coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/registry/routing/catalog.yaml

1323 lines
75 KiB
YAML
Raw Normal View History

docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
# ops-warden routing catalog — POINTER LAYER
#
# This file is a machine-readable index of NetKingdom credential needs. It tells a
# worker WHICH subsystem owns a need and WHERE the authoritative doc is. It is NOT
# a second copy of any subsystem's procedure.
#
Lift ops-warden's binding rules into owned ADRs Five rules that governed this repo lived in wiki prose, a workplan, and a comment at the top of catalog.yaml. All were followed; none was addressable. A reader outside ops-warden could not cite one, could not tell whether it was current, and — the point of this change — could not tell whether it was ours to change or someone else's that we merely obey. ADR-0001 The routing catalog is a pointer layer, never a second copy ADR-0002 ops-warden is a transparent conduit, never a secret broker ADR-0003 Cover gaps, but never silently own them ADR-0004 High-risk lanes refuse raw value streaming to agent sessions ADR-0005 Implement one lane narrowly, route everything else Each carries owner: ops-warden, which is the load-bearing field. It says we follow the rule AND we are responsible for changing it — by superseding ADR, never an in-place edit. The failure this prevents runs both ways: a rule we own mistaken for inherited canon never gets fixed, because we wait for an owner who does not exist; inherited canon mistaken for ours gets quietly bent, and the drift is invisible until it breaks a repo that trusted the canonical version. Rules we follow but do not own — NetKingdom canon, the IAM profile, the credential-management standard, the-custodian's ADR-001 workplan convention — are cited, never copied into docs/adr/. Copying them would recreate exactly the second-source-of-truth failure ADR-0001 exists to prevent. architecture.md also now flags the three-digit/four-digit ADR-001 vs ADR-0001 collision, which is itself an ours-versus-inherited confusion waiting to happen. Publication verified rather than assumed: all five render through policy-nexus tools/render.py, and owner reaches the reader in three places — the page eyebrow (render.py:346), the index Owner column (build_site.py:123,137), and the publication manifest. build_site.py:179 makes title/status/owner required, so ownership cannot be dropped on the way out. policy-nexus publishes and never writes back; docs/adr/ stays the source of truth. Documentation adapted: SCOPE.md gains a Governing rules section and an orientation entry; .claude/rules/architecture.md replaced its stub with the ADR index, the owned-versus-inherited rule, and ADR-over-wiki precedence; finding-routing.md's ADR-gap section closed; catalog.yaml's no-double-source header now cites ADR-0001 rather than the originating workplan. uv run pytest -q → 338 passed, 4 deselected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 13:35:13 +02:00
# No-double-source rule (binding — docs/adr/ADR-0001-catalog-is-a-pointer-layer.md,
# owner: ops-warden; origin workplans/WARDEN-WP-0010-access-routing-charter.md):
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
# - For any subsystem ops-warden does not own, an entry carries identifiers +
# pointers ONLY: owner_repo, subsystem, wiki_ref, canon_ref, need_keywords.
# - Authored procedure (a `steps:` block and `cert_command:`) is allowed ONLY on
# entries with `warden_executes: true` — i.e. the SSH certificate lane, the one
# lane ops-warden owns.
# - A CI/test (WARDEN-WP-0011 T5) FAILS any non-SSH entry that carries a `steps`
# block, and checks that every `wiki_ref` anchor resolves to a real section.
# - No secret material in this file, ever.
#
# Field reference:
# id kebab-case stable identifier (lookup key)
# title human-readable need
# need_keywords tokens for `warden route find` keyword matching
# owner_repo repo/subsystem that owns the procedure
# subsystem platform component a worker acts on
# warden_executes true only for the SSH lane; false everywhere else
# wiki_ref anchor into an in-repo wiki section (authoritative restatement)
# canon_ref upstream net-kingdom doc the wiki section tracks
# reviewed date this pointer was last checked against canon (YYYY-MM-DD)
# status active (surfaced by default) | draft (hidden unless --all)
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
# workload_ref explicit workload applicability and authoritative join.
# Managed deployables use rapp_id + name (+ optional deployable);
# operational workloads use name + declaration_ref; unresolved
# applicable lanes carry unknown_reason; native non-workload
# subjects carry not-applicable + reason. Never infer from paths.
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
# steps ONLY when warden_executes: true
# cert_command ONLY when warden_executes: true
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
# delegation WP-0030 register. mode: native | interim | permanent.
# intended_owner required unless permanent; blocked_on required
# when interim. Absence is implicit interim with unknown owner.
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
version: 1
entries:
feat: complete local layer model v0.7 conformance work Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06eaf-3425-7f92-a0c2-bb4aa4faebe4
2026-09-05 01:19:48 +02:00
- id: netkingdom-layer-declaration
title: NetKingdom layer declaration and PEP stance-map route
risk: standard
workload_ref:
applicability: not-applicable
reason: "Repository conformance guidance, not a workload credential or runtime action."
need_keywords: [how, declare, layer, declaration, netkingdom, security, companion, pep, pep-shaped, stance, conformance, tooling, staff, engine]
owner_repo: ops-warden
subsystem: NetKingdom layer-conformance routing
warden_executes: false
wiki_ref: wiki/playbooks/netkingdom-layer-declaration.md#worker-checklist
canon_ref: net-kingdom/canon/standards/security-layer-model_v0.7.md
reviewed: "2026-09-04"
status: active
delegation:
mode: permanent
reviewed: "2026-09-04"
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: ssh-cert-host-access
title: Short-lived SSH certificate for host / ops reachability
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Emits a signed certificate — a public artifact. The private key never leaves the caller (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Generic certificate-signing lane; each actor resource must resolve its own target workload."
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
need_keywords: [ssh, certificate, cert, host, access, sign, adm, agt, atm, reachability, ops]
owner_repo: ops-warden
subsystem: ops-warden
warden_executes: true
wiki_ref: wiki/AccessRouting.md#issue-vs-route
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
reviewed: "2026-06-18"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: permanent
reviewed: "2026-08-15"
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
cert_command: "warden sign <actor> --pubkey <path>"
steps:
- "Confirm the actor is in inventory (`warden inventory list`); add with `warden inventory add` if not — see wiki/ActorInventoryPatterns.md."
- "Confirm the backend is configured (`warden status`) — local CA for labs, vault for production."
- "Sign: `warden sign <actor> --pubkey <path>` — cert is written to stdout (the cert_command contract)."
- "TTL is enforced per actor type: adm 48h / agt 24h / atm 8h. No long-lived keys."
Add ops-warden-warden-sign-token routing lane for RAILIANCE-WP-0005 T08 Document the railiance-platform credential broker as the owner-native path for scoped VAULT_TOKEN needs. Add catalog entry, playbook, and doc updates so warden route find ranks the broker lane first; manual export remains a documented fallback only.
2026-07-01 23:16:38 +02:00
- id: ops-warden-warden-sign-token
title: Scoped OpenBao token for ops-warden SSH signing (warden-sign)
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# A scoped VAULT_TOKEN is a credential in its own right. Graded on what the value is, not on whether ops-warden currently proxies it (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
name: ops-warden
declaration_ref: tenancy.yaml
Add ops-warden-warden-sign-token routing lane for RAILIANCE-WP-0005 T08 Document the railiance-platform credential broker as the owner-native path for scoped VAULT_TOKEN needs. Add catalog entry, playbook, and doc updates so warden route find ranks the broker lane first; manual export remains a documented fallback only.
2026-07-01 23:16:38 +02:00
need_keywords: [vault_token, vault, token, warden-sign, warden, ops-warden, signing, sign, smoke, flex-auth, credential, broker, lease, openbao, ssh, production]
owner_repo: railiance-platform
subsystem: OpenBao credential broker
warden_executes: false
wiki_ref: wiki/playbooks/ops-warden-warden-sign-token.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
reviewed: "2026-07-01"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Add ops-warden-warden-sign-token routing lane for RAILIANCE-WP-0005 T08 Document the railiance-platform credential broker as the owner-native path for scoped VAULT_TOKEN needs. Add catalog entry, playbook, and doc updates so warden route find ranks the broker lane first; manual export remains a documented fallback only.
