The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
tegwick
33573a35a1
Ran the whole approved pipeline against real OpenBao: created the reins/ KV v2 mount (after pausing for explicit founder confirmation -- a bigger action than the executive summary's blast-radius framing disclosed), the read-only policy, the AppRole, delivered role_id/secret_id. Caught and fixed a real bug in the same pass: built with token_num_uses=0 (OpenBao's default = unlimited) instead of the plan's own stated 8; fixed live and removed the executor's silently-permissive default so it can't recur. Catalog entry proposed and merged in ops-warden (c0a50bc). Corrected a real misreading in this repo's own INTENT.md along the way: pointer fields (auth_method/fetch_command/rotation.steps) are normal on non-SSH catalog entries; only a bare top-level steps:+cert_command: pair is SSH-only -- verified against ops-warden's real entries and its full test suite (326 tests, green). Plan status: built. Catalog entry status: draft until the founder's paste-once-provision and glas-harness/GLAS-WP-0002-T02's live verification succeed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| docs | ||
| plans | ||
| src/ops_mason | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| AGENTS.md | ||
| INTENT.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
ops-mason
The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.
- Why and boundaries: INTENT.md
- Current work: workplans/
The four-phase process
- Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
- Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
- Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
- Build — once approved, execute the plan.
See INTENT.md for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.