tegwick 894761477f MASON-WP-0005-T01: bind key-cape's confirmed claims for the operator lane ... key-cape confirmed groups_claim=groups, bound group fluid-telegram-operators, assurance aal2 and the three openbao-admin callbacks. The OIDC executor now pins /assurance/level=aal2 (bound_claims_type=string) and accepts the exact operator-tunnel UI callback; the retired public UI callback stays refused. T01 now waits on the founder go for the LLDAP group and a scoped survey grant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0		2026-10-08 23:41:34 +02:00
..
test_bao_session.py	MASON-WP-0009-T04 done: live capability verification of the KeyCape secrets-engine-openbao lane	2026-10-07 13:47:14 +02:00
test_custody_inventory.py	Enforce readiness tiers and reconcile blocked workplans	2026-09-28 11:40:57 +02:00
test_executor.py	Bind OpenBao builds to approved inputs and secure credential delivery	2026-09-28 11:55:39 +02:00
test_kubernetes_plane.py	Enforce readiness tiers and reconcile blocked workplans	2026-09-28 11:40:57 +02:00
test_oidc_matrix.py	MASON-WP-0005-T01: bind key-cape's confirmed claims for the operator lane	2026-10-08 23:41:34 +02:00
test_plan.py	Bind OpenBao builds to approved inputs and secure credential delivery	2026-09-28 11:55:39 +02:00
test_plan_survey.py	Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004)	2026-10-07 10:44:24 +02:00