coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/SCOPE.md

473 lines
27 KiB
Markdown
Raw Normal View History

Initial Commit
2026-03-28 00:45:43 +00:00
# SCOPE
> This file helps you quickly understand what this repository is about,
> when it is relevant, and when it is not.
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
> Aspirational direction lives in `INTENT.md`.
Initial Commit
2026-03-28 00:45:43 +00:00
---
## One-liner
feat(WARDEN-WP-0017): make the access front door discoverable (not SSH-only) WP-0014 made ops-warden the operator access front door (warden access --fetch/--exec proxies an exec_capable secret as the caller), but every discovery surface still told the pre-WP-0014 "SSH certs only, pointer not key" story — so agents like whynot-design never found the proxy and concluded they had to message ops-warden for a token value. Messaging/discoverability only; the conduit security model is unchanged (no custody, no broker). T1 — CLI: `warden route` table warden column is now three-valued (issue/assist/route); route + access JSON gain warden_role + exec_capable and a proxy-aware next_action; `warden access` closing line leads with "ops-warden can fetch this for you as the caller" for exec_capable lanes (route-only lanes keep "owner vends"). T2 — .claude/rules/credential-routing.md reframed (lead + routing table role column); SCOPE one-liner + a second capability block for the access front door. T3 — registered the State Hub capability "Operator access front door (caller-identity fetch proxy)" (the hub had no ops-warden security capability at all); messaged whynot-design the corrected `warden access "npm auth token" --fetch/--exec` path. 210 tests pass, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 21:02:46 +02:00
Operational access steward and **front door** for the NetKingdom security model — issues
short-lived SSH certificates for `adm`/`agt`/`atm` actors, and for every other credential
need is the operator front door (`warden access`): routes to the owning subsystem and, for
`exec_capable` lanes (OpenBao reads, key-cape login), **proxies the fetch as the caller**
without taking custody. Also stewards workload security posture conformance and keeps ops
access guidance aligned with NetKingdom canon.
Initial Commit
2026-03-28 00:45:43 +00:00
---
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
## Where we are (2026-08-11)
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
ops-warden **issues short-lived SSH certificates and routes every other credential
need to the subsystem that owns it.** SSH signing is **production-verified** on
Railiance OpenBao (`warden sign` against `https://bao.coulomb.social`, host CA trust
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
deployed).
**Access routing** is shipped: `wiki/AccessRouting.md`, credential routing wiki,
NetKingdom security map, machine-readable pointer catalog
(`registry/routing/catalog.yaml`, WP-0010), and `warden route` lookup CLI
(`list`/`show`/`find`, `--json`, WP-0011).
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
**Operator access assist** is shipped (WP-0014): `warden access` gives advisory
handoffs for every catalog need and can proxy `exec_capable` lanes as the caller,
without taking custody of values.
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
**Owner-native exec lanes** are documented in the catalog (WP-0017–0019 plus
cross-repo stewardship): provisioned secret-exec routes to **secrets-engine**
(`whynot-design-npm-publish`, production-exercised); scoped OpenBao tokens for
ops-warden signing route to the **railiance-platform credential broker**
(`ops-warden-warden-sign-token`, RAILIANCE-WP-0005 T08, live 2026-07-01). ops-warden
points at the owner's front door — it does not mint OpenBao tokens or run
`credential.py` itself.
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
**Workload security posture** is shipped (WP-0015, all tasks done): dev/test/prod
environment posture, M0-M3 workload maturity, the secret-flow lattice, and blocker
triage language (T1); machine-readable descriptors + `warden policy list|show` (T2);
the read-only conformance checker `scripts/check_secret_posture_conformance.py` (T3);
and the dev-tier contract-double library `warden.doubles` (T4). Canon landing in
net-kingdom / info-tech-canon is owner-driven (tracked via coordination messages, T5).
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
**Policy gate** is shipped on the caller side (WP-0007) with production registry
and smoke evidence (WP-0009 archived). flex-auth published the `ssh-certificate`
policy package (FLEX-WP-0006). `policy.enabled` remains **false** in production
until flex-auth is deployed to a reachable URL (flex-auth FLEX-WP-0007).
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
docs(SCOPE): sync current state — WP-0016 pilot-ready, completeness C4→C5 Update SCOPE.md "Where we are" / INTENT gap / maturity vector / Current State to reflect the ops-bridge cert_command pilot (WP-0016) shipped to pilot-ready and all ops-warden workplans finished. Remaining distance is external (flex-auth prod flip, ops-bridge live cutover, owner-driven WP-0015 canon landing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 20:33:32 +02:00
**ops-bridge cert_command pilot** is shipped to pilot-ready (WP-0016): a read-only
readiness gate (`scripts/check_tunnel_cert_readiness.py`) plus an opt-in offline
contract smoke (`--sign-smoke`); the playbook leads with the gate and the pilot
(`agt-state-hub-bridge`) is handed to ops-bridge. The live tunnel cutover is
ops-bridge's to execute.
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
**Credential hygiene and the policy front door** shipped through July 2026:
disclosure hygiene and rotation guidance (WP-0026 — `warden taint`,
`warden rotate-guide`, agent read-boundary on high-risk lanes), the tenant secret
custody pattern (WP-0028, first lane binky company email IMAP), experiential memory
across worker/agent sessions (WP-0024), the Forgejo admin PAT lane (WP-0025), and the
posture-aware policy front door (WP-0029 — `warden plan`, `warden desk`, declared
`organization_posture: build` as a third axis). WP-0027 (tamper-resistant governance,
mass rotation/lockdown) is drafted and sits in `backlog`.
**Delegation register** is the open question (WP-0030, proposed). ops-warden fronts
11 catalog lanes as a caller-identity proxy with no record of which component *should*
own that front door. The primitive to delegate exists and is proven
(`exec_owner`/`exec_command` — secrets-engine for npm publish, the credential broker
for warden-sign) but is used by 2 of 24 lanes. See
`history/2026-08-11-delegation-surface-assessment.md`.
