{ "workplan": "MASON-WP-0009", "task": "MASON-WP-0009-T04", "date": "2026-10-07", "kind": "capability verification (metadata and policy text only; value-free)", "status": "pass", "grant": { "policy": "ops-mason-survey", "extra_policies": ["default"], "display_name": "token-claude-MASON-WP-0009-T04", "bao_addr": "http://127.0.0.1:18200", "founder_session_used": false, "revoked_self": true, "lookup_after_revoke_failed": true, "token_file_shredded": true }, "kv_path": "platform/workloads/keycape/secrets-engine-openbao", "secret_value_read": false, "checks": { "1_policies": { "result": "pass", "workload-kv-read-keycape-secrets-engine-openbao-eso": { "live_matches_repo_file": true, "repo_file": "railiance-platform/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl", "paths": { "platform/data/workloads/keycape/secrets-engine-openbao": ["read"], "auth/token/lookup-self": ["read"], "auth/token/revoke-self": ["update"] } }, "workload-kv-read-keycape-secrets-engine-openbao-operator": { "live_matches_repo_file": true, "repo_file": "railiance-platform/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-operator.hcl", "paths": { "platform/data/workloads/keycape/secrets-engine-openbao": ["read"], "auth/token/revoke-self": ["update"] } } }, "2_roles": { "result": "pass", "auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao": { "matches": "railiance-platform/credential-change-requests/CCR-2026-0033.yaml", "bound_service_account_names": ["external-secrets"], "bound_service_account_namespaces": ["external-secrets"], "audience": "openbao", "token_ttl_s": 900, "token_max_ttl_s": 900, "token_explicit_max_ttl_s": 900, "token_no_default_policy": true, "token_policies": ["workload-kv-read-keycape-secrets-engine-openbao-eso"] }, "auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read": { "matches": "railiance-platform/credential-change-requests/CCR-2026-0034.yaml", "role_type": "oidc", "bound_claims_keys": ["groups", "/assurance/level"], "bound_groups": ["net-kingdom-admins"], "bound_assurance_level": "aal2", "bound_claims_type": "string", "user_claim": "sub", "groups_claim": "groups", "oidc_scopes": ["openid", "profile", "email", "groups"], "token_ttl_s": 300, "token_max_ttl_s": 300, "token_explicit_max_ttl_s": 300, "token_num_uses": 4, "token_type": "service", "token_no_default_policy": true, "token_policies": ["workload-kv-read-keycape-secrets-engine-openbao-operator"], "allowed_redirect_uris_match_ccr": true, "note": "includes the known harmless retired redirect https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback, as in the CCR" } }, "3_kv_metadata": { "result": "pass", "method": "bao kv metadata get (never kv get)", "current_version": 1, "version_1_deleted": false, "version_1_destroyed": false, "cas_required": true, "max_versions": 2, "delete_version_after": "0s", "custom_metadata_keys": ["ccr", "classification", "client_id", "issuer", "owner", "plan", "readers", "rotation"], "custom_metadata_matches_plan_section_3_1": true }, "4_circularity": { "result": "pass", "a_policies_reaching_data_path": { "policies_listed": 81, "policies_read": 79, "not_readable": {"ops-mason-survey": "denied by its own explicit deny (by design)", "root": "built-in, not readable"}, "lane_policies": ["workload-kv-read-keycape-secrets-engine-openbao-eso", "workload-kv-read-keycape-secrets-engine-openbao-operator"], "broad_policies": { "platform-admin": "platform/* create/read/update/delete/list; bound to auth/netkingdom/role/platform-admin (with operator-custody)", "root": "built-in" }, "other_grant_on_path": false, "secrets_engine_policies_reach_path": false, "secrets_engine_policies_checked": ["secrets-engine-build", "secrets-engine-prod", "secrets-engine-test"], "secrets-engine-openbao_jwt_policy_exists": false }, "b_jwt_roles": { "auth_jwt_mount_present": false, "keycape_services_jwt_mount_present": false, "auth_mounts": ["approle", "keycape (oidc)", "kubernetes", "netkingdom (oidc)", "token"], "roles_surveyed": {"kubernetes": 27, "netkingdom": 12, "approle": 14}, "roles_binding_path_reaching_policies": [ "kubernetes/external-secrets-keycape-secrets-engine-openbao", "netkingdom/keycape-secrets-engine-openbao-operator-workload-kv-read", "netkingdom/platform-admin" ] }, "c_eso_reader_on_kubernetes_auth": true }, "5_grant_self_check": { "result": "pass", "platform/data/workloads/keycape/secrets-engine-openbao": "deny", "platform/metadata/workloads/keycape/secrets-engine-openbao": "list, read", "sys/policies/acl/x": "read", "sys/policies/acl/ops-mason-survey": "deny", "auth/approle/role/x/secret-id": "deny", "auth/token/create": "deny" } }, "not_permitted_by_ops-mason-survey": [ "auth/keycape/role (list/read) - the KeyCape human OIDC mount's roles were not surveyed; invariant (i)/(ii) cover it only through policy text", "sys/policies/acl/ops-mason-survey (own policy, explicit deny)" ], "observations_for_owners": [ "ops-mason-build (retired, 'never to be installed') is still installed. It denies platform/data/* but grants create/update on platform/metadata/*, which could change cas_required/max_versions of this entry. No surveyed role binds it. Founder/platform should delete it.", "secrets-engine-prod may write sys/policies/acl/se-prod-* with unconstrained content and bind it via auth/approle/role/se-prod-*; it could author a policy reaching this path. No such policy exists now; this is an indirect route outside invariant (ii) as worded.", "agent-high-risk-boundary does not list this path among its explicit denies, unlike the sibling secrets-engine approval-client/requester entries." ], "not_covered_here": [ "Plan section 4 checks 1-3 and 6 need live lane tokens (operator OIDC login, ESO token, non-member identity, secrets-engine service-jwt run). The survey grant cannot mint or use them; policy text and role definitions are verified equivalent instead.", "The secrets-engine-openbao service-JWT mount (keycape-services) and its policy do not exist yet (RPF-WP-0035-T02); invariant (ii) must be rechecked once they are applied.", "Pointer-only ops-warden route for the operator lane (MASON-WP-0009-T05)." ] }