From 2f48c9df8d9e0308a7714a782d2b1989c2507f4e Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 2 Oct 2026 22:01:44 +0200 Subject: [PATCH] ssh-certificates pack: use ops-warden's rehearsal config (WARDEN_CONFIG); record dry-run Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0 --- runbooks/ssh-certificates/pack.yaml | 17 +++++++++++++---- ...-0044-runbook-packs-for-runbook-tutorials.md | 7 +++++++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/runbooks/ssh-certificates/pack.yaml b/runbooks/ssh-certificates/pack.yaml index 053f321..7adfe7d 100644 --- a/runbooks/ssh-certificates/pack.yaml +++ b/runbooks/ssh-certificates/pack.yaml @@ -22,6 +22,13 @@ datapoints: help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h. agt-rehearsal is an inert test actor (2h, a principal no host trusts); use your own actor for real access." dimensions: {actor: operator, kind: identity, subsystem: ops-warden} ask_in: ready + - id: warden_config + label: warden config file + type: path + default: ~/.config/warden/rehearsal/warden.yaml + help: The rehearsal config uses a throwaway local CA that nothing trusts and has no flex-auth gate, so it proves the signing mechanics, not the policy gate. For real access use your production config, ~/.config/warden/warden.yaml. + dimensions: {actor: operator, kind: location, subsystem: ops-warden} + ask_in: ready - id: pubkey label: Public key path type: path @@ -62,7 +69,8 @@ stages: actor: operator owner: ops-warden requires: [prerequisites] - command: warden status + uses: [warden_config] + command: WARDEN_CONFIG={{warden_config}} warden status idempotent: idempotent verify: done_when: You know which certificates are current and which are expired @@ -76,8 +84,8 @@ stages: title: Sign a public key for the actor actor: operator owner: ops-warden - uses: [actor_name, pubkey] - command: warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub + uses: [actor_name, pubkey, warden_config] + command: WARDEN_CONFIG={{warden_config}} warden sign {{actor_name}} --pubkey {{pubkey}} > /tmp/{{actor_name}}-cert.pub idempotent: idempotent idempotent_note: Each run issues a new certificate and overwrites the file; the old one expires on its own. rollback: Delete /tmp/{{actor_name}}-cert.pub; the certificate expires on its own. @@ -143,7 +151,8 @@ stages: actor: operator owner: ops-warden requires: [tunnel-up] - command: warden log | tail -5 + uses: [warden_config] + command: WARDEN_CONFIG={{warden_config}} warden log | tail -5 idempotent: idempotent verify: done_when: Your signing appears in the history diff --git a/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md b/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md index b641018..819af4b 100644 --- a/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md +++ b/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md @@ -106,6 +106,13 @@ holds no NetKingdom pack, so it is not T05 evidence. sent to ops-warden for the sanctioned registration; net-kingdom does not edit their registry. A systematic pre-production testing environment (test CA, test principals, test hosts) is Bernd's later topic. +**ops-warden answered 2026-10-02** (`21c85dc3-754e-41fc-a271-02255054e12d`): no production registry change. A rehearsal config +(`WARDEN_CONFIG=~/.config/warden/rehearsal/warden.yaml`, throwaway local CA, no flex-auth gate, no prod trust) signs for the inert +`agt-rehearsal`. The pack now has a `warden_config` datapoint defaulting to it. `nk.ssh-certificates` dry-ran clean (cert: test CA, +principal `rehearsal-inert-nohost` only, 2h). This proves the signing mechanics, not the policy gate; the tunnel stage stays "not proven" +until a test target exists. Dry-runs of packs 1-3 are all clean; Bernd's UI rehearsal is the remaining T05 work. A systematic +pre-production environment (ops-warden's option b) is Bernd's later topic. + ## Retire the markdown verifier ```task