The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
tegwick
4c0ada21ca
Minted on a dedicated identity rather than a site admin. A PAT on tegwick would have read every repository on the instance — wider than the approved organisation-wide breadth and wider than the plan's stated blast radius. Built as user state-hub-svc in team coulomb/state-hub-read (read, all repositories, repo.code unit only), following the existing issue-core-svc precedent. The ceiling is enforced by org membership, not by a scope string, and clones are attributable to a named identity. Delivered by warden desk --act paste_once_provision; ops-mason neither minted nor pasted the value. Verified: rapp-openbao, rapp-core-hub, rapp-issue-core and rapp-policy-nexus all read — four of the nine that failed STATE-WP-0083-T04. Push 403, admin API 403, /api/v1/user 403 (the scope carries no read:user). Clone test used GIT_ASKPASS, so no credential entered argv or a clone URL. Records a deviation rather than glossing it: SCOPE.md puts secret values out of scope, and that held for minting and delivery but not for verification — the value was read back to fingerprint it and to run the clone test, under the build-stage disclosure posture agreed 2026-08-27. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 |
||
|---|---|---|
| bundles | ||
| docs | ||
| intakes | ||
| manifests/whitehat-plane | ||
| plans | ||
| src/ops_mason | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
ops-mason
The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.
- Why and boundaries: INTENT.md
- Current work: workplans/
The four-phase process
- Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
- Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
- Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
- Build — once approved, execute the plan.
See INTENT.md for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
Guarded Kubernetes planes
Small Kubernetes security foundations can use the fail-closed ops-mason plane workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.