**INTENT alignment:** SSH issuance mission met in production. All ops-warden workplans
through WP-0029 are finished except WP-0027 (`backlog`) and WP-0030 (`proposed`).
Remaining distance is in other repos' lanes: ops-bridge running the cert_command pilot
cutover, flex-auth runtime deployment (FLEX-WP-0007, unblocks `policy.enabled: true`),
the owner-driven WP-0015 canon landing, and — newly named — the missing owner front
doors that keep ops-warden holding interim lanes (secrets-engine, tenant-engine).
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
### Issue vs route
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
ops-warden executes exactly one lane with its own authority and routes/assists the rest.
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
| Need | Subsystem | ops-warden role |
| --- | --- | --- |
| SSH cert for host/ops access (`adm`/`agt`/`atm`) | **ops-warden** | **Issue** (`warden sign`) |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
| Scoped `VAULT_TOKEN` for warden-sign / policy-gate smoke | railiance-platform credential broker | Route — owner-native `credential exec`; ops-warden does not mint |
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
| API key / DB cred / dynamic lease | OpenBao | Assist — route; proxy as caller only for `exec_capable` lanes |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
| Provisioned secret-exec (e.g. npm publish) | secrets-engine (+ OpenBao custody) | Route — primary `secrets-engine exec`; `warden access` as fallback |
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
| "May I perform action X?" | flex-auth | Route — point at policy; consume decisions where configured |
| Login / OIDC / MFA | key-cape / Keycloak | Assist — route; proxy `login` lane when `exec_capable` |
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
| SSH tunnel / port forward | ops-bridge | Route — supply `cert_command` |
| Host principal deployment | railiance-infra | Route — point at Ansible |
Full role and boundary: `wiki/AccessRouting.md`. The catalog is a **pointer layer** —
it never restates an owner's procedure (authored `steps` exist only for the SSH lane).
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
**Interim by default.** SSH issuance is the only lane ops-warden owns permanently.
Where it proxies or assists, it is covering a need no component fronts yet — a
legitimate service, but a *tracked gap*, retired to the owner once their front door
exists (INTENT §9). Recording that intent per lane is WP-0030; today only
`whynot-design-npm-publish` and `ops-warden-warden-sign-token` carry it.
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
Gap analysis: `history/2026-07-01-intent-scope-gap-analysis.md` (current);
`history/2026-06-24-intent-scope-gap-analysis.md` (prior);
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
`history/2026-06-18-post-wp0008-intent-scope-reassessment.md` (SSH lane);
`history/2026-06-18-access-routing-intent-shift-assessment.md` (routing charter).
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
---
## INTENT gap snapshot
| INTENT success criterion | Status |
| --- | --- |
| Worker knows which subsystem for each credential type | Met |
| SSH short-lived, inventoried, audited | Met (production) |
feat(WARDEN-WP-0016): ops-bridge cert_command readiness gate + handoff Close ops-warden's side of the last Partial INTENT criterion (ops-bridge integrates via a stable cert_command). The migration playbook and contract already existed; what was missing was an automated readiness gate before touching tunnel config. T1 — scripts/check_tunnel_cert_readiness.py: read-only preflight that asserts the cert_command path is ready without signing — config/backend, actor inventory + TTL within type max, pubkey exists/parses/not-private, principals present, and optional host-principal deployment (mirrors check_principals_drift). Exit 0/1/2. T2 — opt-in --sign-smoke: runs the cert_command against the local backend and validates identity/principals/TTL of the emitted cert; refuses a vault backend. Window measured from the cert's own valid_from->valid_before so it's timezone-robust (fixes a CEST off-by-2h artifact). integration-marked test + a vault-refusal unit test. T3 — playbook now leads with Step 0 readiness gate; ops-bridge handoff message sent. T4 — SCOPE INTENT row: Partial -> Pilot-ready; known-gaps + SSH-lane list updated. 9 unit + 1 integration test, 209 default passing, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:50:28 +02:00
| ops-bridge integrates via stable `cert_command` | **Pilot-ready** — contract + readiness gate (`check_tunnel_cert_readiness.py`, WP-0016) shipped; live cutover handed to ops-bridge |
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| NetKingdom evolution reflected in docs | Met |
| Non-SSH secrets stay out of ops-warden | Met |
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
| Workload posture / maturity model for secret-flow blockers | Met — two-axis standard + descriptors + conformance checker + dev doubles (WP-0015) |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| Every execution position explicitly permanent or interim with a named owner | **Not met** — 2 of 24 lanes carry `exec_owner`; 11 proxy lanes record no intended owner (WP-0030) |
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
**Maturity vector:** `D5 / A5 / C4 / R4` (Discovery / Availability / Completeness / Reliability)
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| Dimension | Level | Meaning today |
| --- | --- | --- |
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
| D5 | Discovery | Routing wiki + security map + pointer catalog + NK canon cross-links |
docs(SCOPE): sync current state — WP-0016 pilot-ready, completeness C4→C5 Update SCOPE.md "Where we are" / INTENT gap / maturity vector / Current State to reflect the ops-bridge cert_command pilot (WP-0016) shipped to pilot-ready and all ops-warden workplans finished. Remaining distance is external (flex-auth prod flip, ops-bridge live cutover, owner-driven WP-0015 canon landing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 20:33:32 +02:00
| A5 | Availability | CLI + `warden route` + `warden access` advisory & proxy front door + `warden policy` + opt-in policy gate + agent `--json` |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| C4 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, disclosure hygiene, tenant custody, policy front door. **Down from C5:** delegation is unrecorded on 11 of 24 lanes, so ops-warden's interim positions are not distinguishable from designed ones (WP-0030) |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
| R4 | Reliability | Live OpenBao sign + credential-broker policy-gate smoke evidence on Railiance (2026-07-01) |
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
---
Initial Commit
2026-03-28 00:45:43 +00:00
## Core Idea
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
**Today:** implements the SSH certificate lane from `wiki/AccessManagementDirective.md`
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
§§1–5 — CA signing, actor inventory, TTL policy, cert-side scorecard, optional
flex-auth pre-sign gate, and the `cert_command` interface for ops-bridge. Production
path uses OpenBao SSH engine (`backend: vault`).
