From 102668f089cc5fe17d7d36c49e6e9dfe6cf12212 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 18 Oct 2026 12:44:23 +0200 Subject: [PATCH] CCR-2026-0051: ops-mason apply evidence (policy + kubernetes role) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f --- .../CCR-2026-0051-mas-tem-relay-smtp.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml index 0b5cf21..7bbe8e7 100644 --- a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml +++ b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml @@ -97,7 +97,21 @@ verification: - Founder, platform owner and consumer owner approve the exact CCR. - Native bound claims confirmed (confirm-binding) and native policy/role readback matches source. - evidence: [] + evidence: + - at: '2026-10-18T10:44:23+00:00' + actor: ops-mason (claude-MASON-WP-0014-T03, ops-mason-construct) + kind: apply + result: success + details: + - '2026-10-18: policy workload-kv-read-mas-tem-relay written from openbao/policies/workload-kv-read-mas-tem-relay.hcl; + read back byte-equal' + - 'kubernetes role external-secrets-mas-tem-relay written: SA mas-tem-relay-eso, + ns mas, audience openbao, token_policies [workload-kv-read-mas-tem-relay], ttl/max/explicit_max + 15m, token_no_default_policy true; read back matches CCR' + - KV platform/suppliers/scaleway/mas-tem-relay present (v2, founder-written); + no value read + - 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false); + confirm-binding and ESO sync next' lifecycle: deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.