1.6 KiB
1.6 KiB
SCOPE
One-liner
Builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down OpenBao AppRoles, policies, and KV secret paths so ops-warden always has something real to route to.
Core Idea
Four-phase process: (1) construction plan — respect/extend/compact existing structure before proposing new; (2) review/optimize against what already exists; (3) executive summary — the one mandatory human decision gate, in plain terms; (4) build, only after approval.
In Scope
- Construction plans for new/changed/retired OpenBao AppRoles, policies, KV secret paths
- Consistency review — reuse over duplication, compaction over sprawl
- The executive-summary format that makes a plan decidable at a glance
- Registering what it builds into ops-warden's routing catalog
- Its own audit trail of what it built, under which approved plan
Out of Scope
- Deciding whether access should exist — that's architecture/founder, ops-mason builds what's already decided
- Runtime authorization decisions — flex-auth
- Identity/MFA — key-cape/Keycloak
- Routing consumers to lanes once built — ops-warden
- SSH certificate issuance — ops-warden
- OpenBao cluster init/unseal, platform deploy — railiance-platform
- Holding or logging secret values, ever
Current State
Charter only (INTENT.md). MASON-WP-0001 scopes the four-phase
pipeline and its first real exercise: the rein-openweights OpenBao
AppRole that glas-harness/GLAS-WP-0002-T02 is blocked on. No code yet.
Getting Oriented
- Start with:
INTENT.md - Agent instructions:
AGENTS.md - Workplans:
workplans/