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
**Direction (INTENT):** issue short-lived SSH certificates and route dev workers to
key-cape, flex-auth, OpenBao, ops-bridge, and railiance components for everything
else — implementing only the SSH certificate lane directly, pointing at the owner
for the rest.
Initial Commit
2026-03-28 00:45:43 +00:00
---
## In Scope
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
### Implemented (SSH lane)
- Local CA backend (`ssh-keygen -s`)
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
- OpenBao / Vault-compatible SSH engine backend (**production-verified**)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Actor identity registry (`inventory.yaml`)
- `cert_command`: `warden sign <actor> --pubkey <path>` → cert on stdout
- TTL enforcement per `ActorType` (`adm` 48 h, `agt` 24 h, `atm` 8 h)
- `warden status`, cleanup, scorecard, signatures log
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- Opt-in flex-auth policy gate (`policy.enabled`, `policy_decision_id` in log)
- Production flex-auth registry builder (`scripts/build_flex_auth_registry.py`,
`registry/flex-auth/production_registry_snapshot.json`)
- Policy gate smoke runner (`scripts/policy_gate_production_smoke.sh`)
feat(WP-0011): warden route lookup CLI over the pointer catalog Add a read-only `warden route` command group (list/show/find) that reads registry/routing/catalog.yaml and tells a worker which subsystem owns a need and which wiki/canon doc to follow. ops-warden still executes exactly one lane (SSH); routed entries return a pointer and never call any subsystem. - src/warden/routing/: models.py + catalog.py loader; enforces the no-double-source rule (non-SSH entries with steps/cert_command fail validation), dup-id and schema checks. - route list (active-only unless --all, --tag), route show (SSH appends steps + cert pattern; routed ends with "next action on <owner> — see <wiki_ref>"), route find (keyword ranking, --json). - tests/test_routing.py: load/validation, find ranking, CLI JSON shapes, plus a drift guard (every wiki_ref anchor resolves; every entry has a reviewed date). - Docs: wiki/AccessRouting.md CLI section, README quick reference, SCOPE A3 -> A4. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 21:03:24 +02:00
- `warden route` lookup CLI (`list`/`show`/`find`, `--json`) over the pointer catalog
docs(WARDEN-WP-0014): T5 — assist-layer docs, security model, INTENT/SCOPE - wiki/OperatorAccessAssist.md: warden access contract, conduit-vs-broker boundary, the three guardrails + catalog secret guard, lane semantics. - AccessRouting.md: issue/route/assist roles; reconciled the anti-pattern table so the transparent conduit no longer contradicts it. - credential-routing.md rule: added warden access + "standing broker forbidden, transparent --fetch sanctioned" anti-pattern. - INTENT.md: pointer→assist charter extension. SCOPE.md: implemented list + Getting Oriented + maturity A4→A5 (Availability). - history decision record for the proxy-mode choice and guardrails. WP-0014 finished (T1–T5). 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:35:57 +02:00
- `warden access` operator front door (WP-0014): advisory handoff for any need, and a
transparent, policy-gated, audited **proxy** (`--fetch`/`--exec`) for `exec_capable`
lanes (OpenBao secret reads, key-cape login) — caller identity, value never held
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
- `warden issue` and `ops-ssh-wrapper` (local backend; vault uses sign-only)
feat(WARDEN-WP-0016): ops-bridge cert_command readiness gate + handoff Close ops-warden's side of the last Partial INTENT criterion (ops-bridge integrates via a stable cert_command). The migration playbook and contract already existed; what was missing was an automated readiness gate before touching tunnel config. T1 — scripts/check_tunnel_cert_readiness.py: read-only preflight that asserts the cert_command path is ready without signing — config/backend, actor inventory + TTL within type max, pubkey exists/parses/not-private, principals present, and optional host-principal deployment (mirrors check_principals_drift). Exit 0/1/2. T2 — opt-in --sign-smoke: runs the cert_command against the local backend and validates identity/principals/TTL of the emitted cert; refuses a vault backend. Window measured from the cert's own valid_from->valid_before so it's timezone-robust (fixes a CEST off-by-2h artifact). integration-marked test + a vault-refusal unit test. T3 — playbook now leads with Step 0 readiness gate; ops-bridge handoff message sent. T4 — SCOPE INTENT row: Partial -> Pilot-ready; known-gaps + SSH-lane list updated. 9 unit + 1 integration test, 209 default passing, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:50:28 +02:00
- ops-bridge cert_command readiness gate (`scripts/check_tunnel_cert_readiness.py`,
WP-0016) — read-only preflight + opt-in offline contract smoke
feat(WARDEN-WP-0020): T4 scheduling tick + T5 SCOPE — worker complete T4 — scripts/worker-tick.sh: scheduled tick for the conservative worker. flock concurrency guard; short-lived kubectl port-forward to llm-connect (or LLM_CONNECT_URL, or rule-brain fallback). Ships disabled; header documents the cron entry. Schedules the conservative tier only (never auto-send). T5 — SCOPE records `warden worker` as an implemented capability: conservative triage default, full-auto opt-in, llm-connect brain, the four guardrails, schedulable tick. WARDEN-WP-0020 finished: the autonomous coordination worker — T1 scaffold, T2 llm-connect brain, T3 guarded executor, conservative tier (Option A), T4 scheduling, T5 docs. 245 tests, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 00:41:04 +02:00
- Coordination worker (`warden worker`, WP-0020) — autonomous triage of ops-warden's
State Hub inbox via llm-connect. **Conservative by default** (triage + drafted replies,
sends nothing); `--full-auto` opt-in. Four guardrails (fixed charter, action allowlist,
