ops-mason/AGENTS.md

ops-mason — Agent Instructions

Repo Identity

Purpose: Builder of NetKingdom security infrastructure (AppRoles, policies, KV paths) for ops-warden to route to

Domain: infotech Repo slug: ops-mason Topic ID: cee7bedf-2b48-46ef-8601-006474f2ad7a Workplan prefix: MASON-

---

State Hub Integration

The Custodian State Hub tracks work across all domains. Interact via HTTP REST — there is no MCP server for Codex agents.

Context	URL
Local workstation	http://127.0.0.1:8000
Remote (railiance01, in-cluster)	http://10.43.68.154:8000
Optional local edge relay	http://127.0.0.1:18080

When an operator has enabled the edge relay, set API_BASE to the relay URL. Queueable writes return an explicit queued receipt if the central hub is unreachable. Treat that as pending local evidence, then ask the operator to run statehub outbox status/replay after connectivity returns.

Orient at session start

# Offline brief — works without hub connection
cat .custodian-brief.md

# Active workplans for this domain
curl -s "http://127.0.0.1:8000/workplans/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
  | python3 -m json.tool

# Check inbox
curl -s "http://127.0.0.1:8000/messages/?to_agent=ops-mason&unread_only=true" \
  | python3 -m json.tool

Mark a message read:

curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
  -H "Content-Type: application/json" -d '{}'

Log progress (required at session close)

curl -s -X POST http://127.0.0.1:8000/progress/ \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "what was done",
    "event_type": "note",
    "author": "codex",
    "workplan_id": "<uuid>",
    "task_id": "<uuid>"
  }'

Omit workplan_id / task_id when not applicable.

Update task status

curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"status": "progress"}'
# values: wait | todo | progress | done | cancel

Flag a task for human review

curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
  -H "Content-Type: application/json" \
  -d '{"needs_human": true, "intervention_note": "reason"}'

---

Session Protocol

Start:

1. cat .custodian-brief.md — domain goal and open workplans (offline-safe)
2. Check inbox: GET /messages/?to_agent=ops-mason&unread_only=true; mark read
3. Scan workplans: ls workplans/ — note status: ready, active, or blocked files and open tasks
4. Check human-needed tasks: GET /tasks/?needs_human=true

During work:

• Update task statuses in workplan files as tasks progress
• Record significant decisions via POST /decisions/

Close:

1. Update workplan file task statuses to reflect progress
2. If finishing a workplan: hand off residuals as live work records first (intake with origin: residual + origin_ref: <WP-id>, or a next workplan / decision / engagement). Do not park leftovers only in prose or SCOPE.md. Canon: the-custodian/canon/standards/work-record-types_v0.1.md § Residuals.
3. Log: POST /progress/ with a summary of what changed (name handoff ids)
4. After workplan file changes, run:

   statehub fix-consistency
   

   Coding agents should run this directly; ask the operator only if the CLI or State Hub API is unavailable. This syncs task status from files into the hub DB.

---

Credential and access routing

Audience: Codex, Claude Code, Grok, and custodian agents that call llm-connect for inference. Run this check before requesting secrets, API keys, SSH access, login tokens, or database passwords — in any repo, not only ops-warden.

ops-warden issues SSH certificates only (warden sign, cert_command). Every other credential need belongs to another subsystem. Do not message ops-warden on State Hub expecting a secret value; the reply is a pointer, not a key.

Lookup (do this first)

warden route find "<describe your need>" --json
warden route show <catalog-id> --json

Requires the warden CLI from ~/ops-warden (uv tool install . or uv run warden).

Agent runtime	How to orient
Codex / Grok (shell, HTTP State Hub)	warden route commands above; inbox to_agent=ops-mason is for coordination, not secret vending
Claude Code (MCP when available)	get_domain_summary("custodian") for workplans; still use warden route for credential ownership
llm-connect (inference service)	Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by warden route

Quick routing table

I need…	Owner	ops-warden executes?
SSH cert (adm/agt/atm)	ops-warden	Yes — warden sign
API key, DB password, provider token	OpenBao (railiance-platform)	No — route only
Login / OIDC / MFA	key-cape / Keycloak	No — route only
Authorization decision	flex-auth	No — route only
activity-core → issue-core emission	activity-core + issue-core	No — warden route show activity-core-issue-sink
SSH tunnel	ops-bridge (+ cert_command from warden)	No — route only

Anti-patterns (do not do these)

• POST /messages/ to ops-warden asking for ISSUE_CORE_API_KEY, OPENROUTER_API_KEY, etc.
• Inventing warden secret, warden login, warden bao, warden tunnel — they do not exist
• Pasting secrets into Git, State Hub, workplans, logs, or chat

Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through reuse-surface federation (reuse-surface registry / capability.* indexes). Credential routing is inlined in every repo's agent instructions because it is high-frequency, high-risk, and easy to get wrong.

