tegwick
e7a368af0f
Founder decision 2026-10-18, "build, but never log in": a plan-scoped grant
that writes workload-kv-read-* policies, external-secrets-* and AppRole role
definitions, and create-only placeholder KV under platform/{workloads,suppliers},
and denies role-id, secret-id, token creation and all value reads, so the
MASON-IN-0004 chain stays broken. Adds bao-session.sh build, policy tests,
INTENT/AGENTS alignment and MASON-WP-0015. Not installed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
|
||
|---|---|---|
| .. | ||
| ADHOC-2026-10-11.md | ||
| MASON-0001-statehub-bootstrap.md | ||
| MASON-WP-0001-foundation.md | ||
| MASON-WP-0002-whitehat-foundational-plane.md | ||
| MASON-WP-0003-state-hub-forge-read-lane.md | ||
| MASON-WP-0004-credential-inventory-descriptions.md | ||
| MASON-WP-0005-fluid-telegram-operator-credential-lane.md | ||
| MASON-WP-0006-readiness-tier-check.md | ||
| MASON-WP-0007-tenant-engine-audit-core-sender-projection.md | ||
| MASON-WP-0008-plan-survey.md | ||
| MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md | ||
| MASON-WP-0010-security-case-materialization.md | ||
| MASON-WP-0011-reuse-surface-hub-writer.md | ||
| MASON-WP-0012-sign-in-diagnosis-caller-proof.md | ||
| MASON-WP-0013-reuse-surface-private-source-reader.md | ||
| MASON-WP-0014-mas-tem-relay-smtp.md | ||
| MASON-WP-0015-construct-grant.md | ||