coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Tighten the ops-warden boundary after reviewing its actual repo

Browse source 
Found two things in ops-warden's own code/docs that sharpen the
boundary beyond what INTENT.md originally said:

1. registry/routing/catalog.yaml enforces a real "no-double-source
   rule": non-SSH entries are pointer-only (id/title/need_keywords/
   owner_repo/subsystem/wiki_ref/canon_ref/reviewed/status), never an
   authored steps/cert_command block -- that's reserved for
   warden_executes: true (ops-warden's own SSH lane). ops-mason's
   catalog contributions must follow the same rule: warden_executes:
   false always, status: draft until verified, and it's a normal git
   contribution to ops-warden's repo, not a live registration API.

2. ops-warden already ships a founder-facing "paste-once provision"
   desk (src/warden/desk.py's paste_once_provision act) that writes a
   secret VALUE into an EXISTING KV path via a localhost-only web form,
   never through a terminal/chat/audit log. It does not create
   AppRoles, policies, or paths -- that gap is exactly what ops-mason
   fills. Clean split: ops-mason builds structure only and never
   touches a secret value, even transiently; the founder delivers the
   actual credential through ops-warden's existing desk once the
   structure exists.

Updated INTENT.md/SCOPE.md/MASON-WP-0001 accordingly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-27 00:44:37 +02:00
parent c5e935f949
commit ed518fb876
3 changed files with 81 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

9
SCOPE.md
View file

@ -16,10 +16,12 @@ decision gate, in plain terms; (4) build, only after approval.
## In Scope
- Construction plans for new/changed/retired OpenBao AppRoles, policies,
KV secret paths
KV secret path *structure* (never values)
- Consistency review — reuse over duplication, compaction over sprawl
- The executive-summary format that makes a plan decidable at a glance
- Registering what it builds into ops-warden's routing catalog
- Proposing pointer-only entries (`warden_executes: false`, no authored
`steps`) in ops-warden's routing catalog for what it builds — a normal
git contribution to that repo, not a live API
- Its own audit trail of what it built, under which approved plan
## Out of Scope
@ -31,7 +33,8 @@ decision gate, in plain terms; (4) build, only after approval.
- Routing consumers to lanes once built — ops-warden
- SSH certificate issuance — ops-warden
- OpenBao cluster init/unseal, platform deploy — railiance-platform
- Holding or logging secret values, ever
- Touching secret values at all, even transiently — delivered via
ops-warden's existing `paste_once_provision` desk instead
## Current State