feat(WARDEN-WP-0021): T3-T5 — visibility, approve loop, runbook (scheduled worker complete) T4 (review→send loop): conservative tick persists structured drafts to state_dir/worker-drafts.json; `warden worker drafts` lists them, `warden worker approve <id> [--body …]` sends the reviewed draft as the reply + marks read + drops it. Escalated plans persist no draft. Live-verified end-to-end. T3 (visibility): `warden worker status` (pending drafts, triage count, last digest, timer state); best-effort notify-send nudge in the tick when drafts are pending. T5: wiki/playbooks/scheduled-worker.md (enable/disable, the approve loop, failure modes, conservative-only posture) + SCOPE note. WARDEN-WP-0021 finished: the conservative worker now runs on a systemd --user timer (enabled, every 15 min), triages new inbox messages into drafts you approve with one command, degrades gracefully, and stops with one command. 249 tests, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 15:24:10 +02:00
no-secret invariant, dry-run/audit) enforced regardless of the brain. **Scheduled**
(WP-0021) via a `systemd --user` timer (`scripts/install-worker-timer.sh`); review loop
`warden worker drafts | approve <id>` + `worker status`; one-command kill switch
(`wiki/playbooks/scheduled-worker.md`)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Runbooks for OpenBao config and Inter-Hub bootstrap SSH envelope
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- **warden-sign token routing** (RAILIANCE-WP-0005 T08): catalog id
`ops-warden-warden-sign-token` and playbook
`wiki/playbooks/ops-warden-warden-sign-token.md` — routes `VAULT_TOKEN` needs to
`railiance-platform/scripts/credential.py exec --grant ops-warden/warden-sign`
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
(preferred over manual `export VAULT_TOKEN`); `warden sign` emits broker hint when
token env is unset (WP-0023)
- **Unified audit trail** (WP-0022): append-only `audit.jsonl`, secret-material guard,
instrumentation on sign/access/worker paths, `warden activity` CLI merging legacy
logs + optional State Hub notes (`wiki/AuditTrail.md`)
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
- **Experiential memory** (WP-0024, `src/warden/memory.py`) — recorded outcomes feed
routing and coordination; no secret values, guardrail allowlist unchanged
- **Disclosure hygiene** (WP-0026): `warden taint <catalog-id>` (KV `custom_metadata`,
no data read), `warden rotate-guide`, safe fetch transports (`--out` / `--exec` /
`--wrap`) with refusal to stream to non-terminal stdout, and the agent read-boundary
on `risk: high` lanes (exit 7 when `WARDEN_AGENT_ID` is set)
- **Tenant secret custody** (WP-0028): tenant vs `platform/workloads/...` path
convention, policy/CCR/catalog ownership, first lane `binky-company-email-imap`
- **Policy front door** (WP-0029): `warden plan "<need>" [--json]` returning
`autonomous` / `founder_required` (typed act) / `unroutable` (CCR stub);
`warden desk` loopback founder surface (approve, OIDC login, paste-once provision
straight into OpenBao); `organization_posture: build` as posture axis C; catalog
freshness reporting on `warden route list` and in plan JSON
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
### Stewardship (documentation and alignment)
- NetKingdom security routing guidance — which subsystem owns which credential type
- Wiki and config references aligned with OpenBao-first platform standard
- Capability registry entry for SSH certificate issuance
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- Routing pointer catalog (`registry/routing/catalog.yaml`)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Keeping ops access patterns consistent with `net-kingdom` platform architecture
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
- Workload Security Posture standard (`wiki/WorkloadSecurityPosture.md`),
machine-readable posture descriptors (`registry/policy/security-posture.yaml`),
the read-only conformance checker, and the dev-tier contract-double library
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
### Shipped workplans (archived)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| WP | Focus |
| --- | --- |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| WP-0001–0005 | Initial CLI, quality, hygiene, OpenBao docs, hub sync |
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| WP-0006 | Credential routing, security map, inventory patterns, OpenBao checklist |
| WP-0007 | Opt-in flex-auth policy gate (`policy.enabled`) |
| WP-0008 | Production sign verification, stewardship closeout, archive hygiene |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| WP-0009 | flex-auth registry + policy smoke; pickup brief for FLEX-WP-0007 |
| WP-0010 | Access routing charter + pointer catalog |
| WP-0011 | `warden route` lookup CLI |
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
| WP-0012 | Routing scenario playbooks (catalog + wiki expansion) |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| WP-0013 | Production integration closeout — cert_command playbook, token hygiene, principals drift |
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
| WP-0014 | Operator access assist — `warden access` advisory + proxy front door |
| WP-0015 | Workload security posture — two-axis standard, descriptors, conformance checker, dev doubles |
docs(SCOPE): sync current state — WP-0016 pilot-ready, completeness C4→C5 Update SCOPE.md "Where we are" / INTENT gap / maturity vector / Current State to reflect the ops-bridge cert_command pilot (WP-0016) shipped to pilot-ready and all ops-warden workplans finished. Remaining distance is external (flex-auth prod flip, ops-bridge live cutover, owner-driven WP-0015 canon landing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 20:33:32 +02:00
| WP-0016 | ops-bridge cert_command pilot — readiness gate (`check_tunnel_cert_readiness.py`) + handoff |
WARDEN-WP-0006: NetKingdom stewardship docs and alignment Add credential routing, actor patterns, security map, OpenBao SSH checklist, and policy-gated signing design. Update registry and SCOPE; record INTENT↔SCOPE reassessment (C3 completeness).
2026-06-17 08:22:45 +02:00
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
### Recently shipped (July 2026)
workplan: add WARDEN-WP-0008 production SSH path and stewardship closeout Establish follow-up after WP-0007: E2E OpenBao sign verification, post-policy reassessment, task-status canon migration, and archive hygiene. Refresh SCOPE to reflect shipped policy gate and active WP-0008.
