coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
202 commits 1 branch 0 tags 2.4 MiB
Find a file
custodian-sync 5397ecb2cd chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-09:
  - update .custodian-brief.md for ops-mason

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
2026-10-09 19:42:29 +02:00
bundles Enforce readiness tiers and reconcile blocked workplans 2026-09-28 11:40:57 +02:00
docs MASON-WP-0004-T01 done: founder rulings on tenant conflict and unclear paths 2026-10-09 11:02:47 +02:00
intakes MASON-IN-0003: ask fluid-telegram for the adapter deployment identity 2026-10-09 10:45:03 +02:00
manifests plan --case: explicit reference-case render; WP-0005-T04 done; factor-issuer described 2026-10-09 19:42:02 +02:00
plans MASON-WP-0005-T03 done: founder approved the fluid-telegram operator lane 2026-10-09 00:45:03 +02:00
policies Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004) 2026-10-07 10:44:24 +02:00
scripts MASON-WP-0004-T02: 27/29 descriptions applied; clip to OpenBao's byte limit 2026-10-09 12:09:52 +02:00
src/ops_mason plan --case: explicit reference-case render; WP-0005-T04 done; factor-issuer described 2026-10-09 19:42:02 +02:00
tests plan --case: explicit reference-case render; WP-0005-T04 done; factor-issuer described 2026-10-09 19:42:02 +02:00
workplans plan --case: explicit reference-case render; WP-0005-T04 done; factor-issuer described 2026-10-09 19:42:02 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-10-09 19:42:29 +02:00
.gitignore intake: hand off legacy MASON identifier scheme 2026-08-22 11:33:34 +02:00
.repo-classification.yaml chore(registrar): bind MASON-IN-0001 residual 2026-08-22 11:34:25 +02:00
AGENTS.md Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004) 2026-10-07 10:44:24 +02:00
INTENT.md Replace ops-mason-build with read-only ops-mason-survey grant (MASON-IN-0004) 2026-10-07 10:44:24 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:42:40 +02:00
pyproject.toml build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00
README.md build: add guarded Kubernetes plane executor 2026-08-22 11:23:38 +02:00
SCOPE.md Bind OpenBao builds to approved inputs and secure credential delivery 2026-09-28 11:55:39 +02:00
WORK-RECORDS.md chore(consistency): refresh WORK-RECORDS after sync 2026-10-09 19:02:19 +02:00

README.md

ops-mason

The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.

The four-phase process

  1. Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
  2. Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
  3. Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
  4. Build — once approved, execute the plan.

See INTENT.md for the full responsibility boundary against ops-warden, OpenBao, flex-auth, and key-cape.

Guarded Kubernetes planes

Small Kubernetes security foundations can use the fail-closed ops-mason plane workflow. It pins source manifests and object identities, validates cluster context/RBAC/dependencies/drift, requires an approved construction plan plus exact digest for apply, and produces metadata-only evidence and a non-executing rollback plan.

See docs/kubernetes-plane.md.