tegwick
cd6c61d034
A: coulomb as approved; four infotech hall-of-helix values move there as part of MASON-WP-0005-T04. B1 retire duplicate activity-core/default entry, B2 forgejo-mailer -> rapp-forgejo, B3 target-revenue deferred. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
11 KiB
11 KiB
Credential owner proposals — MASON-WP-0004-T01
Generated 2026-10-09 from scripts/custody-inventory.py under grant
claude-MASON-WP-0004-T01 (ops-mason-survey, metadata only, revoked after
use), cross-referenced with the ops-warden routing catalog, railiance-platform
CCRs/docs/policies and ops-mason plans. No value was read.
Scope has grown. The workplan counted 21 paths, 17 undescribed
(2026-08-28). Today: 49 paths, 45 without the five custody fields. Four are
described (the MASON-WP-0003 paths).
Owner rule used: the catalog's owner_repo where a catalog entry routes the
path; otherwise railiance-platform, which declared the lane by CCR. The consumer
is named alongside. A proposal is not a description: T02 writes the fields from
the cited document, T03 asks owners what the documents leave open.
A. Tenant conflict — founder ruling needed
platform/workloads/infotech/fluid-telegram/hall-of-helix/ holds four entries,
created 2026-10-07: bot-token v1, operator-app v1, operator-session v4,
redaction-salt v1. No document records them. This is the infotech tenant
that the approved operator-lane plan (plans/fluid-telegram-operator-credential-lane.md,
approved 2026-10-09) replaced with coulomb; the plan's live survey checked
only the coulomb path. Values are already in custody, so someone wrote them
with a broader token than the planned lane. Proposed owner: fluid-telegram.
Question for the founder: build the lane at coulomb and move the four values
there in one attended step (then destroy the infotech copies), or amend the
approved plan to the infotech path where the values already are?
Ruling (founder, 2026-10-09): coulomb as approved. The four values move
to platform/workloads/coulomb/fluid-telegram/hall-of-helix/ in one attended,
output-free step (railiance-platform helper, same technique as the
tenant-engine seed: CAS 0 at the target, verify by version, then delete the
infotech copies' metadata). fluid-telegram repoints its refs to coulomb.
B. Genuinely unclear — founder ruling or owner answer needed
platform/workloads/activity-core/default/llm-connect-provider-secrets— No document names it. Same secret name asactivity-core/llm-connect/llm-connect-provider-secrets(CCR-2026-0003), v1 from 2026-06-18: a superseded first placement? Question: is anything still reading it, or can it be retired?platform/workloads/forgejo/forgejo-mailer— No document names it. Question: is this the Forgejo SMTP credential, who owns it (railiance-platform as Forgejo operator?), and what reads it?platform/workloads/target-revenue/runtime-secrets— No document names it. Question: which repo owns target-revenue, and is the workload still deployed?
Rulings (founder, 2026-10-09):
activity-core/default/llm-connect-provider-secrets: retire as the duplicate ofactivity-core/llm-connect/llm-connect-provider-secrets. No source in railiance-platform, activity-core or the ops-warden catalog refers to it (checked 2026-10-09). Before the founder-run delete, confirm no live policy grants the path.forgejo/forgejo-mailer: owner rapp-forgejo (stub repo created by the founder; it is where Forgejo's deployment and credentials belong).target-revenue/runtime-secrets: deferred — outdated; picked up later with target-revenue. Listed here as unknown on purpose; T02/T03 skip it.
C. Documented — owner proposed from existing records
| Path | Version, last write | Proposed owner | Evidence |
|---|---|---|---|
operators/nextcloud |
v2 2026-09-05 | railiance-platform (consumer: nextcloud) | CCR-2026-0004-railiance-backup-offsite-lane.yaml |
operators/nextcloud/backup |
v2 2026-09-05 | railiance-platform (consumer: nextcloud) | CCR-2026-0004-railiance-backup-offsite-lane.yaml |
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets |
v2 2026-07-02 | railiance-platform (consumer: activity-core) | catalog openrouter-llm-connect; CCR-2026-0003-llm-connect-openrouter-api-key.yaml; ops-mason rein-openweights-openrouter-approle.md |
platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01 |
v1 2026-09-23 | railiance-platform (consumer: activity-core) | CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml |
platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01 |
v1 2026-09-23 | railiance-platform (consumer: activity-core) | CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml |
platform/workloads/agent-harness/forgejo-deploy-key |
v1 2026-07-17 | railiance-platform (consumer: agent-harness) | catalog agent-harness-forgejo-deploy; workload-kv-access-lanes.md |
platform/workloads/approval-engine/audit-sender |
v1 2026-09-11 | railiance-platform (consumer: approval-engine) | CCR-2026-0021-approval-engine-audit.yaml |
platform/workloads/approval-engine/operator-client |
v1 2026-09-08 | railiance-platform (consumer: approval-engine) | CCR-2026-0018-keycape-approval-engine-operator-client.yaml |
platform/workloads/audit-core/senders |
v11 2026-08-14 | ops-mason (consumer: audit-core) | catalog audit-core-senders; tenant-engine-audit-core-sender-seed.md; ops-mason tenant-engine-audit-core-sender-projection.md |
platform/workloads/core-hub/forgejo-source-read |
