ops-mason/docs/evidence/2026-09-28-loose-end-review.md

Loose-end review — 2026-09-28

Reviewed every local workplan. MASON-0001 and MASON-WP-0001–0003 are finished; no open task in those files needs implementation. The three proposed workplans, MASON-WP-0004–0006, contain the remaining work. No new task or workplan was opened. Existing uncommitted intake, Telegram construction-plan, and lockfile work was left outside this change.

MASON-WP-0006

T01 is answered by founder decision in the-custodian/docs/kubernetes-change-gate-decision.md, communicated by message b41bd54f-a7a4-41e5-a1ee-aa9b0efa7dc5: whitehat is explicitly non-production. The same decision and current agent orientation establish that ArgoCD has since been installed; the blanket absence-of-ArgoCD transition is obsolete.

T02–T05 implemented in the readiness resolver, bundle, CLI, evidence and docs. Validation: 54 tests pass (.venv/bin/pytest -q), including a real temporary Git history that promotes then reverts a binding; git diff --check passes. Tests exercise approved and refused apply, explicit whitehat placement, binding supersession, stale/missing sources, namespace mapping, historical production approval, deprecation, the December 21 boundary, and emergency reason/evidence. Existing manifest and approval refusals remain covered. Secret-presence verification now requests object names, never Secret JSON.

A read-only local source check resolves the actual whitehat bundle to non-production under APPROVED, using reef-railiance commit e3c5ca2b74f6ae4f3b79f918708f3b573157a0c2, bindings SHA-256 796007c68f0eda1d50cebddf9e11a2c123a8814ebaf67f739ed5d2af2d6fa3f1. No Kubernetes command or deployment was needed for this implementation.

T06 stays wait: its review is due 2026-12-21 and requires platform confirmation of policy-nexus GitOps adoption and review of the accepted plan-approval exception. The workplan remains blocked, not finished; the existing task holds this obligation.

MASON-WP-0004

The session check at http://127.0.0.1:18200 reports no valid caller session and no scoped ops-mason grant. No credential value was requested. The original 21-path/17-undescribed inventory has no saved path-level snapshot in this repo; source documents cannot prove the current live path set or completeness. T01–T03 therefore remain wait for an attended scoped metadata grant, current inventory, and owner confirmations. No ownership or recovery story is invented.

Source-backed candidates for the next T01 inventory comparison:

Path or family	Proposed responsible repo	Evidence / unresolved question
operators/lldap/admin	net-kingdom	platform-root-custody.md; confirm current consumers and recovery
operators/privacyidea/pi-admin	net-kingdom	platform-root-custody.md and verify-t06.md; confirm recovery ownership
operators/forgejo/state-hub-svc	railiance-platform	MASON-WP-0003 construction/delivery record; confirm active metadata
platform/workloads/railiance/backup/object-storage	railiance-platform	plans/backup-object-storage.md
platform/workloads/railiance/backup/offsite-lane	railiance-platform	ops-warden catalog railiance-backup-offsite-lane
platform/workloads/railiance/scaleway/bootstrap	railiance-platform	plans/reef-storage-scaleway-bootstrap.md
user-engine/runtime and rapp-qonto families	owning consumer plus railiance-platform custody	corresponding plans in this repo; exact current paths need live inventory
reuse-surface/runtime-secrets	reuse-surface plus railiance-platform custody	cited by T02; current owner procedure still needs confirmation

These are candidates, not accepted custom_metadata, and do not enumerate the missing seventeen. Every additional live path needs an owner or a named unknown before T01 can close.

T04 preparation fixes an actual false-success defect: an unavailable/denied metadata request previously returned an empty list and exit 0. The inventory now exits 2 on missing grant, command failure or malformed response, exits 1 for missing descriptions, and reserves 0 for a completed inventory. It refuses to fall back silently to the user's default token. The default Bao address in both helpers now follows the private tunnel. Tests cover failure reporting and metadata-only traversal. Running it without a grant returned the expected explicit error, not a fictitious healthy inventory.

Scheduled reporting remains blocked on T03 and a named reader plus a non-interactive metadata-only credential. No existing scheduler for this repo was found; a 45-minute interactive grant cannot support a durable schedule.

MASON-WP-0005

The September 9 platform reply (c0977d84-9a63-421d-8ee1-98587fc60b1b) and railiance-platform/docs/credential-lane-designs/fluid-telegram-operator-kv.md confirm a proposed matrix, not an accepted writer contract. Tenant/path, field/capability acceptance, actual OIDC group/MFA and callbacks, named writer authority, matching platform validator/renderer, and live survey remain open. The existing ops-mason grant does not authorize auth/netkingdom role changes; it must not be widened to bypass this boundary.

T01–T05 remain wait for those inputs and explicit construction approval. T02 cannot be called done by shipping an unapproved engine shape: the owner requires matching approved CCR and builder contracts before any writer. T06 also waits for verification and routing-owner acceptance; no live lane or resolvable pointer is claimed. Local draft preparation remains in the existing construction plan. The separate adapter demand stays in its existing intake.