2026-06-17 23:34:13 +02:00
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
| WP | Focus |
| --- | --- |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| WP-0017 | Access front-door discoverability |
| WP-0018 | `whynot-design-npm-publish` — first concrete secret lane (production-exercised) |
| WP-0019 | Route provisioned secret-exec lanes to secrets-engine (`exec_owner` pattern) |
| WP-0020 | Coordination worker (`warden worker`) |
| WP-0021 | Scheduled worker tick (systemd --user timer, kill switch) |
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
| WP-0022 | Unified audit trail + `warden activity` |
| WP-0023 | INTENT–SCOPE alignment closeout |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| WP-0024 | Experiential memory across worker/agent sessions (`src/warden/memory.py`) |
| WP-0025 | Forgejo admin PAT OpenBao lane (CCR-2026-0006) |
| WP-0026 | Credential disclosure hygiene — `warden taint`, `warden rotate-guide`, agent read-boundary, safe fetch transports |
| WP-0028 | Tenant secret custody pattern — tenant vs platform paths; first lane binky company email IMAP |
| WP-0029 | Policy front door — `warden plan`, `warden desk`, `organization_posture: build` third axis |
### Open ops-warden work
| WP | Status | Focus |
| --- | --- | --- |
| WP-0027 | `backlog` | Tamper-resistant credential governance + mass rotation/lockdown (Strand B follow-on to WP-0026) |
| WP-0030 | `proposed` | Delegation register — record intended owner + blocker on every interim lane, `warden route gaps`, promotion gate |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
Remaining production distance is also in other repos' lanes (see Known gaps).
workplan: add WARDEN-WP-0008 production SSH path and stewardship closeout Establish follow-up after WP-0007: E2E OpenBao sign verification, post-policy reassessment, task-status canon migration, and archive hygiene. Refresh SCOPE to reflect shipped policy gate and active WP-0008.
2026-06-17 23:34:13 +02:00
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
### Known gaps (not ops-warden workplans)
chore(WP-0008): finish and archive production SSH path closeout Mark WP-0008 finished and move to archived/. Spin flex-auth production gate to WARDEN-WP-0009. Update SCOPE and reassessment history for R3 reliability.
2026-06-18 01:28:49 +02:00
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| Gap | Owner | Notes |
| --- | --- | --- |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| flex-auth production runtime + registry deploy | flex-auth | **FLEX-WP-0007** — unblocks `policy.enabled: true` |
feat(WARDEN-WP-0016): ops-bridge cert_command readiness gate + handoff Close ops-warden's side of the last Partial INTENT criterion (ops-bridge integrates via a stable cert_command). The migration playbook and contract already existed; what was missing was an automated readiness gate before touching tunnel config. T1 — scripts/check_tunnel_cert_readiness.py: read-only preflight that asserts the cert_command path is ready without signing — config/backend, actor inventory + TTL within type max, pubkey exists/parses/not-private, principals present, and optional host-principal deployment (mirrors check_principals_drift). Exit 0/1/2. T2 — opt-in --sign-smoke: runs the cert_command against the local backend and validates identity/principals/TTL of the emitted cert; refuses a vault backend. Window measured from the cert's own valid_from->valid_before so it's timezone-robust (fixes a CEST off-by-2h artifact). integration-marked test + a vault-refusal unit test. T3 — playbook now leads with Step 0 readiness gate; ops-bridge handoff message sent. T4 — SCOPE INTENT row: Partial -> Pilot-ready; known-gaps + SSH-lane list updated. 9 unit + 1 integration test, 209 default passing, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:50:28 +02:00
| ops-bridge `cert_command` on live tunnels | ops-bridge | Playbook + readiness gate shipped (WP-0016); pilot cutover handed off, awaiting ops-bridge |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| Principals sync warden ↔ railiance-infra | ops-warden + infra | `scripts/check_principals_drift.py` — operator runs periodically |
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
| NK-WP-0009 joint SSH tutorial | net-kingdom | Parallel coordination track |
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
| WP-0015 canon landing (generic `WorkloadMaturityLevel` + M0-M3 requirements) | net-kingdom + info-tech-canon | ops-warden drafted + offered (coordination msgs); owner-driven landing |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| Owner front doors for workload secret lanes | secrets-engine | 6 lanes proxied by ops-warden that `secrets-engine exec` could front, as WP-0019 did for npm publish |
| Owner front door for tenant secret lanes | tenant-engine | WP-0028 defined the custody pattern; 3 tenant lanes still fronted by ops-warden proxy |
chore(WP-0008): finish and archive production SSH path closeout Mark WP-0008 finished and move to archived/. Spin flex-auth production gate to WARDEN-WP-0009. Update SCOPE and reassessment history for R3 reliability.
2026-06-18 01:28:49 +02:00
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Out of Scope
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- **Issuing or custodying** non-SSH secrets (API keys, DB creds, OpenBao tokens,
S3 STS, Inter-Hub keys) → OpenBao / railiance-platform credential broker /
secrets-engine with flex-auth policy where required; ops-warden documents paths,
routes to owner-native exec front doors, and may proxy caller-authenticated
`exec_capable` lanes only
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Identity / OIDC / MFA → key-cape, Keycloak
- Authorization policy decisions → flex-auth
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
- flex-auth runtime deployment and secret-flow lattice enforcement → flex-auth
(`FLEX-WP-0007` and follow-ups)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Tunnel lifecycle → `ops-bridge`
- Host principal deployment → `railiance-infra`
- OpenBao / Vault cluster deployment → `railiance-platform`
- Human admin SSH key generation (self-service `ssh-keygen`)
- Session recording, SIEM, SSO / Teleport at scale
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
- **Permanently owning another component's lane.** Covering an unfilled gap is in
scope and expected; keeping it once secrets-engine / tenant-engine / user-engine
can front it — or holding it without recording that it is interim — is not (INTENT §9)
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Relevant When
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Issuing or refreshing an **SSH cert** for `adm`/`agt`/`atm`
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- A worker needs a **scoped `VAULT_TOKEN`** for production `warden sign` or the
flex-auth policy-gate smoke — route to `ops-warden-warden-sign-token`, then run
`credential exec` in `railiance-platform` (no manual token paste)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- A dev worker needs to know **where to get credentials** in the NetKingdom stack
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- An agent needs **`warden route find`** instead of re-deriving routing from wiki prose
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- `ops-bridge` needs a `cert_command` for a tunnel
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- Adding actors to the principals inventory (regenerate flex-auth registry snapshot)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Inter-Hub or bootstrap tasks need a **short-lived agent SSH envelope**
- Checking cert-side compliance (scorecard)
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- Enabling or testing the opt-in flex-auth policy gate
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
- Classifying whether a credential blocker is a dev/test double, owner-routed prod
gate, or maturity/posture violation
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Not Relevant When
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- Storing or vending **API keys, OpenBao tokens, or runtime secrets** (→ OpenBao /
railiance-platform broker / secrets-engine)
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- Policy decisions on resource access (→ flex-auth)
- Managing tunnels without SSH cert issuance (→ ops-bridge)
- Static-key-only legacy access (ops-bridge static key mode)
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Current State
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
- **SSH CLI:** v0.1.0 — local + OpenBao backends
- **Production sign:** verified 2026-06-18 (`history/2026-06-17-openbao-production-verify.md`)
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
- **Access routing:** WP-0010 + WP-0011 shipped (`warden route`, pointer catalog)
- **Policy gate:** caller shipped (WP-0007); registry + smoke complete (WP-0009 archived).
