custody-inventory.py walks operators/ and platform/workloads/, prints
each path's description, owner, consumers and recovery path, and marks
any missing them. Metadata only, never a value, so it runs under
ops-mason-build and can be handed to anyone orienting themselves. First
run: 21 paths, 17 undescribed.
Described the four this session touched, including on_loss — the field
whose absence meant the LLDAP predecessor's recovery path had to be
worked out from first principles while locked out.
ops-mason-build gains create/update on */metadata/*, since a description
is documentation rather than a value. delete stays absent: deleting a
metadata entry destroys every version of the secret beneath it.
It also now denies itself sys/policies/acl/ops-mason-build. Without that
the policy was advisory — a token that can write policies can delete its
own denials, so the claim that OpenBao enforces "never read a value" was
not true as written. An exact path outranks the glob, so changing what
ops-mason may do is now an operator act, visible as one in the audit log.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
tegwick
d020413d7a