v1 2026-10-03 | railiance-platform (consumer: core-hub) | catalog core-hub-forgejo-source-read; CCR-2026-0031-core-hub-forgejo-source-read.yaml |
platform/workloads/core-hub/runtime |
v1 2026-08-20 | railiance-platform (consumer: core-hub) | CCR-2026-0013-core-hub-runtime-api-token.yaml |
platform/workloads/coulomb-social/backup-primary |
v2 2026-10-08 | railiance-platform (consumer: coulomb-social) | CCR-2026-0036-coulomb-social-backup-primary.yaml |
platform/workloads/coulomb/whynot-design/npm-publish |
v2 2026-06-27 | railiance-platform (consumer: coulomb) | catalog whynot-design-npm-publish; CCR-2026-0001-whynot-design-npm-publish.yaml; ops-mason fluid-telegram-operator-credential-lane.md |
platform/workloads/email-connect/backup-primary |
v2 2026-10-08 | railiance-platform (consumer: email-connect) | CCR-2026-0037-email-connect-backup-primary.yaml |
platform/workloads/email-connect/transactional |
v1 2026-08-12 | railiance-platform (consumer: email-connect) | catalog email-connect-transactional; CCR-2026-0010-email-connect-transactional.yaml |
platform/workloads/forgejo/forgejo-admin |
v2 2026-07-12 | railiance-platform (consumer: forgejo) | catalog forgejo-admin-api-token; CCR-2026-0006-forgejo-admin-api-token-lane.yaml; ops-mason state-hub-forge-derivation-read.md |
platform/workloads/glas-harness/claude-agent-dev |
v2 2026-09-05 | railiance-platform (consumer: glas-harness) | CCR-2026-0016-glas-claude-anthropic.yaml |
platform/workloads/inbound-library/imap |
v2 2026-10-05 | ops-mason (consumer: inbound-library) | catalog inbound-library-imap-approle; inbound-library-imap-custody.md; ops-mason keycape-secrets-engine-openbao-client-custody.md |
platform/workloads/informed-decision/audit-sender |
v1 2026-09-11 | railiance-platform (consumer: informed-decision) | CCR-2026-0022-informed-decision-audit.yaml |
platform/workloads/informed-decision/sitting-requester |
v1 2026-09-15 | railiance-platform (consumer: informed-decision) | CCR-2026-0032.yaml |
platform/workloads/issue-core/issue-core/issue-core-runtime |
v4 2026-06-25 | railiance-platform (consumer: issue-core) | catalog issue-core-ingestion-api-key; CCR-2026-0002-issue-core-ingestion-api-key.yaml |
platform/workloads/keycape/secrets-engine-openbao |
v1 2026-10-06 | railiance-platform (consumer: keycape) | CCR-2026-0034.yaml; ops-mason keycape-secrets-engine-openbao-client-custody.md |
platform/workloads/net-kingdom/keycape-factor-issuer |
v1 2026-09-13 | railiance-platform (consumer: net-kingdom) | net-kingdom-credential-custody-contract.md |
platform/workloads/net-kingdom/keycape-factor-read |
v3452 2026-09-13 | railiance-platform (consumer: net-kingdom) | CCR-2026-0023-keycape-factor-read.yaml |
platform/workloads/policy-nexus/forgejo-source-read |
v1 2026-08-31 | railiance-platform (consumer: policy-nexus) | catalog policy-nexus-forgejo-source-read; CCR-2026-0014-policy-nexus-forgejo-source-read.yaml |
platform/workloads/railiance-clock/authority-signing |
v1 2026-09-15 | railiance-platform (consumer: railiance-clock) | CCR-2026-0028-railiance-clock-authority-signing.yaml |
platform/workloads/railiance-telemetry/smtp |
v2 2026-09-28 | railiance-platform (consumer: railiance-telemetry) | CCR-2026-0035-authelia-platform-smtp.yaml |
platform/workloads/railiance/backup/object-storage |
v2 2026-08-14 | railiance-platform (consumer: railiance) | CCR-2026-0012-backup-object-storage.yaml; ops-mason reef-storage-scaleway-bootstrap.md |
platform/workloads/railiance/backup/offsite-lane |
v4 2026-07-07 | railiance-platform (consumer: railiance) | catalog railiance-backup-offsite-lane; CCR-2026-0004-railiance-backup-offsite-lane.yaml; ops-mason reef-storage-scaleway-bootstrap.md |
platform/workloads/railiance/scaleway/bootstrap |
v2 2026-08-14 | railiance-platform (consumer: railiance) | catalog scaleway-bootstrap; CCR-2026-0011-scaleway-object-storage-bootstrap.yaml; ops-mason reef-storage-scaleway-bootstrap.md |
platform/workloads/rapp-qonto/keycape-client |
v2 2026-07-27 | key-cape (consumer: rapp-qonto) | catalog rapp-qonto-keycape-client |
platform/workloads/reuse/reuse-surface/runtime-secrets |
v1 2026-07-07 | railiance-platform (consumer: reuse) | catalog reuse-surface-hub-write-token; CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml; ops-mason fluid-telegram-operator-credential-lane.md |
platform/workloads/secrets-engine/approval-client |
v1 2026-09-08 | railiance-platform (consumer: secrets-engine) | CCR-2026-0019-secrets-engine-approval-client-read.yaml |
platform/workloads/secrets-engine/approval-requester |
v1 2026-09-14 | railiance-platform (consumer: secrets-engine) | CCR-2026-0025-t03-requester-reader.yaml |
platform/workloads/state-hub/repository-rename-preflight |
v2 2026-09-05 | railiance-platform (consumer: state-hub) | CCR-2026-0015-state-hub-preflight-signing.yaml |
platform/workloads/telemetry/grafana-admin |
v1 2026-09-06 | railiance-platform (consumer: telemetry) | telemetry-grafana.md |
platform/workloads/tenant-engine/audit-core-sender |
v1 2026-10-02 | railiance-platform (consumer: tenant-engine) | tenant-engine-audit-core-sender-seed.md; ops-mason tenant-engine-audit-core-sender-projection.md |
platform/workloads/user-engine/runtime |
v2 2026-07-29 | railiance-platform (consumer: user-engine) | keycape-approval-clients.md; ops-mason user-engine-openbao-runtime-custody.md |