2026-07-01 23:16:38 +02:00
# Concrete broker lane — RAILIANCE-WP-0005 pilot (live 2026-07-01):
# credential exec injects VAULT_TOKEN only into the child process; ops-warden
# issues SSH certs and never mints or holds OpenBao tokens.
auth_method: "railiance-platform credential broker (issuer via OPENBAO_TOKEN_FILE for apply; child tokens via grant)"
path_template: "credential-grants/catalog.yaml grant ops-warden/warden-sign"
fetch_command: "scripts/credential.py request --grant ops-warden/warden-sign --purpose ops-warden-sign --ttl 15m"
policy_ref: "flex-auth optional preflight per grant catalog"
exec_owner: railiance-platform
exec_command: "scripts/credential.py exec --grant ops-warden/warden-sign --ttl 15m -- <cmd>"
pointer_command: "make credential-exec-ops-warden-smoke"
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: true
steps:
- "This lane vends a short-lived (15m) child VAULT_TOKEN — routine renewal is just re-running `credential.py exec`; the token auto-expires, nothing to revoke."
- "To rotate the underlying grant/issuer: railiance-platform edits `credential-grants/catalog.yaml` for `ops-warden/warden-sign` (scope/policy) and re-mints the issuer token behind OPENBAO_TOKEN_FILE."
- "Verify capabilities-safe: `make credential-exec-ops-warden-smoke` and a `bao token capabilities` check on ssh/sign/{adm,agt,atm}-role (never read a value)."
Add ops-warden-warden-sign-token routing lane for RAILIANCE-WP-0005 T08 Document the railiance-platform credential broker as the owner-native path for scoped VAULT_TOKEN needs. Add catalog entry, playbook, and doc updates so warden route find ranks the broker lane first; manual export remains a documented fallback only.
2026-07-01 23:16:38 +02:00
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: openbao-api-key
title: API key, DB credential, or dynamic lease
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Wildcard lane over platform/workloads/<domain>/<workload>/<bundle>: its ceiling is the most dangerous bundle it can resolve to (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Generic credential-path pattern; concrete lanes carry the workload reference."
feat(WARDEN-WP-0014): T1 — structured handoff fields in routing catalog Adds optional assist-layer fields (auth_method, path_template, fetch_command, exec_capable, policy_ref) to RouteEntry, parsed and secret-screened in catalog.py. Handoff fields are templates/pointers only — _assert_no_secret_material rejects known token prefixes and high-entropy runs, and exec_capable requires a fetch_command. The openbao-api-key entry is populated as the reference example (covers the coulomb_social npm shape). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 16:00:56 +02:00
need_keywords: [api, key, secret, database, db, password, token, lease, openbao, vault, kv, dynamic, credential, npm, npm_auth_token, registry]
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
owner_repo: railiance-platform
subsystem: OpenBao
warden_executes: false
wiki_ref: wiki/CredentialRouting.md#routing-table
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
feat(WARDEN-WP-0014): T1 — structured handoff fields in routing catalog Adds optional assist-layer fields (auth_method, path_template, fetch_command, exec_capable, policy_ref) to RouteEntry, parsed and secret-screened in catalog.py. Handoff fields are templates/pointers only — _assert_no_secret_material rejects known token prefixes and high-entropy runs, and exec_capable requires a fetch_command. The openbao-api-key entry is populated as the reference example (covers the coulomb_social npm shape). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 16:00:56 +02:00
reviewed: "2026-06-27"
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
mode: native
intended_owner: railiance-platform
blocked_on: "NOT A DELEGABLE LANE. Refused by secrets-engine 2026-08-21: this is a generic routing template (path_template is a <domain>/<workload>/<bundle> pattern), not one secret lane, so there is no front door for anyone to own. ops-warden agrees. The concrete lanes it resolves to are delegated individually; this entry stays a pointer and should not be counted as an interim cover."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
feat(WARDEN-WP-0014): T1 — structured handoff fields in routing catalog Adds optional assist-layer fields (auth_method, path_template, fetch_command, exec_capable, policy_ref) to RouteEntry, parsed and secret-screened in catalog.py. Handoff fields are templates/pointers only — _assert_no_secret_material rejects known token prefixes and high-entropy runs, and exec_capable requires a fetch_command. The openbao-api-key entry is populated as the reference example (covers the coulomb_social npm shape). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 16:00:56 +02:00
# Structured handoff (WP-0014) — reference example. Templates only, no values.
# ops-warden does not own this secret; it advises and (exec_capable) proxies the
# fetch *as the caller* via `warden access`, never holding or persisting the value.
auth_method: "key-cape OIDC → bao login -method=oidc role=<domain>"
path_template: "platform/workloads/<domain>/<workload>/<bundle>"
fetch_command: "bao kv get -field=<FIELD> <path_template>"
policy_ref: "flex-auth check secret.read:<domain>"
exec_capable: true
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Generic template lane — rotate per the concrete workload's own catalog entry when one exists."
- "Provider re-mint (or OpenBao dynamic-secret rotation): mint a fresh value at the source, then `bao kv put <path> <FIELD>=@file` (value from a mode-0600 file, never on argv)."
- "For dynamic-lease secrets, revoke the old lease (`bao lease revoke`) instead of a KV put."
- "Verify capabilities-safe (`bao token capabilities` on the data path); notify consumers to re-fetch."
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
fix: route OpenBao platform administration login Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-22 19:08:21 +02:00
- id: openbao-platform-admin-login
title: Attended OpenBao platform administration login
# This is an identity bootstrap, not a secret value lane. The authority it
fix: contain attended OpenBao login output Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-23 01:31:05 +02:00
# establishes is high-risk. Safety does not rely on -no-print: Warden must
# preflight a private writable helper, contain both output streams, run only
# the reviewed child command, self-revoke, and remove the helper.
fix: route OpenBao platform administration login Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-22 19:08:21 +02:00
risk: high
workload_ref:
applicability: not-applicable
reason: "Attended human operator identity act; the governed admin operation supplies its own resource identity."
need_keywords: [openbao, platform-admin, platform, admin, administrator, first-time, bootstrap, database-engine, database/config, policy, policies, token-role, token-roles, mount, auth-role]
owner_repo: railiance-platform
subsystem: OpenBao operator OIDC via key-cape
warden_executes: false
wiki_ref: wiki/playbooks/openbao-platform-admin-login.md#worker-checklist
canon_ref: railiance-platform/docs/openbao.md
reviewed: "2026-08-22"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-08-22"
verified: source-read
auth_method: "attended KeyCape OIDC/MFA at OpenBao auth mount netkingdom, role platform-admin"
fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
exec_capable: true
lane: login
Route attended approval-client login to scoped OpenBao reader Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 01:46:46 +02:00
- id: secrets-engine-approval-client-login
title: Attended secrets-engine approval client reader login
risk: high
workload_ref:
applicability: not-applicable
reason: "Attended operator identity for the exact CCR-2026-0019 reader."
need_keywords: [secrets-engine, approval-client, reader, login, ccr-2026-0019]
owner_repo: railiance-platform
subsystem: OpenBao scoped operator OIDC via KeyCape
warden_executes: false
wiki_ref: wiki/playbooks/secrets-engine-approval-client-login.md
canon_ref: railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml
reviewed: "2026-09-14"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-09-14"
verified: source-read
auth_method: "attended KeyCape OIDC, netkingdom role secrets-engine-approval-client-workload-kv-read"
fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=secrets-engine-approval-client-workload-kv-read"
exec_capable: true
lane: login
Route attended T03 requester login to scoped owner reader Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
2026-09-14 02:47:32 +02:00
- id: secrets-engine-requester-login
title: Attended T03 create-only requester reader login
risk: high
workload_ref:
applicability: not-applicable
reason: "Attended operator identity for the exact CCR-2026-0025 reader."
need_keywords: [secrets-engine, approval-requester, reader, login, ccr-2026-0025]
owner_repo: railiance-platform
subsystem: OpenBao scoped operator OIDC via KeyCape
warden_executes: false
wiki_ref: wiki/playbooks/secrets-engine-requester-login.md
canon_ref: railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml
reviewed: "2026-09-14"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-09-14"
verified: source-read
auth_method: "attended KeyCape OIDC, netkingdom role secrets-engine-requester-workload-kv-read"
fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=secrets-engine-requester-workload-kv-read"
exec_capable: true
lane: login
Add informed-decision-sitting-requester reader login lane. Exact CCR-2026-0027 OIDC role. No secret fetch. Platform owns the reviewed exchange-proof child. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
2026-09-15 20:38:47 +02:00
- id: informed-decision-sitting-requester-login
title: Attended Informed Decision sitting-requester reader login
risk: high
workload_ref:
applicability: not-applicable
reason: "Attended operator identity for the exact CCR-2026-0027 reader."