`policy.enabled: false` until flex-auth reachable (`FLEX-WP-0007`)
feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles Finish the Workload Security Posture workplan (all five tasks done). T3 — scripts/check_secret_posture_conformance.py: read-only checker that asserts env-posture conformance (backend/unseal/real_values per tier) and evaluates the secret-flow lattice via posture.can_deliver. Metadata-only manifest, no secret values, exit 0/1/2. examples/posture-conformance.example.yaml as the reference. T4 — src/warden/doubles.py: generalizes "fake bao" into materialize_doubles() — hermetic, synthetic-only (synthetic- prefix) stand-ins for bao/key-cape honoring each argv/stdout/exit contract, for fully offline dev/test access flows. Documented as the sanctioned dev backend in WorkloadSecurityPosture.md R1. T5 — INTENT/SCOPE/wiki aligned; canon landing in net-kingdom/info-tech-canon left owner-driven (tracked via coordination messages). 16 new tests, 200 passing, ruff clean. Archived WP-0012/0014/0015 to workplans/archived/ with 260627- prefix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 19:30:30 +02:00
- **Workload posture:** WP-0015 shipped (standard, descriptors, `warden policy`,
conformance checker, dev doubles); canon landing owner-driven
docs(SCOPE): sync current state — WP-0016 pilot-ready, completeness C4→C5 Update SCOPE.md "Where we are" / INTENT gap / maturity vector / Current State to reflect the ops-bridge cert_command pilot (WP-0016) shipped to pilot-ready and all ops-warden workplans finished. Remaining distance is external (flex-auth prod flip, ops-bridge live cutover, owner-driven WP-0015 canon landing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 20:33:32 +02:00
- **ops-bridge cert_command:** WP-0016 shipped to pilot-ready (readiness gate +
offline contract smoke + handoff); live cutover is ops-bridge's
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- **Access front door:** WP-0017 discoverability + WP-0018 first concrete secret lane
feat(WARDEN-WP-0019): route secret-exec lanes to secrets-engine (route-primary, proxy fallback) secrets-engine (SECRETS-WP-0003) shipped a native secret-exec front door (`secrets-engine route/exec`, decision e6381a56) and asked ops-warden to route to it. Bernd's call: route-primary, proxy-fallback — surface the secrets-engine exec as the primary path for owned lanes, keep `warden access --exec` as a transparent fallback. T1 — RouteEntry gains exec_owner/exec_command/pointer_command (+ has_native_exec), screened for secret material like the other handoff fields. whynot-design-npm-publish points its native exec at secrets-engine. `warden access` renders Primary (secrets-engine exec) + Fallback (warden proxy); route/access JSON gain the fields and a native-exec-aware next_action. Tests added; 217 pass, lint clean. T2 — credential-routing.md adds secrets-engine as the secret-exec owner (route primary, proxy fallback); SCOPE adds secrets-engine to Related Repos and records the npm lane as production-exercised (@whynot/design@0.4.0); playbook leads with secrets-engine exec and fixes the fallback one-liner (--field NPM_AUTH_TOKEN, --no-policy) per whynot-design. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 17:41:49 +02:00
(`whynot-design-npm-publish`), **production-exercised** — whynot-design published
`@whynot/design@0.4.0` through the conduit. WP-0019 routes provisioned secret-exec
lanes to **secrets-engine** (`secrets-engine exec`), proxy as transparent fallback
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- **warden-sign broker routing:** catalog `ops-warden-warden-sign-token` +
`wiki/playbooks/ops-warden-warden-sign-token.md` (RAILIANCE-WP-0005 T08) — live
`make credential-exec-ops-warden-smoke` proven 2026-07-01; manual `export VAULT_TOKEN`
documented as fallback only
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
- **Audit + activity:** WP-0022 shipped — `warden activity`, `wiki/AuditTrail.md`
- **INTENT closeout:** WP-0023 shipped — INTENT refresh, production flip/cutover
checklists, catalog promotion cadence, broker hint on missing `VAULT_TOKEN`
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
- **Disclosure hygiene:** WP-0026 shipped — `warden taint`, `warden rotate-guide`,
safe fetch transports (`--out`/`--exec`/`--wrap`), agent read-boundary on `risk: high`
lanes (`wiki/playbooks/agent-read-boundary.md`)
- **Tenant custody:** WP-0028 shipped — tenant vs platform path convention; first lane
`binky-company-email-imap`. Front door is still an ops-warden proxy (tenant-engine gap)
- **Policy front door:** WP-0029 shipped — `warden plan "<need>"` (autonomous /
founder_required / unroutable), `warden desk` founder interaction surface, declared
`organization_posture: build` as a third posture axis, catalog freshness reporting
- **Delegation:** 24 catalog lanes — 1 executed by ops-warden (SSH), 2 delegated via
`exec_owner`, 11 proxied with **no intended owner recorded**, 10 route-only. Addressed
by WP-0030 (proposed)
- **Active work:** WP-0027 (`backlog`), WP-0030 (`proposed`); remaining production
distance is other repos' lanes
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
- **Integration docs:** cert_command migration, token hygiene (broker-first), principals
drift (`wiki/playbooks/`)
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
- **Latest assessment:** `history/2026-08-11-delegation-surface-assessment.md`
- **Latest workplans:** WP-0029 (policy front door) shipped July 2026; WP-0030
(delegation register) proposed 2026-08-11
Initial Commit
2026-03-28 00:45:43 +00:00
---
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
## How It Fits (NetKingdom)
```text
key-cape / Keycloak identity claims
→ flex-auth authorization decisions
→ OpenBao runtime secrets & dynamic credentials
→ ops-warden SSH certs + operational access guidance
→ ops-bridge tunnel transport (cert_command consumer)
→ railiance-* deployment and host enforcement
```
docs: post-WP-0008 INTENT↔SCOPE reassessment and gap snapshot SCOPE.md now documents where we are (R3 production sign), INTENT criteria status, maturity vector, and workplan landscape. Add reassessment history; point INTENT evolution notes at latest assessment.
