tegwick
2b318634b6
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# ops-mason
|
|
|
|
The builder of NetKingdom security infrastructure — creates, changes,
|
|
maintains, and tears down access routes, credentials, tokens, and policies
|
|
so that ops-warden always has something real to route to.
|
|
|
|
- Why and boundaries: [INTENT.md](INTENT.md)
|
|
- Current work: [workplans/](workplans/)
|
|
|
|
## The four-phase process
|
|
|
|
1. **Construction plan** — given an access demand, draft what needs
|
|
building, respecting/extending/compacting existing structure first.
|
|
2. **Review and optimize** — self-review the plan against what already
|
|
exists, for consistency and ease of use.
|
|
3. **Executive summary** — the one mandatory human decision gate: render
|
|
who gets what access, for how long, and what it costs to reverse.
|
|
4. **Build** — once approved, execute the plan.
|
|
|
|
See `INTENT.md` for the full responsibility boundary against ops-warden,
|
|
OpenBao, flex-auth, and key-cape.
|
|
|
|
## Guarded Kubernetes planes
|
|
|
|
Small Kubernetes security foundations can use the fail-closed `ops-mason
|
|
plane` workflow. It pins source manifests and object identities, validates
|
|
cluster context/RBAC/dependencies/drift, requires an approved construction
|
|
plan plus exact digest for apply, and produces metadata-only evidence and a
|
|
non-executing rollback plan.
|
|
|
|
See [docs/kubernetes-plane.md](docs/kubernetes-plane.md).
|