tegwick
969fe218df
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
65 lines
3.4 KiB
JSON
65 lines
3.4 KiB
JSON
{
|
|
"at": "2026-10-11",
|
|
"facts": [
|
|
"Neither exact custody lane policy grants sys/capabilities-self; no default policy. Existing survey sys/capabilities queries lane tokens in memory.",
|
|
"Existing survey source receipt display_name is token-claude-MASON-WP-0009-T04; required T05 grant is token-claude-MASON-WP-0009-T05.",
|
|
"ESO lifecycle uses separately issued ServiceAccount TokenRequest JWT, not controller or Secret token.",
|
|
"Nonmember CLI failure never accepted; independently trusted identity and same-flow owner-correlated groups refusal still required.",
|
|
"Previously accepted service JWT positive/login/revoke proofs retained; new preparation is distinct custody-reader evidence."
|
|
],
|
|
"founder_native_disposition": "not-yet-recorded",
|
|
"native_result": "not-run",
|
|
"owner_source_review": "not-yet-performed",
|
|
"preparation_result": "corrected-source-preparation",
|
|
"prepared_by": "custodian-codex delegated preparation for ops-mason; no owner authority assumed",
|
|
"previous_manifest_sha256": "e5d4781c6280c3bc8a3930c63cfb563f59752465720d6c2c3e95eb0551f8e949",
|
|
"prior_outcome": "independent source changes_requested; not native success",
|
|
"proposal_id": "MASON-WP-0009-T05-native-capability-proof-20261011",
|
|
"refinements": [
|
|
"endpoint-specific HTTP status/content/body/object/error handling; revoke only204empty",
|
|
"nonempty typed bounded native accessors; recovered-token cleanup",
|
|
"positive-integer TTL",
|
|
"incrementally bounded subprocess capture; no unbounded PIPE claim",
|
|
"approved digest guard before token/receipt/native IO"
|
|
],
|
|
"remaining_gates": [
|
|
"ops-mason owner formal exact-source review",
|
|
"supervisor exact source disposition and founder scoped native attendance",
|
|
"operator native capability matrix with cleanup",
|
|
"ESO native capability matrix with cleanup; platform TokenRequest approval",
|
|
"key-cape validated same-attempt human/nonmember/aal2 evidence and platform correlated bound-group refusal",
|
|
"ops-mason native owner acceptance and ops-warden pointer activation"
|
|
],
|
|
"routing": {
|
|
"initial_default_memory_append_failed_outside_sandbox": true,
|
|
"memory_disabled_read_succeeded": true,
|
|
"mode": "pointer",
|
|
"route": "openbao-structure-survey",
|
|
"warden_executes": false
|
|
},
|
|
"safety": {
|
|
"commits": 0,
|
|
"credential_reads": 0,
|
|
"credential_requests": 0,
|
|
"foreign_owner_reviews": 0,
|
|
"native_actions": 0,
|
|
"owner_checkout_writes": 0,
|
|
"policy_widening": 0,
|
|
"pushes": 0,
|
|
"secret_gets": 0
|
|
},
|
|
"schema": "mason-native-preparation/v1",
|
|
"source_scope": "existing MASON-WP-0009-T05 only; source preparation, no live acceptance; unrelated WORK-RECORDS.md and ADHOC-2026-10-11.md preserved",
|
|
"source_sha256": {
|
|
"docs/keycape-client-custody-attended-verification.md": "554d20f722c13742eb86460991df420035cec11a469fef09e09567a64e07b247",
|
|
"scripts/verify-keycape-client-custody.py": "f7685646dca48db5874174940c1826db186e1ed73e167814d8c0f37af3ad619c",
|
|
"tests/test_keycape_client_custody_verifier.py": "ad981635eb97f48ca2e092cdbcb6e47007d89eb272a85578485dbb299bb7c479",
|
|
"workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md": "9bea9cb4f2619c42a6cf3a7cf1fb14edc8539d702c437939b397ad9ebe1ce7d6"
|
|
},
|
|
"task": "MASON-WP-0009-T05",
|
|
"verification": {
|
|
"command": "python3 -m unittest discover -s /tmp/mason-jwt-capability-next-stage-v2/ops-mason/tests -q",
|
|
"result": "passed-offline",
|
|
"tests": 29
|
|
}
|
|
}
|