coulomb/gate-house
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gate-house/history/2026-10-11-sec-dsm-practice-guide.md
tegwick bc890c4d05 Teach SEC-DSM as the secrets best-practice guide. 
Keep ASM v0.3 for estate invariants, operating modes, and assurance tests. Secrets-practice sentences yield to the security-canon standard.

Assistant: grok
Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4
2026-10-11 23:41:30 +02:00

2 KiB
Raw Permalink Blame History

2026-10-11 — SEC-DSM is the secrets best-practice guide

The repository owner inserted DevOps Secrets Management Canon v1.0 into security-canon as SEC-DSM 1.0.0 (security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md, decision SECURITY-DEC-2026-004) and asked Gate House to use that standard as the best-practice guide from now on, with ops-mason and ops-warden guided by it.

What changed

  • Secrets practice — preference hierarchy, decision procedure Q1–Q5, and the DSM-* requirements — is read from SEC-DSM. Gate House teaches it and does not edit it.
  • spec/ActiveSecretsManagementCanon_v0.3.md stays the estate doctrine for INV-01…INV-12, assistant and autonomous modes, and assurance tests T-01…T-10. Secrets-practice controls in that file yield to SEC-DSM where they differ.
  • ops-mason construction plans must answer Q1–Q5 before proposing a new credential. ops-warden routes inside the same hierarchy and still does not take custody of static secrets. SSH certificates remain the short-lived path ops-warden actually issues.

What did not move

Custody and issuance stay with secrets-engine. Authorization stays with access-engine. Route construction stays with ops-mason. Lane operation stays with ops-warden. The layer maxim is unchanged: cognition proposes, authority disposes, infrastructure executes.

Staff reading

Role Follow first
ops-mason, when designing a route SEC-DSM §5 preference hierarchy, §37 decision procedure, §35 OpenBao mapping, §36 Kubernetes mapping, DSM-ARCH-001 through DSM-ARCH-004, DSM-TRANS-003
ops-warden, when operating a lane SEC-DSM §5 and §37, DSM-DELIV-*, DSM-HUM-001, DSM-AUDIT-002, DSM-AP-020. Issue SSH certificates as ephemeral credentials. Do not become the store.
Gate House Teach the standard. Keep ASM v0.3 for modes, invariants, and assurance. Record conflicts; do not fork the standard.