need_keywords: [informed-decision, sitting-requester, reader, login, ccr-2026-0027]
owner_repo: railiance-platform
subsystem: OpenBao scoped operator OIDC via KeyCape
warden_executes: false
wiki_ref: wiki/playbooks/informed-decision-sitting-requester-login.md
canon_ref: railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml
reviewed: "2026-09-15"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-09-15"
verified: source-read
auth_method: "attended KeyCape OIDC, netkingdom role informed-decision-sitting-requester-workload-kv-read"
fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=informed-decision-sitting-requester-workload-kv-read"
exec_capable: true
lane: login
fix: route OpenBao recovery ceremonies safely Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-22 20:54:45 +02:00
- id: openbao-shamir-recovery-ceremony
title: Attended OpenBao Shamir seal and unseal recovery ceremony
# A ceremony pointer, not a credential-value lane. Approval coordinates
# existing out-of-band custodians; Warden never requests or transports a share.
risk: high
workload_ref:
applicability: not-applicable
reason: "Attended platform trust-root ceremony; no workload credential is retrieved."
need_keywords: [openbao, shamir, seal, unseal, sealed, emergency, recovery, break-glass, quorum, share, shares, custodian, ceremony, raft, snapshot, provider-console, abort, attended]
owner_repo: railiance-platform
subsystem: OpenBao operator recovery
warden_executes: false
wiki_ref: wiki/playbooks/openbao-shamir-recovery-ceremony.md#worker-checklist
canon_ref: railiance-platform/docs/railiance01-coordinated-reboot.md
reviewed: "2026-08-22"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-08-22"
verified: source-read
lane: ceremony
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
- id: whynot-design-npm-publish
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
title: whynot-design npm publish token (@whynot/design → coulomb Forgejo registry)
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Publish rights to the package registry — a leaked token is a supply-chain write, not a read (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "whynot-design has not published an authoritative workload identity declaration."
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
need_keywords: [whynot-design, whynot, npm, publish, npm_auth_token, forgejo, registry, coulomb, package]
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
owner_repo: railiance-platform
subsystem: OpenBao
warden_executes: false
wiki_ref: wiki/playbooks/whynot-design-npm-publish.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
reviewed: "2026-09-04"
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: secrets-engine
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0001 (commit 8f617fc):
# status=active, access_frontdoor.readiness=ready, resolvable=true; positive fetch
# passed and negative (non-whynot) login denied. Zero-placeholder fetch: an automated
# caller can `warden access whynot-design-npm-publish --exec -- npm publish` directly.
# The path was corrected to the `coulomb` tenant — the whynot-design/whynot-design/…
# form is superseded; do not reintroduce it.
auth_method: "bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read"
path_template: "platform/workloads/coulomb/whynot-design/npm-publish"
fix: name the npm KV field, not the env var it becomes secrets-engine corrected our claim (msg 15f0c0ca): `npm_token` is the KV field on the whynot-design publish lane; `NPM_AUTH_TOKEN` is the environment variable their publication-scope policy injects. Their doc lists the two as separate rows and we had copied the env var in as the field name, so our `fetch_command` named a field that does not exist -- `bao kv get -field=NPM_AUTH_TOKEN` could only ever have failed. This is ADR-0001's failure mode, not a typo: a pointer layer restating an owner's procedure and getting it wrong. Corrected from the owner's statement rather than re-derived here, and the catalog now records the distinction inline so the env var does not get copied back in. The path is a separate and still-open question. secrets-engine declined to resolve it unilaterally -- which location backs the lane for reads is railiance-platform's custody state -- so the path is unchanged and routed to them rather than moved on a coordination message. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-09 14:43:44 +02:00
# Field corrected 2026-09-09 on the owner's statement (secrets-engine msg
# 15f0c0ca): `npm_token` is the KV FIELD; `NPM_AUTH_TOKEN` is the environment
# variable the publication-scope policy injects, and ops-warden had copied the
# env var in as the field name. That is ADR-0001's failure mode exactly — a
# pointer layer restating an owner's procedure and getting it wrong — so it is
# corrected from the owner's doc (secrets-engine docs/whynot-design-real-publish-closeout.md),
# never re-derived here. The path is a separate question, open with
# railiance-platform; do not change it on this correction.
fetch_command: "bao kv get -field=npm_token platform/workloads/coulomb/whynot-design/npm-publish"
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
policy_ref: "flex-auth check secret.read:whynot-design"
exec_capable: true
lane: secret
feat(WARDEN-WP-0019): route secret-exec lanes to secrets-engine (route-primary, proxy fallback) secrets-engine (SECRETS-WP-0003) shipped a native secret-exec front door (`secrets-engine route/exec`, decision e6381a56) and asked ops-warden to route to it. Bernd's call: route-primary, proxy-fallback — surface the secrets-engine exec as the primary path for owned lanes, keep `warden access --exec` as a transparent fallback. T1 — RouteEntry gains exec_owner/exec_command/pointer_command (+ has_native_exec), screened for secret material like the other handoff fields. whynot-design-npm-publish points its native exec at secrets-engine. `warden access` renders Primary (secrets-engine exec) + Fallback (warden proxy); route/access JSON gain the fields and a native-exec-aware next_action. Tests added; 217 pass, lint clean. T2 — credential-routing.md adds secrets-engine as the secret-exec owner (route primary, proxy fallback); SCOPE adds secrets-engine to Related Repos and records the npm lane as production-exercised (@whynot/design@0.4.0); playbook leads with secrets-engine exec and fixes the fallback one-liner (--field NPM_AUTH_TOKEN, --no-policy) per whynot-design. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 17:41:49 +02:00
# Owner-native exec front door (WP-0019, secrets-engine SECRETS-WP-0003, decision
# e6381a56): route-primary, proxy-fallback. The secrets-engine exec is the primary
# path; warden access --fetch/--exec remains a transparent fallback.
exec_owner: secrets-engine
exec_command: "secrets-engine exec --catalog whynot-design-npm-publish -- <cmd>"
pointer_command: "secrets-engine route whynot-design-npm-publish --json"
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
- "In the coulomb Forgejo registry, revoke the current @whynot/design publish token and generate a new one (scope: package read/write) for the whynot-design publish identity."
fix: name the npm KV field, not the env var it becomes secrets-engine corrected our claim (msg 15f0c0ca): `npm_token` is the KV field on the whynot-design publish lane; `NPM_AUTH_TOKEN` is the environment variable their publication-scope policy injects. Their doc lists the two as separate rows and we had copied the env var in as the field name, so our `fetch_command` named a field that does not exist -- `bao kv get -field=NPM_AUTH_TOKEN` could only ever have failed. This is ADR-0001's failure mode, not a typo: a pointer layer restating an owner's procedure and getting it wrong. Corrected from the owner's statement rather than re-derived here, and the catalog now records the distinction inline so the env var does not get copied back in. The path is a separate and still-open question. secrets-engine declined to resolve it unilaterally -- which location backs the lane for reads is railiance-platform's custody state -- so the path is unchanged and routed to them rather than moved on a coordination message. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-09 14:43:44 +02:00
- "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish npm_token=@file` (value from a mode-0600 file). The field is `npm_token`; `NPM_AUTH_TOKEN` is the injected env var, not a KV key."
