From a53a55a9801fa27cb9f5b70fefe823d1d4bb1cde Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 13:21:22 +0200 Subject: [PATCH] WARDEN-WP-0042: route the OpenBao structure survey to ops-mason Pointer-only catalog entry openbao-structure-survey (warden_executes: false, owner ops-mason, ceremony lane, not exec_capable) pointing at ops-mason's ops-mason-build grant, scripts/plan-survey.py and construction-plan-format section 2, plus a short pointer playbook. ops-warden holds no survey code and no token. Routing-lane coverage re-measured: not_applicable 15 -> 16. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1170398@bnt-lap001 Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583 --- pep-stance.yaml | 4 +- registry/routing/catalog.yaml | 28 ++++++++++ tests/test_workload_join.py | 6 ++- wiki/playbooks/openbao-structure-survey.md | 24 +++++++++ ...-WP-0042-openbao-structure-survey-route.md | 52 +++++++++++++++++++ 5 files changed, 110 insertions(+), 4 deletions(-) create mode 100644 wiki/playbooks/openbao-structure-survey.md create mode 100644 workplans/WARDEN-WP-0042-openbao-structure-survey-route.md diff --git a/pep-stance.yaml b/pep-stance.yaml index b2e1b39..62eb0a5 100644 --- a/pep-stance.yaml +++ b/pep-stance.yaml @@ -94,7 +94,7 @@ on_apply: # a register that cannot detect its own staleness is only as good as the last # re-measure, and this one was stale by eight lanes before the test caught it. classification_coverage: - measured: "2026-10-03" + measured: "2026-10-05" attribution: self-measured signing_targets: resolved: 0 @@ -103,7 +103,7 @@ classification_coverage: routing_lanes: resolved: 4 unknown: 20 - not_applicable: 15 + not_applicable: 16 verdict_caching: none input_claim_caching: "registry/flex-auth/production_registry_snapshot.json, rebuilt by scripts/build_flex_auth_registry.py" diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index 3337836..8bacce2 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -1385,3 +1385,31 @@ entries: - "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists." - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat." - "Confirm metadata gone or version bumped; capabilities-safe only." + + - id: openbao-structure-survey + title: OpenBao existing-structure survey for a construction plan (section 2) + # Pointer only (WARDEN-WP-0042). Founder decision: ops-warden routes, + # ops-mason surveys. No survey code and no token live in ops-warden; the + # survey runs under ops-mason's own scoped ops-mason-build grant. + risk: high + workload_ref: + applicability: not-applicable + reason: "Attended builder survey under a founder-minted grant; reads OpenBao structure metadata, not a workload credential." + need_keywords: [survey, structure survey, openbao structure, existing structure, existing policies, existing lane, auth roles, approle roles, policy list, auth list, secrets list, construction plan, construction plan section 2, plan-survey, ops-mason-build] + owner_repo: ops-mason + subsystem: OpenBao structure metadata via ops-mason-build grant + warden_executes: false + wiki_ref: wiki/playbooks/openbao-structure-survey.md#worker-checklist + canon_ref: ops-mason/docs/construction-plan-format.md + reviewed: "2026-10-05" + status: active + delegation: + mode: native + intended_owner: ops-mason + reviewed: "2026-10-05" + verified: source-read + auth_method: "founder-minted scoped grant: ops-mason scripts/bao-session.sh grant (policy ops-mason-build, 45m, display_name claude-)" + exec_owner: ops-mason + exec_command: "ops-mason/scripts/plan-survey.py --kv-path --policy --approle --consumer --keyword " + exec_capable: false + lane: ceremony diff --git a/tests/test_workload_join.py b/tests/test_workload_join.py index 13d6fed..a398251 100644 --- a/tests/test_workload_join.py +++ b/tests/test_workload_join.py @@ -19,8 +19,10 @@ def test_repo_catalog_uses_only_explicit_workload_references(): # (c374d41) remain provider/control-plane credentials. Lanes added after # 2026-09-09 moved the denominator without moving `resolved`; these counts # and pep-stance.yaml's classification_coverage measure the same populations - # and must be updated together. - assert len(report["not_applicable"]) == 15 + # and must be updated together. 