The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
tegwick
7bd230c06a
operators/ enabled as KV v2; operator-custody grants read/write on it. Kept separate from platform-admin rather than folded in, though that would have been one stanza. platform-admin lists the mounts an administrator operates *on*; operators/ is the one mount an administrator keeps things *in*. Separating them lets custody move independently of administration, which is what the S6 trust stage (two-of-three independent recovery control) requires and which cannot be retrofitted once the grant is buried inside platform-admin. Delete is deliberately absent from the policy. A credential is retired by writing its successor, and KV v2 keeps the prior version — the history that did not exist when the LLDAP predecessor was overwritten in a browser password manager on 2026-08-27 and lost for good. ops-mason-build verified behaviourally, not just by capability strings: metadata reads succeed, `kv get` on the forge token returns permission denied, and enabling a mount returns permission denied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 |
||
|---|---|---|
| bundles | ||
| docs | ||
| intakes | ||
| manifests/whitehat-plane | ||
| plans | ||
| policies | ||
| scripts | ||
| src/ops_mason | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
ops-mason
The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.
- Why and boundaries: INTENT.md
- Current work: workplans/
The four-phase process
- Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
- Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
- Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
- Build — once approved, execute the plan.
See INTENT.md for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
Guarded Kubernetes planes
Small Kubernetes security foundations can use the fail-closed ops-mason plane workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.