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
- "Verify capabilities-safe, then publish a fresh version and confirm it with Forgejo-supported `npm view <package>@<version>` through the governed execution lane (value used, not printed)."
feat(WARDEN-WP-0018): activate whynot-design npm publish lane + resolvable flag railiance-platform finished provisioning the whynot-design npm publish lane (CCR-2026-0001, commit 8f617fc: active, readiness=ready, resolvable=true, positive fetch + negative denial verified). First concrete warden access --fetch-resolvable non-SSH lane — end-to-end proof of the WP-0014 conduit + WP-0017 discoverability. T1 — catalog entry whynot-design-npm-publish (active, exec_capable) with the owner-confirmed zero-placeholder handoff: path platform/workloads/coulomb/whynot-design/ npm-publish (the superseded whynot-design/whynot-design/... form is not used), field NPM_AUTH_TOKEN, OIDC role whynot-design-workload-kv-read, policy + flex-auth ref. Added wiki/playbooks/whynot-design-npm-publish.md. T2 — RouteEntry.resolvable (active + exec_capable + no <…> placeholder), surfaced in route/access --json; Catalog.find resolves an exact catalog-id first so `warden access whynot-design-npm-publish` is deterministic. Tests added; fixed a no-match test query that substring-collided (no ⊂ whynot). 213 pass, lint clean. T3 — notified whynot-design (zero-placeholder command + resolvable gate + path correction) and confirmed activation to railiance-platform. Sibling lanes stay draft per their deferral. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 00:32:00 +02:00
feat: route Policy Nexus source credential Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
2026-09-01 00:46:28 +02:00
- id: policy-nexus-forgejo-source-read
title: Policy Nexus Forgejo private-source repository read token
# Read-only at Forgejo, but disclosure grants estate-wide private source access.
# Agent callers therefore remain inside Warden's sanctioned transport boundary.
risk: high
workload_ref:
applicability: applicable
unknown_reason: "policy-nexus-actions has not published an authoritative workload identity declaration."
need_keywords: [policy-nexus, policy, nexus, forgejo, private, source, repository, read, token, actions, FORGEJO_SOURCE_TOKEN]
owner_repo: railiance-platform
subsystem: OpenBao + Forgejo Actions
warden_executes: false
wiki_ref: wiki/playbooks/policy-nexus-forgejo-source-read.md#worker-checklist
canon_ref: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
reviewed: "2026-09-01"
status: active
delegation:
mode: native
intended_owner: railiance-platform
reviewed: "2026-09-01"
verified: source-read
auth_method: "bao login -method=oidc -path=netkingdom role=policy-nexus-forgejo-source-workload-kv-read"
path_template: "platform/workloads/policy-nexus/forgejo-source-read"
fetch_command: "bao kv get -field=FORGEJO_SOURCE_TOKEN platform/workloads/policy-nexus/forgejo-source-read"
policy_ref: "flex-auth check secret.read:policy-nexus"
exec_capable: true
lane: secret
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Mint a replacement PAT for the restricted policy-nexus-source identity with scope exactly read:repository; retain the predecessor until verification passes."
- "Use the attended railiance-platform bootstrap to update OpenBao and the coulomb/policy-nexus FORGEJO_SOURCE_TOKEN Actions secret without exposing the value."
- "Pass one exact-commit candidate workflow, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0014."
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: flex-auth-policy-check
title: Authorization decision — may this actor perform this action
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Generic authorization action; the governed resource supplies workload identity."
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
need_keywords: [authorization, policy, permission, allow, deny, may, flex-auth, topaz, pdp, decision]
owner_repo: flex-auth
subsystem: flex-auth
warden_executes: false
wiki_ref: wiki/CredentialRouting.md#quick-decision-tree
canon_ref: net-kingdom/docs/responsibility-map.md
reviewed: "2026-06-18"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: flex-auth
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: key-cape-oidc-login
title: Interactive login, OIDC token, or MFA
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Interactive browser OIDC: a login flow, not a KV read. No stored value is fetched, and warden access already excludes is_login from raw-value streaming (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Interactive login action; caller identity is native context, not a workload target."
feat(WARDEN-WP-0014): T4 — key-cape login orchestration lane Adds a lane: secret|login field to RouteEntry. The login lane is an interactive auth bootstrap: it skips the caller-auth precheck (no token yet — that's the point) and the secret-read gate (it establishes the identity the gate needs), runs the owner's login command interactively as the caller via inherited stdio, and rejects --exec. The token stays in the caller's own store; warden never captures it (G2 holds). Audited as action: login. key-cape-oidc-login populated as the reference login entry. Advisory proxy hint updated now that T3 has shipped. 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:31:55 +02:00
need_keywords: [login, oidc, identity, mfa, token, jwt, sso, keycloak, key-cape, iam, claims, authenticate, signin]
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
owner_repo: key-cape
subsystem: key-cape / Keycloak
warden_executes: false
wiki_ref: wiki/CredentialRouting.md#quick-decision-tree
canon_ref: net-kingdom/docs/canon/standards/iam-profile_v0.2.md
feat(WARDEN-WP-0014): T4 — key-cape login orchestration lane Adds a lane: secret|login field to RouteEntry. The login lane is an interactive auth bootstrap: it skips the caller-auth precheck (no token yet — that's the point) and the secret-read gate (it establishes the identity the gate needs), runs the owner's login command interactively as the caller via inherited stdio, and rejects --exec. The token stays in the caller's own store; warden never captures it (G2 holds). Audited as action: login. key-cape-oidc-login populated as the reference login entry. Advisory proxy hint updated now that T3 has shipped. 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:31:55 +02:00
reviewed: "2026-06-27"
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
intended_owner: key-cape
docs: narrow qonto blocker, record key-cape lane ownership key-cape corrected two blockers that had stopped being true after our 2026-08-28 source-read: - rapp-qonto-keycape-client: `keycape service-token` (2026-09-05) is the native exchange the blocker recorded as absent, and `keycape verify-client` (2026-09-08) is rotation step 3 as one command. Narrowed to steps 1-2 -- successor generation and the CAS write -- rather than cleared, as they asked. rotation.automatable -> false so a future executable driver is not told a lane with no admitted custody transport is drivable; the per-step truth moves into the steps. - key-cape-oidc-login: ownership ACCEPTED by key-cape, so verified moves from asked-and-waiting to owner-confirmed. Lane stays interim -- acceptance covers the identity half, while the fetch_command yields an OpenBao token whose mount, role mapping and enforcement are not key-cape's. Two tests pinned `key-cape-oidc-login` to sitting `asked-and-waiting`, so answering the question broke them -- they failed on good news. Both now assert the property instead: an unverified blocker is stale regardless of date, over whatever lanes are in that state. Verifying the routing answer against our own front door turned up a defect: `warden plan` returns `autonomous` for a custody *write* and answers it with read transports, because it has no read-versus-mutate intent. Recorded as WARDEN-WP-0038 (proposed) -- the WP-0033-T06 shape, as a class this time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-08 14:55:02 +02:00
blocked_on: "ACCEPTED by key-cape 2026-09-08 (msg 12f1bdfa): key-cape owns interactive login, OIDC identity-token issuance and MFA for this lane, confirming the 2026-08-28 correction of intended_owner from secrets-engine (whose 2026-08-21 refusal was right). Lane stays interim because the accepted ownership covers only the identity half: the fetch_command yields an OPENBAO token, and the netkingdom auth mount, the role=<domain> mapping, the token store and its enforcement are OpenBao's, with role/policy definition railiance-platform's. keycape login is not a drop-in — it yields a key-cape issuer JWT written to a private file, a different credential type with a different verifier (KEY-WP-0014-T04). Retires when a key-cape-native front door yields the credential this route's consumers expect, or when the route is deliberately re-contracted to a JWT. Verified against key-cape docs/native-authentication.md, docs/openbao-service-auth-contract.md, config/service-clients.example.yaml, src/internal/server/oidc/discovery.go."
reviewed: "2026-09-08"
verified: owner-confirmed
feat(WARDEN-WP-0014): T4 — key-cape login orchestration lane Adds a lane: secret|login field to RouteEntry. The login lane is an interactive auth bootstrap: it skips the caller-auth precheck (no token yet — that's the point) and the secret-read gate (it establishes the identity the gate needs), runs the owner's login command interactively as the caller via inherited stdio, and rejects --exec. The token stays in the caller's own store; warden never captures it (G2 holds). Audited as action: login. key-cape-oidc-login populated as the reference login entry. Advisory proxy hint updated now that T3 has shipped. 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:31:55 +02:00
# Login lane (WP-0014 T4) — interactive auth bootstrap, not a secret read. No
# secret-read gate (you have no identity yet) and no caller-auth precheck (the
# point is to obtain one). warden runs it interactively as the caller and never
# captures the resulting token — the owner tool writes it to the caller's store.
lane: login
feat(routing): repoint whynot npm lane to Forgejo Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
2026-09-04 23:39:11 +02:00
auth_method: "browser OIDC via key-cape / Keycloak at auth/netkingdom"
fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=<domain>"
feat(WARDEN-WP-0014): T4 — key-cape login orchestration lane Adds a lane: secret|login field to RouteEntry. The login lane is an interactive auth bootstrap: it skips the caller-auth precheck (no token yet — that's the point) and the secret-read gate (it establishes the identity the gate needs), runs the owner's login command interactively as the caller via inherited stdio, and rejects --exec. The token stays in the caller's own store; warden never captures it (G2 holds). Audited as action: login. key-cape-oidc-login populated as the reference login entry. Advisory proxy hint updated now that T3 has shipped. 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 17:31:55 +02:00
exec_capable: true
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: ops-bridge-tunnel
title: SSH tunnel or port forward
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Routes to ops-bridge and supplies a cert_command; no secret value flows (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "ops-bridge has not published the operational tunnel workload declaration."