2026-06-18 01:36:23 +02:00
Upstream: OpenBao SSH engine (production) or local CA (labs). Actor inventory in
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
operator config or Git-tracked patterns. flex-auth registry snapshot derived from
inventory when policy gate is enabled.
Initial Commit
2026-03-28 00:45:43 +00:00
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operators.
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Terminology
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
- `ActorType`: `adm` | `agt` | `atm`
- `cert_command`: shell command returning a cert on stdout
- `inventory.yaml`: actor → principals + TTL registry
- `LocalCA` / `VaultCA`: signing backends (`backend: local` | `vault`)
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
- Pointer catalog: `registry/routing/catalog.yaml` — subsystem ownership lookup plus
secret-free `warden access` handoff metadata
- Workload Security Posture: env posture (`dev/test/prod`) plus maturity (`M0-M3`)
used to decide whether a secret may flow to a workload
Initial Commit
2026-03-28 00:45:43 +00:00
---
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
## Related Repositories
Initial Commit
2026-03-28 00:45:43 +00:00
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
| Repo | Relationship |
| --- | --- |
| `net-kingdom` | Canonical security architecture; ops-warden aligns to it |
| `ops-bridge` | Primary cert_command consumer |
| `railiance-infra` | Host-side SSH principals and hardening |
| `railiance-platform` | OpenBao deployment and platform secrets |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| `flex-auth` | Authorization; policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
| `key-cape` | Identity / IAM Profile lightweight mode |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) and holds 6 more as interim proxies pending its front doors |
| `tenant-engine` | Intended owner of tenant/client secret front doors; ops-warden holds 3 tenant lanes as interim proxies (WP-0028 pattern, WP-0030 register) |
| `user-engine` | End-user identity/account lifecycle; no ops-warden lane today — route rather than absorb |
docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2)
2026-07-08 16:41:15 +02:00
| `state-hub` | Workplan registry |
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Provided Capabilities
```capability
type: security
title: SSH certificate issuance
description: Issues short-lived CA-signed SSH certificates for adm/agt/atm actors via a
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
pluggable cert_command interface; documents NetKingdom operational access routing;
supports local CA and OpenBao/Vault-compatible SSH engine backends.
keywords: [ssh, certificate, ca, credential, warden, ops-warden, pki, openbao, vault, netkingdom]
Initial Commit
2026-03-28 00:45:43 +00:00
```
feat(WARDEN-WP-0017): make the access front door discoverable (not SSH-only) WP-0014 made ops-warden the operator access front door (warden access --fetch/--exec proxies an exec_capable secret as the caller), but every discovery surface still told the pre-WP-0014 "SSH certs only, pointer not key" story — so agents like whynot-design never found the proxy and concluded they had to message ops-warden for a token value. Messaging/discoverability only; the conduit security model is unchanged (no custody, no broker). T1 — CLI: `warden route` table warden column is now three-valued (issue/assist/route); route + access JSON gain warden_role + exec_capable and a proxy-aware next_action; `warden access` closing line leads with "ops-warden can fetch this for you as the caller" for exec_capable lanes (route-only lanes keep "owner vends"). T2 — .claude/rules/credential-routing.md reframed (lead + routing table role column); SCOPE one-liner + a second capability block for the access front door. T3 — registered the State Hub capability "Operator access front door (caller-identity fetch proxy)" (the hub had no ops-warden security capability at all); messaged whynot-design the corrected `warden access "npm auth token" --fetch/--exec` path. 210 tests pass, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 21:02:46 +02:00
```capability
type: security
title: Operator access front door (caller-identity fetch proxy)
description: warden access is the operator front door for any NetKingdom credential need.
It renders the owner, auth method, path, and policy status, and for exec_capable lanes
(OpenBao secret reads, key-cape OIDC login) proxies the fetch as the caller — running
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
the owner's tool with the caller's identity and streaming the value to them. For
owner-native lanes (secrets-engine exec, railiance-platform credential broker) it routes
to the owner's front door instead of proxying. ops-warden takes no custody — transparent
conduit, not a broker. Use this to discover how to obtain an API key, DB credential,
npm token, warden-sign lease, or login — not a State Hub message.
keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, login, proxy, fetch, exec, warden-access, front-door, routing, warden-sign, vault_token, credential-broker]
feat(WARDEN-WP-0017): make the access front door discoverable (not SSH-only) WP-0014 made ops-warden the operator access front door (warden access --fetch/--exec proxies an exec_capable secret as the caller), but every discovery surface still told the pre-WP-0014 "SSH certs only, pointer not key" story — so agents like whynot-design never found the proxy and concluded they had to message ops-warden for a token value. Messaging/discoverability only; the conduit security model is unchanged (no custody, no broker). T1 — CLI: `warden route` table warden column is now three-valued (issue/assist/route); route + access JSON gain warden_role + exec_capable and a proxy-aware next_action; `warden access` closing line leads with "ops-warden can fetch this for you as the caller" for exec_capable lanes (route-only lanes keep "owner vends"). T2 — .claude/rules/credential-routing.md reframed (lead + routing table role column); SCOPE one-liner + a second capability block for the access front door. T3 — registered the State Hub capability "Operator access front door (caller-identity fetch proxy)" (the hub had no ops-warden security capability at all); messaged whynot-design the corrected `warden access "npm auth token" --fetch/--exec` path. 210 tests pass, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 21:02:46 +02:00
```
Initial Commit
2026-03-28 00:45:43 +00:00
---
## Getting Oriented
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
| Read first | Purpose |
| --- | --- |
| `INTENT.md` | Why ops-warden exists and where it is going |
| `SCOPE.md` | What is implemented today (this file) |
docs(WARDEN-WP-0014): T5 — assist-layer docs, security model, INTENT/SCOPE - wiki/OperatorAccessAssist.md: warden access contract, conduit-vs-broker boundary, the three guardrails + catalog secret guard, lane semantics. - AccessRouting.md: issue/route/assist roles; reconciled the anti-pattern table so the transparent conduit no longer contradicts it. - credential-routing.md rule: added warden access + "standing broker forbidden, transparent --fetch sanctioned" anti-pattern. - INTENT.md: pointer→assist charter extension. SCOPE.md: implemented list + Getting Oriented + maturity A4→A5 (Availability). - history decision record for the proxy-mode choice and guardrails. WP-0014 finished (T1–T5). 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:35:57 +02:00
| `wiki/AccessRouting.md` | What ops-warden issues vs routes vs assists (role and boundary) |
| `wiki/OperatorAccessAssist.md` | `warden access` front door + conduit-vs-broker boundary + guardrails |
WARDEN-WP-0006: NetKingdom stewardship docs and alignment Add credential routing, actor patterns, security map, OpenBao SSH checklist, and policy-gated signing design. Update registry and SCOPE; record INTENT↔SCOPE reassessment (C3 completeness).
2026-06-17 08:22:45 +02:00
| `wiki/CredentialRouting.md` | Which subsystem for each credential need |
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
| `wiki/WorkloadSecurityPosture.md` | Secret-store posture, workload maturity, and blocker triage |
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
| `registry/routing/catalog.yaml` | Machine-readable routing pointer catalog |
WARDEN-WP-0006: NetKingdom stewardship docs and alignment Add credential routing, actor patterns, security map, OpenBao SSH checklist, and policy-gated signing design. Update registry and SCOPE; record INTENT↔SCOPE reassessment (C3 completeness).
2026-06-17 08:22:45 +02:00
| `wiki/NetKingdomSecurityMap.md` | Platform security component map |
feat(WP-0008): reassessment, task-status canon, archive hygiene - Post-WP-0007 reassessment and SCOPE/README updates - AGENTS.md + workplan-convention task status canon migration - examples/warden.production.example.yaml for production OpenBao - Archive WP-0004 through WP-0007 to workplans/archived/260617-* - WP-0008 T1/T3/T4 done; T2/T5 wait on operator/flex-auth
2026-06-17 23:51:12 +02:00
| `examples/warden.production.example.yaml` | Production warden.yaml template |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| `wiki/PolicyGatedSigning.md` | flex-auth opt-in gate + registry rollout |
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
| `wiki/AccessManagementDirective.md` | SSH actor model |
| `wiki/OpsWardenConfig.md` | warden.yaml and OpenBao |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
| `wiki/playbooks/ops-warden-warden-sign-token.md` | Scoped `VAULT_TOKEN` via credential broker (preferred path) |
| `wiki/playbooks/operator-openbao-token-hygiene.md` | Manual token fallback and hygiene rules |
Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
2026-07-01 23:32:38 +02:00
| `wiki/AuditTrail.md` | Unified metadata-only audit + `warden activity` |
| `wiki/playbooks/catalog-lane-promotion.md` | draft → active catalog promotion checklist |
Define INTENT, refresh SCOPE, and plan NetKingdom stewardship Add ops-warden INTENT as operational access steward for NetKingdom security (route credential lanes, align docs, issue SSH certs only). Refresh SCOPE for stewardship scope, persist INTENT↔SCOPE gap assessment, and open WARDEN-WP-0006 for routing runbooks and platform alignment.
2026-06-17 08:20:32 +02:00
| `wiki/CertCommandInterface.md` | cert_command contract |
Add WP-0030 delegation register; refresh INTENT and SCOPE Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00
| `history/2026-08-11-delegation-surface-assessment.md` | Current assessment — where ops-warden covers gaps and who should own them |
| `workplans/WARDEN-WP-0030-delegation-register.md` | Delegation register plan (proposed) |
| `history/2026-07-01-intent-scope-gap-analysis.md` | Prior INTENT↔SCOPE gap analysis |
Add July INTENT↔SCOPE gap analysis and WARDEN-WP-0023 alignment closeout Persist the 2026-07-01 assessment, register the alignment workplan with tasks for INTENT refresh, production integration coordination, broker UX, and catalog promotion. Promote WP-0022 to ready and update SCOPE links.
2026-07-01 23:27:14 +02:00
| `workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md` | Alignment closeout plan |
| `history/2026-06-24-intent-scope-gap-analysis.md` | Prior gap analysis |
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
| `history/2026-06-27-workload-security-posture-charter.md` | WP-0015 posture/conformance charter |
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
| `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` | SSH lane gap analysis |
| `history/2026-06-18-access-routing-intent-shift-assessment.md` | Routing charter decision |
| `history/2026-06-23-flex-auth-policy-gate-production-smoke.md` | Policy gate smoke evidence |
Clarify workload secret posture stewardship
2026-06-27 18:22:09 +02:00
| `net-kingdom/docs/platform-identity-security-architecture.md` | Platform security canon |
Reference in a new issue Copy permalink