coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/openbao-structure-survey.md
tegwick 139f77dd55 Route OpenBao configuration and provisioning away from the structure survey 
Configuration intent (policies, auth roles) routes to the attended
openbao-platform-admin-login lane and value provisioning to openbao-api-key
custody; both fail closed when their front door is missing. The survey lane
now points at ops-mason's read-only ops-mason-survey grant (MASON-IN-0004).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327285@bnt-lap001
Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
2026-10-08 23:21:46 +02:00

1.3 KiB
Raw Blame History

OpenBao existing-structure survey (construction plan section 2)

Catalog: openbao-structure-survey (status active, pointer only) Owner: ops-mason — scripts/plan-survey.py, docs/construction-plan-format.md § 2 Routing records: WARDEN-WP-0042, WARDEN-WP-0043; owner change: ops-mason/MASON-IN-0004 (2026-10-07)

ops-warden routes this need and does nothing else. It holds no survey code and no OpenBao token; the survey runs under ops-mason's own scoped ops-mason-survey read-only grant, which reads structure metadata and is denied every secret value.

Worker checklist

  1. Ask the founder for an ops-mason grant for the task. The founder runs ./scripts/bao-session.sh grant <task> in ~/ops-mason; an agent does not log in or grant.
  2. Run ./scripts/plan-survey.py in ~/ops-mason with the demand's KV path, proposed policy, role and consumer, exactly as documented in ops-mason/docs/construction-plan-format.md § 2.
  3. Paste its output as section 2 of the plan and turn the draft answer into a reviewed one.

Anything the grant refuses is ops-mason's to resolve with the founder; do not reach for a broader session through ops-warden.

The builder grant was retired by MASON-IN-0004. Surveys cannot apply policies or auth roles; reviewed structure changes belong to railiance-platform's delegated metadata applier.