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
need_keywords: [tunnel, port, forward, bridge, ops-bridge, reverse, transport, ssh-tunnel, cert_command]
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
owner_repo: ops-bridge
subsystem: ops-bridge
warden_executes: false
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
wiki_ref: wiki/playbooks/ops-bridge-tunnel-cert.md#migration-checklist
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
feat: close WP-0009/WP-0013 production integration stewardship strand Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00
reviewed: "2026-06-24"
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: ops-bridge
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: railiance-infra-principals
title: Host SSH principal file or force-command deployment
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Principal-file deployment via Ansible; no secret value flows (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Host principal-file deployment is an infrastructure action, not a workload."
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
need_keywords: [principal, auth_principals, force-command, host, sshd, hardening, railiance-infra, ansible]
owner_repo: railiance-infra
subsystem: railiance-infra
warden_executes: false
wiki_ref: wiki/CredentialRouting.md#routing-table
canon_ref: net-kingdom/docs/responsibility-map.md
reviewed: "2026-06-18"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: railiance-infra
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
feat(WP-0012): add inter-hub-bootstrap-ssh catalog entry and align wiki Promote Inter-Hub bootstrap lane to active catalog with worker checklist, attended/unattended branches, and flex-auth/OpenBao pointers. Mark WP-0012 T2/T3 done; ops-bridge tunnel playbook shipped in prior WP-0013 commit.
2026-06-24 12:45:23 +02:00
- id: inter-hub-bootstrap-ssh
title: Inter-Hub bootstrap SSH envelope
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Graded high conservatively: ops-warden could not establish from the lane definition that no key material moves in the envelope. Regrade with evidence, do not assume down (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The inter-hub bootstrap execution unit has no authoritative workload declaration."
feat(WP-0012): add inter-hub-bootstrap-ssh catalog entry and align wiki Promote Inter-Hub bootstrap lane to active catalog with worker checklist, attended/unattended branches, and flex-auth/OpenBao pointers. Mark WP-0012 T2/T3 done; ops-bridge tunnel playbook shipped in prior WP-0013 commit.
2026-06-24 12:45:23 +02:00
need_keywords: [inter-hub, interhub, bootstrap, ops-hub, agt-interhub-bootstrap, envelope, force-command, CUST-WP-0049]
owner_repo: ops-warden
subsystem: ops-warden + railiance-infra
warden_executes: false
wiki_ref: wiki/InterHubBootstrapAccessLane.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
reviewed: "2026-06-24"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: railiance-infra
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
Add activity-core-issue-sink routing playbook and catalog entry Agents can discover the activity-core → issue-core emission contract via `warden route show activity-core-issue-sink` instead of messaging ops-warden for ISSUE_CORE_API_KEY. The playbook points at owner-repo docs per the no-double-source rule.
2026-06-18 22:34:59 +02:00
- id: activity-core-issue-sink
title: activity-core IssueSink → issue-core REST emission
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Emission routing only — the API key is a separate lane (WARDEN-WP-0032-T05).
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "activity-core has not published an authoritative workload identity declaration."
Add activity-core-issue-sink routing playbook and catalog entry Agents can discover the activity-core → issue-core emission contract via `warden route show activity-core-issue-sink` instead of messaging ops-warden for ISSUE_CORE_API_KEY. The playbook points at owner-repo docs per the no-double-source rule.
2026-06-18 22:34:59 +02:00
need_keywords: [activity-core, issue-sink, issue-core, emission, issue_core_url, issue_core_api_key, tasks, ingest, rest, issuesink]
owner_repo: activity-core
subsystem: activity-core + issue-core
warden_executes: false
wiki_ref: wiki/playbooks/activity-core-issue-sink.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
Refresh the activity-core issue-sink lane; close WP-0032-T01 issue-core asked us to drop a CoulombCore/port-18765 bridge topology from activity-core-issue-sink. That topology was never in this repo — the only address the playbook carried was a local-dev 127.0.0.1:8765 example. What was actually stale was step 5, which still told workers to coordinate with railiance-platform "when the canonical path ships"; it shipped 2026-07-02 and the lane is active. So: point at issue-core's SCOPE.md for the production address rather than restating it here (ADR-0001), state plainly that no bridge or forwarded port is involved so the next reader does not re-derive the retired topology, and route step 5 through warden route / warden rotate-guide instead of a read. WP-0032-T01 closes as done. What was owed was inputs, not a design, and ZONE-WP-0001-T02 is done carrying all of them — including the two that were corrections to ops-warden's own claims (organization_posture, refused by net-kingdom; and the workload join key, which this repo wrongly said did not exist anywhere). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 00:43:42 +02:00
reviewed: "2026-08-21"
Add activity-core-issue-sink routing playbook and catalog entry Agents can discover the activity-core → issue-core emission contract via `warden route show activity-core-issue-sink` instead of messaging ops-warden for ISSUE_CORE_API_KEY. The playbook points at owner-repo docs per the no-double-source rule.
2026-06-18 22:34:59 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: activity-core
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Add activity-core-issue-sink routing playbook and catalog entry Agents can discover the activity-core → issue-core emission contract via `warden route show activity-core-issue-sink` instead of messaging ops-warden for ISSUE_CORE_API_KEY. The playbook points at owner-repo docs per the no-double-source rule.
2026-06-18 22:34:59 +02:00
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
- id: issue-core-ingestion-api-key
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
title: issue-core ingestion API key (OpenBao KV + ESO)
WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008 secrets-engine reviewed our catalog metadata while drafting their five entries and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high. We had both as standard, and had deliberately regraded them DOWN on 2026-08-19. They are right. Both paths carry a second credential our grade never looked at -- GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the credential the lane is named after. The defect is structural: we graded the lane by its headline field, but a read returns every field at the path. Worse, the evidence was already in the CCRs we cite as authoritative -- not missing, unread -- and a test asserted the wrong answer, so a correct first-pass grade got overruled by it. ADR-0008 records the rule: a grade covers every field its path discloses. ADR-0007 is unchanged and still governs; this says what the grade is of. Six of the remaining standard lanes have no KV path. Two have paths and no field evidence; per ADR-0008 they are stated as unknown rather than assumed, and left for operator-sanctioned grading. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:36:42 +02:00
