited non-zero and its receipt vanished with the
temporary directory. Failures now record bao's exit code in the receipt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
The warden admin wrapper refuses any output; the first founder run was
refused (nothing written, all entries still drafts).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
custody-describe.py drafts the five custody fields from CCRs, the routing
catalog and the owner proposals (no OpenBao access), and applies accepted
entries with bao kv metadata patch only, silently. 29/38 drafts complete;
gaps left empty for owners. 4 tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
bao login printed the full platform-admin token to stdout, which put it in
an agent transcript on 2026-10-08. Use -no-print so it reaches only the
token helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Value-free evidence under the read-only ops-mason-survey grant (revoked after
use). Adds T05 for live-token checks and the pointer route. Fixes
bao-session.sh grant misreporting an unreadable policy as absent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Founder decision 2026-10-07, option (c)+(a): ops-mason surveys and verifies
only. Policy/role writes, secret-id minting and token creation go through the
founder-attended railiance-platform delegated applier. ops-mason-build retired
to policies/retired/ (never installed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
scripts/plan-survey.py runs under the ops-mason-build grant and prints a
pasteable section 2: relevant secrets/auth/policy/role listings with counts,
policy stanzas covering the target for name-matched policies, KV metadata
existence, matching ops-warden catalog entries, timestamp, BAO_ADDR, token
display_name and a draft yes/no/partial answer. Metadata only: an allowlist
refuses kv get, */data/* and role-id/secret-id before any process starts; a
non-grant token is refused and the token is never printed. Denied queries
degrade to 'not permitted by ops-mason-build'. Tests use a fake bao runner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1170398@bnt-lap001
Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
custody-inventory.py walks operators/ and platform/workloads/, prints
each path's description, owner, consumers and recovery path, and marks
any missing them. Metadata only, never a value, so it runs under
ops-mason-build and can be handed to anyone orienting themselves. First
run: 21 paths, 17 undescribed.
Described the four this session touched, including on_loss — the field
whose absence meant the LLDAP predecessor's recovery path had to be
worked out from first principles while locked out.
ops-mason-build gains create/update on */metadata/*, since a description
is documentation rather than a value. delete stays absent: deleting a
metadata entry destroys every version of the secret beneath it.
It also now denies itself sys/policies/acl/ops-mason-build. Without that
the policy was advisory — a token that can write policies can delete its
own denials, so the claim that OpenBao enforces "never read a value" was
not true as written. An exact path outranks the glob, so changing what
ops-mason may do is now an operator act, visible as one in the audit log.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
The OIDC flow reads nothing from stdin — it starts a local callback
listener, prints a URL, and waits for the browser. The guard was copied
from scripts that prompt for secrets, where it belongs, and here it only
blocked the non-interactive invocation the flow supports.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Handing an agent an operator session gives it everything you have, for
as long as you have it, and every action lands in the audit log as you.
scripts/bao-session.sh grant <task> mints a separate token into
~/.claude-bao-token — your ~/.vault-token is untouched and the two
revoke independently. 45 minutes, max one hour, display_name
claude-<task> so an audited action is attributable to a piece of work.
policies/ops-mason-build.hcl is what makes the scope real. It allows the
phase-2 survey (sys/mounts, sys/auth, policy list), policy and auth-role
creation, KV metadata reads, and short-lived test tokens for positive
and negative capability checks. It denies every read of */data/* on
platform, operators and secret.
That denial is the point: SCOPE.md says ops-mason never touches secret
values, and until now that was a promise kept by whoever was driving.
An explicit deny outranks any grant, including one added to this policy
later by mistake. The one time the line was crossed is recorded in
plans/state-hub-forge-derivation-read.md §8; under this policy it would
have been refused rather than recorded.
sys/mounts/* is deliberately absent — enabling a mount is a
railiance-platform act, and a grant that needed it should be recognised
as a broader thing rather than folded in here.
Also fixes the WSL2 login trap: bao login's browser launch fails under
gio, so the script prints the URL plainly instead of appearing to hang.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
