The agent responsible to create, change, maintain and tear down access routes with new credentials, tokens, policies, etc inside net-kingdom. Ops-mason is responsible to build the security infrastructure as required and defined by architecture documents as a base for ops-warden..
tegwick
84c36a6c26
Policy workload-kv-read-state-hub-forge-derivation and Kubernetes auth role state-hub-forge-derivation, verified both directions through a 2-minute test token that was revoked after use: read on its own path; deny on forgejo-admin, on the shared llm-connect provider secrets, and on the parent metadata path. Kubernetes auth replaces the approved AppRole. The plan's §2 survey was written from disk with no OpenBao session and could not see that kubernetes/ auth is enabled on this cluster; the plan's own phase-4 instruction to re-verify against live state is what surfaced it. Ruled by the founder at phase 4. No static credential is created, so nothing has to be delivered into the cluster or rotated. The live survey also re-checked reuse: workload-kv-read-agent-harness- forgejo grants one repository deploy key, not organisation-wide read, so §2's rejection of reuse stands. ops-mason handled no secret value. The KV path does not exist until paste_once_provision writes the token. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 |
||
|---|---|---|
| bundles | ||
| docs | ||
| intakes | ||
| manifests/whitehat-plane | ||
| plans | ||
| src/ops_mason | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| INTENT.md | ||
| LICENSE | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
ops-mason
The builder of NetKingdom security infrastructure — creates, changes, maintains, and tears down access routes, credentials, tokens, and policies so that ops-warden always has something real to route to.
- Why and boundaries: INTENT.md
- Current work: workplans/
The four-phase process
- Construction plan — given an access demand, draft what needs building, respecting/extending/compacting existing structure first.
- Review and optimize — self-review the plan against what already exists, for consistency and ease of use.
- Executive summary — the one mandatory human decision gate: render who gets what access, for how long, and what it costs to reverse.
- Build — once approved, execute the plan.
See INTENT.md for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
Guarded Kubernetes planes
Small Kubernetes security foundations can use the fail-closed ops-mason plane workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.