Canon: ~/ops-warden/wiki/CredentialRouting.md · catalog ~/ops-warden/registry/routing/catalog.yaml

Secrets practice guide

From 2026-10-11, secrets practice follows SecurityCanon SEC-DSM 1.0.0:

../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md

Gate House teaches that standard. This repo builds routes inside it. Read these parts before proposing a credential:

• §5 preference hierarchy, highest practical mechanism first
• §37 decision procedure, questions Q1 through Q5, in order
• §35 OpenBao/Vault mapping — a broker is not the default store for every value
• §36 Kubernetes mapping — projected workload identity before a secret broker; Kubernetes Secrets are a delivery copy, not the authority
• DSM-ARCH-001 through DSM-ARCH-004, DSM-TRANS-002, DSM-TRANS-003, DSM-K8S-001 through DSM-K8S-004

A new static secret, AppRole, or KV path is allowed when Q1–Q3 are no. The plan records that answer, the owner, the consumers, the authority, and how the residual secret is rotated and revoked (DSM-TRANS-002). Do not add an issuance layer only to look dynamic (DSM-TRANS-003). Do not put secret values in the plan, the workplan, or chat.

---

Workplan Convention (ADR-001)

Work items originate as files in this repo — not in the hub. The hub is a read/cache/index layer that rebuilds from files.

File location: workplans/MASON-NNNN-<slug>.md

Archived location: finished workplans may move to workplans/archived/YYMMDD-MASON-NNNN-<slug>.md. The YYMMDD prefix is the completion/archive date; the frontmatter id does not change.

Ad Hoc Tasks: small opportunistic fixes discovered during a session use workplans/ADHOC-YYYY-MM-DD.md with task ids ADHOC-YYYY-MM-DD-T01, etc. Use this only for low-risk work completed directly; create a normal workplan for anything needing analysis, design, approval, dependencies, or multiple phases.

Frontmatter:

---
id: MASON-NNNN
type: workplan
title: "..."
domain: infotech
repo: ops-mason
status: proposed | ready | active | blocked | backlog | finished | archived
owner: codex
topic_slug: ...
created: "YYYY-MM-DD"
updated: "YYYY-MM-DD"
state_hub_workstream_id: "<uuid>"   # fix-consistency — do not edit (legacy field name; workplan UUID)
---

Use proposed for a new draft, ready after review against current repo state, and finished after implementation. stalled and needs_review are derived health labels, not frontmatter statuses.

Terminology: workplan is the fleet term; workstream appears only in legacy API/MCP/frontmatter bridges until STATE-WP-0069 retires them — see the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md.

Task block format (one per ## section):

## Task Title

` ` `task
id: MASON-NNNN-T01
status: wait | todo | progress | done | cancel
priority: high | medium | low
state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
` ` `

Task description text.

Status progression: todo → progress → done; use wait for waiting/blocked work and cancel for stopped work.

Residuals when finishing: actionable leftovers become live work records before status: finished — usually an intake (origin: residual, origin_ref: MASON-NNNN) or a spawned workplan. Residual is a role, not a kind. Fleet list lives on State Hub, not in SCOPE.md.

To create a new workplan:

1. Write the file following the format above
2. Run statehub fix-consistency locally; ask the operator only if the CLI or State Hub API is unavailable.

OpenBao Access — how to grant a session, and what it authorises

ops-mason builds in OpenBao, so it needs a session. Do not hand it your own operator session: that gives everything you have, for as long as you have it, and every action lands in the audit log as you.

./scripts/bao-session.sh status          # what session exists, if any
./scripts/bao-session.sh login           # refresh YOUR operator session (OIDC)
./scripts/bao-session.sh grant <task>    # mint a scoped token for Claude
./scripts/bao-session.sh revoke          # end it immediately

With a grant in place, generate a construction plan's section 2 with ./scripts/plan-survey.py --kv-path <path> --policy <name> --approle <role> --consumer <repo> [--keyword <word>] (metadata only; see docs/construction-plan-format.md § 2).

grant mints a separate token into ~/.claude-bao-token — your own ~/.vault-token is untouched, and the two revoke independently. The agent uses it as BAO_TOKEN=$(cat ~/.claude-bao-token) bao <cmd>.