16 since 2026-10-05: the + # openbao-structure-survey pointer (WARDEN-WP-0042) is a builder survey + # under a founder-minted grant, not a workload credential. + assert len(report["not_applicable"]) == 16 assert {row["lane"] for row in report["resolved"]} == { "ops-warden-warden-sign-token", "issue-core-ingestion-api-key", diff --git a/wiki/playbooks/openbao-structure-survey.md b/wiki/playbooks/openbao-structure-survey.md new file mode 100644 index 0000000..62f17b5 --- /dev/null +++ b/wiki/playbooks/openbao-structure-survey.md @@ -0,0 +1,24 @@ +# OpenBao existing-structure survey (construction plan section 2) + +Catalog: `openbao-structure-survey` (status `active`, pointer only) +Owner: `ops-mason` — `scripts/plan-survey.py`, `docs/construction-plan-format.md` § 2 +Routing record: `WARDEN-WP-0042`; owner work: `ops-mason/MASON-WP-0008` + +ops-warden routes this need and does nothing else. It holds no survey code and +no OpenBao token; the survey runs under ops-mason's own scoped +`ops-mason-build` grant, which reads structure metadata and is denied every +secret value. + +## Worker checklist + +1. Ask the founder for an ops-mason grant for the task. The founder runs + `./scripts/bao-session.sh grant ` in `~/ops-mason`; an agent does not + log in or grant. +2. Run `./scripts/plan-survey.py` in `~/ops-mason` with the demand's KV path, + proposed policy, role and consumer, exactly as documented in + `ops-mason/docs/construction-plan-format.md` § 2. +3. Paste its output as section 2 of the plan and turn the draft answer into + a reviewed one. + +Anything the grant refuses is ops-mason's to resolve with the founder; do not +reach for a broader session through ops-warden. diff --git a/workplans/WARDEN-WP-0042-openbao-structure-survey-route.md b/workplans/WARDEN-WP-0042-openbao-structure-survey-route.md new file mode 100644 index 0000000..35e027f --- /dev/null +++ b/workplans/WARDEN-WP-0042-openbao-structure-survey-route.md @@ -0,0 +1,52 @@ +--- +id: WARDEN-WP-0042 +type: workplan +title: "Route the OpenBao existing-structure survey to ops-mason" +domain: infotech +repo: ops-warden +status: finished +flavor: implementation +owner: claude +topic_slug: netkingdom +created: "2026-10-05" +updated: "2026-10-05" +depends_on: [] +--- + +ops-mason construction plans need an existing-structure survey (section 2) +built from live OpenBao metadata. Founder decision: ops-warden routes, +ops-mason surveys. ops-mason implements `scripts/plan-survey.py` under its +own `ops-mason-build` grant (`ops-mason/MASON-WP-0008`). ops-warden gets no +survey code and no token, per the no-double-source rule +(`WARDEN-WP-0010`, `docs/adr/ADR-0001-catalog-is-a-pointer-layer.md`). + +## Add the pointer-only catalog entry + +```task +id: WARDEN-WP-0042-T01 +status: done +priority: medium +``` + +`registry/routing/catalog.yaml` entry `openbao-structure-survey`: owner +`ops-mason`, `warden_executes: false`, `exec_capable: false`, no `steps`, +native delegation to ops-mason, lane `ceremony` (the grant is a founder act), +`risk: high` (the grant can write policies and auth roles), `auth_method` +naming the ops-mason grant, `exec_owner`/`exec_command` pointing at the +survey script, `canon_ref` at `ops-mason/docs/construction-plan-format.md`. +Short pointer playbook `wiki/playbooks/openbao-structure-survey.md`. + +## Verify routing offline + +```task +id: WARDEN-WP-0042-T02 +status: done +priority: medium +``` + +`make test` passes, including catalog validation and layer conformance. +`warden access "openbao structure survey"`, `warden access "construction +plan section 2"` and `warden route find "existing policies auth roles +survey"` resolve to the entry; `warden plan` returns `founder_required` +with the survey command; `warden access ... --exec` refuses (not +exec_capable).