# Regraded standard -> high 2026-08-21 (WARDEN-WP-0033-T02). The T05 grade below
# was wrong, and wrong systematically: it graded the headline field, not the path.
# was: "Ordinary internal workload secret: an ingestion key for a first-party
# service. Rotatable, no spend, no tenant data, no admin scope."
# CCR-2026-0002 records a deliberate field-set decision to keep GITEA_BACKEND_TOKEN
# at this path alongside the ingestion key, and a read discloses every field there.
# A Forgejo backend token is not recovered by rotating an ingestion key.
# Found by secrets-engine reviewing SECRETS-WP-0006 -- not by us.
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
rapp_id: rapp-issue-core
name: issue-core
deployable: issue-core
WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008 secrets-engine reviewed our catalog metadata while drafting their five entries and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high. We had both as standard, and had deliberately regraded them DOWN on 2026-08-19. They are right. Both paths carry a second credential our grade never looked at -- GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the credential the lane is named after. The defect is structural: we graded the lane by its headline field, but a read returns every field at the path. Worse, the evidence was already in the CCRs we cite as authoritative -- not missing, unread -- and a test asserted the wrong answer, so a correct first-pass grade got overruled by it. ADR-0008 records the rule: a grade covers every field its path discloses. ADR-0007 is unchanged and still governs; this says what the grade is of. Six of the remaining standard lanes have no KV path. Two have paths and no field evidence; per ADR-0008 they are stated as unknown rather than assumed, and left for operator-sanctioned grading. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:36:42 +02:00
fields: [ISSUE_CORE_API_KEY, GITEA_BACKEND_TOKEN] # CCR-2026-0002
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
need_keywords: [issue-core, ingestion, api, key, openbao, issue_core_api_key, eso, external-secrets]
owner_repo: railiance-platform
subsystem: OpenBao + issue-core + activity-core
warden_executes: false
wiki_ref: wiki/playbooks/issue-core-ingestion-api-key.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
reviewed: "2026-07-02"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: secrets-engine
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: owner-confirmed
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0002 / RAILIANCE-WP-0009
# (promoted 2026-07-02): policy workload-kv-read-issue-core-runtime and k8s auth role
# external-secrets-issue-core applied; ExternalSecret issue-core/issue-core-runtime
# SecretSynced; positive + negative access verified with OpenBao audit evidence.
# Production consumer is ESO; warden access proxies reads as the caller (caller's own
# OpenBao authority) and never holds the value.
auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-issue-core-runtime)"
path_template: "platform/workloads/issue-core/issue-core/issue-core-runtime"
fetch_command: "bao kv get -field=ISSUE_CORE_API_KEY platform/workloads/issue-core/issue-core/issue-core-runtime"
policy_ref: "flex-auth check secret.read:issue-core"
exec_capable: true
lane: secret
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Mint a new issue-core ingestion API key at the issue-core admin surface; keep the old one until consumers cut over."
- "`bao kv put platform/workloads/issue-core/issue-core/issue-core-runtime ISSUE_CORE_API_KEY=@file` (value from a mode-0600 file)."
- "ESO re-syncs ExternalSecret issue-core/issue-core-runtime; roll consumers, then revoke the old key at the source."
- "Verify capabilities-safe on the data path (`bao token capabilities`); never read the value to confirm."
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
Add routing catalog entry for reuse-surface hub write token. REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2026-07-07 00:52:39 +02:00
- id: reuse-surface-hub-write-token
title: reuse-surface federation hub write bearer token
WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008 secrets-engine reviewed our catalog metadata while drafting their five entries and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high. We had both as standard, and had deliberately regraded them DOWN on 2026-08-19. They are right. Both paths carry a second credential our grade never looked at -- GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the credential the lane is named after. The defect is structural: we graded the lane by its headline field, but a read returns every field at the path. Worse, the evidence was already in the CCRs we cite as authoritative -- not missing, unread -- and a test asserted the wrong answer, so a correct first-pass grade got overruled by it. ADR-0008 records the rule: a grade covers every field its path discloses. ADR-0007 is unchanged and still governs; this says what the grade is of. Six of the remaining standard lanes have no KV path. Two have paths and no field evidence; per ADR-0008 they are stated as unknown rather than assumed, and left for operator-sanctioned grading. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:36:42 +02:00
# Regraded standard -> high 2026-08-21 (WARDEN-WP-0033-T02), same defective T05
# pass as issue-core-ingestion-api-key.
# was: "Ordinary internal workload secret. Write access to a first-party
# federation surface; damaging to forge, but rotatable and internal."
# CCR-2026-0005 declares REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET at this path: a
# dual-consumer HMAC that must stay aligned with Forgejo org webhook id=1 on
# rotation. Disclosure lets an attacker forge webhook deliveries into the
# federation hub, which rotating the write token alone does not undo.
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "reuse-surface has not published an authoritative workload identity declaration."
WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008 secrets-engine reviewed our catalog metadata while drafting their five entries and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high. We had both as standard, and had deliberately regraded them DOWN on 2026-08-19. They are right. Both paths carry a second credential our grade never looked at -- GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the credential the lane is named after. The defect is structural: we graded the lane by its headline field, but a read returns every field at the path. Worse, the evidence was already in the CCRs we cite as authoritative -- not missing, unread -- and a test asserted the wrong answer, so a correct first-pass grade got overruled by it. ADR-0008 records the rule: a grade covers every field its path discloses. ADR-0007 is unchanged and still governs; this says what the grade is of. Six of the remaining standard lanes have no KV path. Two have paths and no field evidence; per ADR-0008 they are stated as unknown rather than assumed, and left for operator-sanctioned grading. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:36:42 +02:00
fields: [REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET] # CCR-2026-0005
Migrate reuse-surface hub token lane to OpenBao handoff RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog, playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets; kubectl documented as break-glass only.
2026-07-07 22:38:45 +02:00
need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, reuse.coulomb.social]
owner_repo: railiance-platform
subsystem: OpenBao + reuse-surface
Add routing catalog entry for reuse-surface hub write token. REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2026-07-07 00:52:39 +02:00
warden_executes: false
wiki_ref: wiki/playbooks/reuse-surface-hub-write-token.md#worker-checklist
canon_ref: reuse-surface/specs/FederationHubAPI.md
reviewed: "2026-07-07"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: secrets-engine
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: owner-confirmed
Migrate reuse-surface hub token lane to OpenBao handoff RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog, playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets; kubectl documented as break-glass only.
2026-07-07 22:38:45 +02:00
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011
# (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
# positive + negative access verified. Production consumer is ESO; warden access
# proxies reads as the caller and never holds the value.
auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)"
path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets"
fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets"
policy_ref: "flex-auth check secret.read:reuse"
Add routing catalog entry for reuse-surface hub write token. REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2026-07-07 00:52:39 +02:00
exec_capable: true
Migrate reuse-surface hub token lane to OpenBao handoff RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog, playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets; kubectl documented as break-glass only.
2026-07-07 22:38:45 +02:00
resolvable: true
Add routing catalog entry for reuse-surface hub write token. REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2026-07-07 00:52:39 +02:00
lane: secret
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Generate a new reuse-surface federation hub write bearer token at reuse.coulomb.social; if the Forgejo webhook secret rotates too, regenerate REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET alongside it."
- "`bao kv put platform/workloads/reuse/reuse-surface/runtime-secrets REUSE_SURFACE_TOKEN=@file` (and the webhook field if changed)."
- "ESO re-syncs reuse/reuse-surface-runtime → reuse-surface-env on Railiance01; roll the consumer; update the Forgejo webhook config if the secret changed; revoke the old token."
- "Verify capabilities-safe on the data path (`bao token capabilities`)."
Add routing catalog entry for reuse-surface hub write token. REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2026-07-07 00:52:39 +02:00
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
- id: openrouter-llm-connect
title: OpenRouter API key for llm-connect in activity-core
need_keywords: [openrouter, llm, llm-connect, api, key, activity-core, gemini, provider, openrouter_api_key]
owner_repo: railiance-platform
subsystem: OpenBao + activity-core
warden_executes: false
wiki_ref: wiki/playbooks/openrouter-llm-connect.md#worker-checklist
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
reviewed: "2026-07-02"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: secrets-engine
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: owner-confirmed
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
# High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "llm-connect has not published an authoritative workload identity declaration."
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0003 / RAILIANCE-WP-0010
# (promoted 2026-07-02): policy workload-kv-read-llm-connect-provider-secrets and k8s
# auth role external-secrets-activity-core applied; ExternalSecret
# activity-core/llm-connect-provider-secrets SecretSynced and llm-connect rolled out on
# the OpenBao-delivered value; positive + negative access verified with audit evidence.
# Production consumer is ESO; warden access proxies reads as the caller and never holds
# the provider key.
auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-llm-connect-provider-secrets)"
path_template: "platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets"
fetch_command: "bao kv get -field=OPENROUTER_API_KEY platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets"
policy_ref: "flex-auth check secret.read:llm-connect"
exec_capable: true
lane: secret
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Create a new key in the OpenRouter dashboard for the llm-connect identity; keep the old key active until rollout completes."
- "`bao kv put platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets OPENROUTER_API_KEY=@file` (value from a mode-0600 file)."
- "ESO re-syncs activity-core/llm-connect-provider-secrets; roll out llm-connect on the new value; then delete the old OpenRouter key."
- "Verify capabilities-safe on the data path (`bao token capabilities`)."
