tegwick 482a08b40e MASON-WP-0015-T03: deny comma-string token_policies in ops-mason-construct ... Live probe showed token_policies=workload-kv-read-x,default passes the workload-kv-read-* glob as one string. Login denies held; this closes the role-policy limit. Reinstall required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f		2026-10-18 11:59:04 +02:00
..
retired	Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004)	2026-10-07 10:44:24 +02:00
operator-custody.hcl	feat(mason): operators/ custody mount and its access policy	2026-08-28 11:18:06 +02:00
ops-mason-construct.hcl	MASON-WP-0015-T03: deny comma-string token_policies in ops-mason-construct	2026-10-18 11:59:04 +02:00
ops-mason-survey.hcl	WP-0009-T05 invariant (ii) verified; survey policy covers keycape-services roles; Forgejo plan re-rendered	2026-10-10 14:13:02 +02:00