The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
codex
50d70004ea
The remote row pointed at 127.0.0.1:18000, a reverse tunnel back to the workstation. On railiance01 the State Hub runs in the cluster on that same machine, so the request left the box and came back to reach a local service. Refs CUST-WP-0067-T07 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 |
||
|---|---|---|
| bundles | ||
| docs | ||
| intakes | ||
| manifests/whitehat-plane | ||
| plans | ||
| src/ops_mason | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
ops-mason
The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.
- Why and boundaries: INTENT.md
- Current work: workplans/
The four-phase process
- Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
- Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
- Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
- Build — once approved, execute the plan.
See INTENT.md for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
Guarded Kubernetes planes
Small Kubernetes security foundations can use the fail-closed ops-mason plane workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.