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
Add draft catalog lane for railiance backup offsite credentials. Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
2026-07-07 17:16:30 +02:00
- id: railiance-backup-offsite-lane
title: Railiance offsite backup Nextcloud WebDAV credentials
need_keywords: [railiance, backup, nextcloud, webdav, offsite, age, forgejo-backup, NC_WEBDAV_TOKEN, file drop]
owner_repo: railiance-platform
subsystem: OpenBao + Nextcloud
warden_executes: false
wiki_ref: wiki/playbooks/railiance-backup-offsite-lane.md#worker-checklist
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
reviewed: "2026-07-16"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: railiance-platform
blocked_on: "Rotation is re-establish, a multi-step procedure ops-warden only describes"
reviewed: "2026-08-11"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
# High-risk: WebDAV upload token + AGE recovery escrow (WP-0026 T04).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The backup execution unit has no authoritative workload identity declaration."
Add draft catalog lane for railiance backup offsite credentials. Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
2026-07-07 17:16:30 +02:00
# CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07.
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
# Capabilities-safe re-verify 2026-07-16 (WP-0026 T07): lane-policy token
# capabilities=read on data path; default-policy and agent-high-risk-boundary = deny;
# field keys present (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY) via metadata
# lengths only — no value read. Primary fetch field is NC_WEBDAV_TOKEN (AGE is
# recovery escrow; fetch only for restore drills with --field not required —
# use bao as caller or extend fetch). EXPOSED taint set on version 2 (T05).
Add draft catalog lane for railiance backup offsite credentials. Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
2026-07-07 17:16:30 +02:00
auth_method: "caller's own OpenBao token (OIDC netkingdom role railiance-backup-workload-kv-read)"
path_template: "platform/workloads/railiance/backup/offsite-lane"
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
fetch_command: "bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane"
Add draft catalog lane for railiance backup offsite credentials. Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
2026-07-07 17:16:30 +02:00
exec_capable: true
lane: secret
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
# Mixed lane: NC_WEBDAV_TOKEN rotates (provider re-mint); AGE_PRIVATE_KEY
# re-establishes (new keypair + re-encrypt existing artifacts). Method reflects
# the more involved re-establish path. Marked exposed 2026-07-16 (see
# history/2026-07-16-credential-disclosure-lessons.md); rotation is the operator's
# optional call (buildup), not a blocker for promotion.
rotation:
method: re-establish
owner: railiance-platform
automatable: false
steps:
- "Rotate NC_WEBDAV_TOKEN: regenerate the Nextcloud WebDAV app password/token; `bao kv put platform/workloads/railiance/backup/offsite-lane NC_WEBDAV_TOKEN=@file`. NC_WEBDAV_URL changes only if the host/share moves."
- "Re-establish AGE_PRIVATE_KEY: generate a new keypair (`age-keygen`), decrypt existing offsite artifacts with the old key and re-encrypt to the new recipient, then `bao kv put ... AGE_PRIVATE_KEY=@file` (mode-0600 file, shred after)."
- "Because AGE_PRIVATE_KEY is recovery escrow, retain the old key offline until re-encryption of all retained backups is confirmed."
- "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact."
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
- "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)."
Add draft catalog lane for railiance backup offsite credentials. Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
2026-07-07 17:16:30 +02:00
Draft the flex-auth envelope-signing credential route. Pointer-only, warden_executes false. Shape lives in flex-auth; OpenBao path is not built yet. Testdata keys are not this lane. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 09:59:11 +02:00
- id: flex-auth-decision-envelope-signing-key
title: Ed25519 key that signs flex-auth decision envelopes
risk: high
workload_ref:
applicability: applicable
unknown_reason: "flex-auth has not published an authoritative workload identity declaration for envelope signing."
need_keywords: [flex-auth, decision, envelope, signing, signature, ed25519, responder, authenticity, FLEX-WP-0024]
owner_repo: railiance-platform
subsystem: OpenBao + flex-auth
warden_executes: false
wiki_ref: wiki/playbooks/flex-auth-decision-envelope-signing-key.md#worker-checklist
canon_ref: flex-auth/docs/decision-envelope-signature.md
reviewed: "2026-09-14"
status: draft
delegation:
mode: interim
intended_owner: railiance-platform
blocked_on: "Shape is chosen in flex-auth (FLEX-WP-0024-T02). OpenBao KV path, Kubernetes auth role, and paste_once_provision of the private seed are not built. Testdata key in flex-auth is not this lane."
reviewed: "2026-09-14"
verified: unverified
auth_method: "Kubernetes auth from the flex-auth pin (to be bound); not a static secret in git"
path_template: "platform/workloads/flex-auth/envelope-signing (fields ED25519_PRIVATE_KEY, ED25519_PUBLIC_KEY, kid)"
Register the State Hub Forgejo derivation-read routing lane. Pointer-only catalog entry so warden route find "state hub read private repository" resolves. ops-warden routes and does not execute. MASON-WP-0003-T03. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 04:57:55 +02:00
- id: state-hub-forge-derivation-read
title: Forgejo read-only token for State Hub projection derivation
risk: high
workload_ref:
applicability: applicable
unknown_reason: "state-hub has not published an authoritative workload identity declaration; Kubernetes auth role state-hub-forge-derivation binds ServiceAccount state-hub/state-hub."
need_keywords: [state-hub, statehub, forge, forgejo, derivation, derive, projection, private, repository, clone, FORGE_READ_TOKEN, ADR-012, work-records, unreadable, kubernetes-auth]
owner_repo: ops-mason
subsystem: OpenBao + Forgejo
warden_executes: false
wiki_ref: wiki/playbooks/state-hub-forge-derivation-read.md#worker-checklist
canon_ref: ops-mason/plans/state-hub-forge-derivation-read.md
reviewed: "2026-09-14"
status: active
delegation:
mode: native
intended_owner: ops-mason
reviewed: "2026-09-14"
verified: owner-confirmed
auth_method: "Kubernetes auth (role state-hub-forge-derivation, ServiceAccount state-hub/state-hub) from the in-cluster state-hub workload"
path_template: "platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN)"
rotation:
method: rotate
owner: ops-mason
automatable: false
steps:
- "Mint a replacement read-only token in Forgejo — repository read, organisation-wide, no other scope."
- "Deliver it to platform/workloads/state-hub/forge-derivation, field FORGE_READ_TOKEN, via paste_once_provision. ops-mason does not handle the value."
- "Revoke the previous token in Forgejo."
- "Confirm a derivation pass still reads a known private repository; rotation must not require a chart change or a redeploy."
Add forgejo-admin-api-token catalog lane (CCR-2026-0006) Draft routing entry and worker playbook for Forgejo site-admin PAT custody in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
2026-07-12 16:01:53 +02:00
- id: forgejo-admin-api-token
title: Forgejo operator/admin API token (PAT)
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, forgejo-npm]
Add forgejo-admin-api-token catalog lane (CCR-2026-0006) Draft routing entry and worker playbook for Forgejo site-admin PAT custody in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
2026-07-12 16:01:53 +02:00
owner_repo: railiance-platform
subsystem: OpenBao + Forgejo
warden_executes: false
wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04) PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin under field API_TOKEN (re-stored from initial Token field to match CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true). - catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13 - playbook: header active/resolvable, drop post-promotion caveat - workplan: T04 done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 01:47:52 +02:00
reviewed: "2026-07-13"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: secrets-engine
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: owner-confirmed
WARDEN-WP-0026 finish Strand A (T04/T05/T07) Promote railiance-backup-offsite-lane to active/resolvable after capabilities-safe re-verify. Add catalog risk=high, agent read-boundary (exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and close WP-0026.
2026-07-16 23:26:26 +02:00
# High-risk: site-admin PAT (WP-0026 T04).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The Forgejo administration workload has no authoritative workload identity declaration."
Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04) PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin under field API_TOKEN (re-stored from initial Token field to match CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true). - catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13 - playbook: header active/resolvable, drop post-promotion caveat - workplan: T04 done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 01:47:52 +02:00
# CCR-2026-0006: approved by platform-operator 2026-07-12; policy
# workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on
# bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at
# platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented
# fetch_command returns non-empty, PAT valid against forgejo.coulomb.social
# (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial
# recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is
# workstation/worker OIDC fetch only, no cluster ExternalSecret.
Add forgejo-admin-api-token catalog lane (CCR-2026-0006) Draft routing entry and worker playbook for Forgejo site-admin PAT custody in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
2026-07-12 16:01:53 +02:00
auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
path_template: "platform/workloads/forgejo/forgejo-admin"
fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"
exec_capable: true
lane: secret
WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide - routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:40:30 +02:00
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "As Forgejo user tegwick (site admin): Settings → Applications → generate a new token with the current scopes (read/write:package, read/write:repository, plus admin scopes for operator-bootstrap); keep the old token until cutover."
