Founder decision 2026-10-18, "build, but never log in": a plan-scoped grant
that writes workload-kv-read-* policies, external-secrets-* and AppRole role
definitions, and create-only placeholder KV under platform/{workloads,suppliers},
and denies role-id, secret-id, token creation and all value reads, so the
MASON-IN-0004 chain stays broken. Adds bao-session.sh build, policy tests,
INTENT/AGENTS alignment and MASON-WP-0015. Not installed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
bao login printed the full platform-admin token to stdout, which put it in
an agent transcript on 2026-10-08. Use -no-print so it reaches only the
token helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
Value-free evidence under the read-only ops-mason-survey grant (revoked after
use). Adds T05 for live-token checks and the pointer route. Fixes
bao-session.sh grant misreporting an unreadable policy as absent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Founder decision 2026-10-07, option (c)+(a): ops-mason surveys and verifies
only. Policy/role writes, secret-id minting and token creation go through the
founder-attended railiance-platform delegated applier. ops-mason-build retired
to policies/retired/ (never installed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
The OIDC flow reads nothing from stdin — it starts a local callback
listener, prints a URL, and waits for the browser. The guard was copied
from scripts that prompt for secrets, where it belongs, and here it only
blocked the non-interactive invocation the flow supports.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
Handing an agent an operator session gives it everything you have, for
as long as you have it, and every action lands in the audit log as you.
scripts/bao-session.sh grant <task> mints a separate token into
~/.claude-bao-token — your ~/.vault-token is untouched and the two
revoke independently. 45 minutes, max one hour, display_name
claude-<task> so an audited action is attributable to a piece of work.
policies/ops-mason-build.hcl is what makes the scope real. It allows the
phase-2 survey (sys/mounts, sys/auth, policy list), policy and auth-role
creation, KV metadata reads, and short-lived test tokens for positive
and negative capability checks. It denies every read of */data/* on
platform, operators and secret.
That denial is the point: SCOPE.md says ops-mason never touches secret
values, and until now that was a promise kept by whoever was driving.
An explicit deny outranks any grant, including one added to this policy
later by mistake. The one time the line was crossed is recorded in
plans/state-hub-forge-derivation-read.md §8; under this policy it would
have been refused rather than recorded.
sys/mounts/* is deliberately absent — enabling a mount is a
railiance-platform act, and a grant that needed it should be recognised
as a broader thing rather than folded in here.
Also fixes the WSL2 login trap: bao login's browser launch fails under
gio, so the script prints the URL plainly instead of appearing to hang.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
