ops-warden/docs/adr/ADR-0010-ops-warden-is-staff.md

---
id: ops-warden-adr-0010
type: adr
title: "ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap"
domain: infotech
repo: ops-warden
status: accepted
version: "1.0"
revision: "1"
owner: ops-warden
binds: "ops-warden"
created: "2026-08-28"
updated: "2026-08-28"
last_reviewed: "2026-08-28"
review_interval: 3m
enforced_by: "INTENT.md layer declaration; docs/adr/ADR-0002; docs/adr/ADR-0003; docs/adr/ADR-0005; registry/routing/catalog.yaml delegation fields"
supersedes: ""
successor: ""
---

# ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap

## Status

Accepted 2026-08-28, answering intake `WARDEN-IN-0001` from gate-house, which
carries decision `GH-DEC-2026-001`. The standard being adopted —
`net-kingdom/canon/standards/security-layer-model_v0.1.md` — is `proposed`, and was
proposed pending assent from flex-auth, kings-guard, and ops-warden. This ADR is
ops-warden's half of that assent.

## Context

The estate acquired overlapping claims to the same responsibility, most visibly two
repositories describing themselves as the authorization control plane. The layer
model resolves the overlap by layering repositories on determinism — Taxonomy,
Tooling, Engines, Staff — and by two rules: Staff never touches Tooling directly
(§5), and `access-engine` is the only policy decision point (§6).

ops-warden is assigned Staff. Two demarcations follow that touch this repository:
the security curriculum it had been carrying belongs to gate-house, and the words
*access lane* and *access rule* are bound to different owners.

Full reasoning: `history/2026-08-28-security-layer-model-assent.md`.

## Decision

**1. ops-warden is Staff and declares it.** `INTENT.md` carries the layer label and
the §5 invariant. ops-warden holds no state another layer depends on at runtime and
renders no authorization decision — it consumes them.

**2. Lanes, not rules.** ops-warden owns *how* a worker reaches a host: SSH
certificate issuance, the routing catalog, `warden access`, `warden plan`,
`cert_command`. It never owns *whether* a worker may — that is `access-engine`
(today `flex-auth`), and ops-warden neither renders nor caches that decision. This
restates what `ADR-0002` and `ADR-0005` already bind; it is recorded here because
the demarcation is now normative estate-wide and other repositories rely on
ops-warden holding to it. The ruled rename `flex-auth` → `access-engine` is assented
to; ops-warden asks only for a window in which both names resolve.

**3. Doctrine goes to gate-house; runbooks stay here.** ops-warden does not restate
security doctrine, the authority model, or the curriculum. It references
gate-house's. It keeps everything operational about the lanes it stewards: which
subsystem owns which need, how to obtain a credential lane by lane, and conformance
evidence for its own lanes. `.claude/rules/credential-routing.md` is runbook, not
curriculum, and stays inlined in this and every other repository.

**4. One declared engine gap, not an exemption.** `src/warden/vault.py` (`VaultCA`)
is a direct OpenBao client performing a write from a Staff repository. It is a §5
non-conformance. ops-warden declares it rather than arguing it away:

- **intended owner:** `secrets-engine` (credential abstraction, custody, lifecycle)
- **blocked on:** no engine exposes an SSH certificate signing surface
- **review:** with this ADR, every 3 months

Until that surface exists, ops-warden continues to sign — refusing to would remove
production host access to close a documentation gap — and reports the position as
open. `warden desk`'s `bao kv put` is declared on the same terms. `taint.py` is
metadata-only observation, declared under §5's read-only allowance. `proxy.py`
supplies no authority of its own: it runs the owner's tool under the caller's
identity and is governed by `ADR-0002`.

This is `ADR-0003` turned inward. ops-warden has required an intended owner and a
blocker on 27 catalog lanes it holds for other repositories; it holds itself to the
same record.

## Consequences

ops-warden's conformance under §10 is *declared non-conformant with a tracked
closure path*, not clean. That is the accurate state and it is the state that gets
fixed, because it names an owner who can fix it.

An amendment to §5 has been offered to gate-house — a second sanctioned shape
alongside read-only diagnostics: a declared engine gap carrying intended owner,
blocker, and review date, machine-readable so §10 can tell a tracked gap from an
undeclared violation. It is offered, not assumed; §5 stays gate-house's to write. If
gate-house declines it, ops-warden's position is a plain non-conformance and is
reported as one.

The `NetKingdom Security Literacy` section stops being a prose second source for
`registry/routing/catalog.yaml`, which `ADR-0001` had already ruled against for
catalog procedure.

## Related

- `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed, gate-house)
- `gate-house/decisions/decisions.md` — `GH-DEC-2026-001`
- `history/2026-08-28-security-layer-model-assent.md`
- `ADR-0001`, `ADR-0002`, `ADR-0003`, `ADR-0005`, `ADR-0009`
- `WARDEN-IN-0001`