What the grant authorises

Policy ops-mason-survey (policies/ops-mason-survey.hcl), 45 minutes, max one hour, named claude-<task>. Read-only (MASON-IN-0004, 2026-10-07); used for surveys. Building uses the separate build grant below (MASON-IN-0005). ops-mason-build stays in policies/retired/, never to be installed.

Allowed	Denied / not granted
read/list sys/mounts, sys/auth; list sys/policies/acl, read sys/policies/acl/* — the phase-2 survey	any policy write (no create/update/delete on sys/policies/acl/*; explicit deny on its own policy)
read/list role definitions on auth/kubernetes/role/*, auth/netkingdom/role/*, auth/jwt/role/*; list auth/approle/role, read auth/approle/role/<name>	any auth-role write; AppRole role-id, secret-id, secret-id/*, secret-id-accessor/*, custom-secret-id (explicit deny)
read/list KV metadata on platform/, operators/ — enough to confirm a delivery landed	every */data/* on platform, operators, secret (explicit deny); KV metadata writes
sys/capabilities, sys/capabilities-self (query only), auth/token/lookup-self, auth/token/revoke-self	token creation of any kind; revoking other tokens; sys/mounts/*

The grant can show what exists and prove what a token can reach; it cannot change anything. That removes the escalation MASON-IN-0004 described — write a policy without the denies, bind it to an AppRole, read the role-id, mint a secret-id, log in — because none of those steps is granted.

Installing the survey policy (founder act)

ops-mason cannot install its own grant. The founder runs, silently and with an absolute path (the warden wrapper refuses output and runs with a temporary HOME):

warden access openbao-platform-admin-login --exec -- sh -c \
  'bao policy write ops-mason-survey /home/worsch/ops-mason/policies/ops-mason-survey.hcl >/dev/null 2>&1'

Silent check — the installed policy's hash into a 0600 receipt, compared with the repo file's hash outside the wrapper:

warden access openbao-platform-admin-login --exec -- sh -c \
  'umask 077; mkdir -p /home/worsch/.local/state/railiance/receipts; bao policy read ops-mason-survey 2>/dev/null | sha256sum > /home/worsch/.local/state/railiance/receipts/ops-mason-survey.sha256'
cat /home/worsch/.local/state/railiance/receipts/ops-mason-survey.sha256
sha256sum < /home/worsch/ops-mason/policies/ops-mason-survey.hcl

The two hashes match only if OpenBao returns the file byte-for-byte; if they differ, compare the stored text against the file before concluding the install is wrong (OpenBao may normalise a trailing newline).

Choosing the task name

grant <task> sets display_name=claude-<task>, so the audit log attributes an action to a piece of work rather than to a person. Use the workplan task where there is one — grant MASON-WP-0003-T02 — otherwise something a reader would recognise later.

The build grant (MASON-IN-0005)

ops-mason is the builder. After a plan is approved, the founder mints the build grant:

./scripts/bao-session.sh build <plan-task>   # ops-mason-construct, 45m, claude-<task>

Policy ops-mason-construct (policies/ops-mason-construct.hcl). It includes everything the survey grant can do, plus:

Allowed	Still denied
create/update/delete sys/policies/acl/workload-kv-read-*	every other policy; default, root, ops-mason-* (explicit deny)
create/update/delete auth/kubernetes/role/external-secrets-* and AppRole role definitions, with token_policies limited to workload-kv-read-*	AppRole role-id, secret-id*, custom-secret-id; auth/token/create*
create (no read or update) on platform/data/{workloads,suppliers}/*, so placeholders only	reading any */data/*; overwriting an existing value
full metadata on platform/metadata/{workloads,suppliers}/* (describe, tear down)	sys/mounts/*, sys/auth/*, operators/ and secret/ writes

The grant can build a lane but can never log in as one, which keeps the MASON-IN-0004 chain broken. AppRole secret-id delivery stays a founder act; Kubernetes-auth lanes need no secret-id. After every build, compare the written policy text with the plan's policy file (MASON-WP-0015-T04).

Install it the same way as the survey policy, with ops-mason-construct and its file path.

When a broader grant is genuinely needed

Minting a secret-id or a token, enabling a mount, reading a value, a policy outside workload-kv-read-*, or another subsystem's paths is outside both grants on purpose. Do not widen a policy to get past a refusal. Those acts go through the founder and the railiance-platform delegated applier (scripts/credential-change.py applier-apply under warden access openbao-platform-admin-login --exec), or need their own named policy and founder decision.