coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/examples/ops-warden
History
tegwick 9132f9b677
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details
FLEX-WP-0037: register ops-warden actor agt-custodian in the production registry 
Add agt-custodian (WARDEN-WP-0045) to examples/ops-warden/production_registry_snapshot.json
so flex-auth-ops-warden stops refusing it with unknown_actor_resource (CUST-WP-0073-T02).
Additions only; regenerated-inventory drift (agt-rehearsal, adm/codex zone fields) not taken.
Tests cover own-principal proceed and foreign-principal disallowed_principal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
2026-10-20 22:58:36 +02:00
..
check_request_allow_adm.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_allow_agt.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_allow_atm.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_actor_type_mismatch.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_disallowed_principal.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_missing_fingerprint.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_ttl_above_max.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_unknown_subject.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_wrong_tenant.json Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 2026-09-15 23:38:48 +02:00
policy_fixtures.yaml Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. 2026-09-15 23:38:48 +02:00
policy_package.md feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
production_registry_snapshot.json FLEX-WP-0037: register ops-warden actor agt-custodian in the production registry 2026-10-20 22:58:36 +02:00
protected_system_manifest.yaml FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
README.md FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020) 2026-10-10 13:26:19 +02:00
registry_snapshot.json feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
resource_manifest.yaml Audit package attribute reads and choose fact/assertion shape. 2026-09-14 04:47:52 +02:00
subject_manifest.yaml FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00

README.md

Ops-Warden SSH Signing Policy Gate

This example is the flex-auth side of ops-warden's opt-in pre-sign gate. When policy.enabled: true, ops-warden calls POST /v1/check before signing or issuing an SSH certificate.

Files:

  • protected_system_manifest.yaml declares the ops-warden protected system, ssh-certificate resource type, and sign action.
  • resource_manifest.yaml declares fixture SSH certificate actor resources and non-secret policy attributes such as allowed principals and TTL maxima.
  • subject_manifest.yaml declares non-secret fixture actors for adm, agt, and atm signing paths.
  • registry_snapshot.json is the combined local registry used by the CLI and service examples.
  • policy_package.md is the Rego-in-Markdown policy package.
  • policy_fixtures.yaml contains allow and deny expectations for package validation.
  • check_request_*.json files are ops-warden-shaped /v1/check requests.

Run locally:

access-engine validate --kind protected-system --file examples/ops-warden/protected_system_manifest.yaml
access-engine validate --kind resource-manifest --file examples/ops-warden/resource_manifest.yaml
access-engine validate --kind subject-manifest --file examples/ops-warden/subject_manifest.yaml
access-engine load-registry --file examples/ops-warden/registry_snapshot.json
access-engine test-policy --file examples/ops-warden/policy_package.md
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json

The fixture public-key fingerprints are examples only. Do not put real keys, OpenBao tokens, or private signing material in these files.

Production Registry Fixture

production_registry_snapshot.json is a non-secret fixture generated by ops-warden for FLEX-WP-0007 coverage. It mirrors the current production actor names used by ops-warden inventory and should be refreshed when that inventory changes.

Validate both registries locally:

access-engine load-registry --file examples/ops-warden/registry_snapshot.json
access-engine load-registry --file examples/ops-warden/production_registry_snapshot.json

The production sync contract is documented in docs/ops-warden-registry-sync.md.