- "Store via the provisioning helper: `~/railiance-platform/scripts/forgejo-admin-pat-provision.sh <mode-0600-file>` writes field API_TOKEN to platform/workloads/forgejo/forgejo-admin; shred the input file."
- "Confirm the new PAT works (fetch --field API_TOKEN into env, call /api/v1/user — never print it), then delete the old token in Forgejo."
- "Verify capabilities-safe on the data path (`bao token capabilities`); notify consumers (package-prune, operator-bootstrap, npm-smoke, reuse-webhook) to re-fetch."
Add forgejo-admin-api-token catalog lane (CCR-2026-0006) Draft routing entry and worker playbook for Forgejo site-admin PAT custody in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
2026-07-12 16:01:53 +02:00
WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft) Adopt tenants/<tenant>/… custody (not platform/workloads). Document onboarding, add draft binky-company-email-imap catalog entry, and mark T01–T04/T06–T07 done. Founder Red provision remains T05.
2026-07-17 00:09:28 +02:00
# --- tenant commercial secrets (mount tenants/; WARDEN-WP-0028) ---
- id: binky-company-email-imap
title: Binky company email IMAP credentials
need_keywords: [binky, company, email, imap, mailbox, binky-hedgehog, mail, company-email]
owner_repo: railiance-platform
subsystem: OpenBao + email-connect
warden_executes: false
wiki_ref: wiki/playbooks/binky-company-email-imap.md#worker-checklist
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
reviewed: "2026-07-17"
WARDEN-WP-0028: promote binky-company-email-imap active Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify pass. Catalog resolvable; workplan finished.
2026-07-17 00:33:20 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: tenant-engine
blocked_on: "Custody at tenants/binky/... but rotation owner is binky-control — split lifecycle, no front door reconciling it"
reviewed: "2026-08-11"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft) Adopt tenants/<tenant>/… custody (not platform/workloads). Document onboarding, add draft binky-company-email-imap catalog entry, and mark T01–T04/T06–T07 done. Founder Red provision remains T05.
2026-07-17 00:09:28 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The Binky email consumer has no authoritative workload identity declaration."
WARDEN-WP-0028: promote binky-company-email-imap active Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify pass. Catalog resolvable; workplan finished.
2026-07-17 00:33:20 +02:00
# CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned
# values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17:
# lane-policy read; default deny. Host: imap.ionos.de:993 (binky-control config).
WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft) Adopt tenants/<tenant>/… custody (not platform/workloads). Document onboarding, add draft binky-company-email-imap catalog entry, and mark T01–T04/T06–T07 done. Founder Red provision remains T05.
2026-07-17 00:09:28 +02:00
auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-company-email-imap-workload-kv-read)"
path_template: "tenants/binky/company-email/imap"
fetch_command: "bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
exec_capable: true
lane: secret
rotation:
method: rotate
owner: binky-control
automatable: false
steps:
- "At the mail provider, revoke the old app password / mailbox password and mint a new one (do not paste it into chat or Git)."
- "`bao kv put tenants/binky/company-email/imap IMAP_PASSWORD=@file` (and IMAP_USERNAME=@file if the login changed); shred the mode-0600 input file(s)."
- "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/."
- "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation."
catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008) Tenant Qonto bank API front door for binky-control read-only MCP; stays draft until policy apply, founder provision, and capabilities-safe verify.
2026-07-21 21:26:25 +02:00
- id: binky-qonto-api
title: Binky Qonto bank API credentials (read-only MCP)
need_keywords: [binky, qonto, bank, api, finance, cost-run-rate, mcp, organization]
owner_repo: railiance-platform
subsystem: OpenBao + qonto-mcp-server
warden_executes: false
wiki_ref: wiki/playbooks/binky-qonto-api.md#worker-checklist
canon_ref: binky-control/integrations/qonto-mcp.md
reviewed: "2026-07-21"
catalog: promote binky-qonto-api to active (CCR-2026-0008) Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
2026-07-21 21:42:10 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: tenant-engine
blocked_on: "Same split lifecycle as binky-company-email-imap; no tenant-engine front door"
reviewed: "2026-08-11"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008) Tenant Qonto bank API front door for binky-control read-only MCP; stays draft until policy apply, founder provision, and capabilities-safe verify.
2026-07-21 21:26:25 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The Binky Qonto MCP consumer has no authoritative workload identity declaration."
catalog: promote binky-qonto-api to active (CCR-2026-0008) Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
2026-07-21 21:42:10 +02:00
# CCR-2026-0008: policy + OIDC role applied; secret at tenants/binky/qonto-api
# (fields API_KEY, API_USER). Map to QONTO_API_KEY / QONTO_ORGANIZATION_ID for
# qonto-mcp-server. First read-only pull 2026-07-21 (BINKY-WP-0005-T05).
catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008) Tenant Qonto bank API front door for binky-control read-only MCP; stays draft until policy apply, founder provision, and capabilities-safe verify.
2026-07-21 21:26:25 +02:00
# Read-only is harness tool allow-list — Qonto keys are not scope-limited server-side.
auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-qonto-api-workload-kv-read)"
catalog: promote binky-qonto-api to active (CCR-2026-0008) Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
2026-07-21 21:42:10 +02:00
path_template: "tenants/binky/qonto-api"
fetch_command: "bao kv get -field=API_KEY tenants/binky/qonto-api"
catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008) Tenant Qonto bank API front door for binky-control read-only MCP; stays draft until policy apply, founder provision, and capabilities-safe verify.
2026-07-21 21:26:25 +02:00
exec_capable: true
lane: secret
rotation:
method: rotate
owner: binky-control
automatable: false
steps:
- "In the Qonto dashboard, revoke the old API key and mint a new one under /settings/integrations (do not paste it into chat or Git)."
catalog: promote binky-qonto-api to active (CCR-2026-0008) Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
2026-07-21 21:42:10 +02:00
- "`bao kv put tenants/binky/qonto-api API_KEY=@file` (and API_USER=@file if the login/org slug changed); shred the mode-0600 input file(s)."
- "Re-run read-only pull with warden access --exec (map API_KEY→QONTO_API_KEY, API_USER→QONTO_ORGANIZATION_ID); update binky-control finance/CostRunRate.md metadata only."
- "Verify capabilities-safe on tenants/data/binky/qonto-api; if EXPOSED taint was set, clear custom_metadata after rotation."
catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008) Tenant Qonto bank API front door for binky-control read-only MCP; stays draft until policy apply, founder provision, and capabilities-safe verify.
2026-07-21 21:26:25 +02:00
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
- id: rapp-qonto-keycape-client
title: rapp-qonto KeyCape workload client
need_keywords: [rapp-qonto, qonto, keycape, oidc, client-credentials, service-token, workload-identity, binky]
owner_repo: key-cape
subsystem: KeyCape + OpenBao
warden_executes: false
Repair stale rapp-qonto-keycape-client wiki anchor The catalog pointed at wiki/CredentialRouting.md#credential-routing-catalog, which does not exist; the live heading is "Routing catalog index". Restores tests/test_routing.py to 61/61. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 10:27:12 +02:00
wiki_ref: wiki/CredentialRouting.md#routing-catalog-index
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
canon_ref: key-cape/docs/qonto-runtime-identity-contract.md
reviewed: "2026-07-27"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: key-cape
docs: record the answered custody authority on the qonto lane railiance-platform answered the routing question (msg 7c7228ac): steps 1-2 are executed by the platform operator attended, through the governed openbao-platform-admin-login lane with a unique metadata receipt path, under founder_required attended OIDC via netkingdom role=platform-admin. Nothing else in that repo carries write authority against platform/workloads/. The blocker narrows again -- the AUTHORITY is answered, the ARTIFACT is not. A two-custodian CAS rotation with a service restart is a distinct version-guarded operation needing its own reviewed CCR, which is theirs to write once an owner asks for the rotation. That question is now with key-cape; ops-warden connected the two and did not ask on their behalf. Their executable precedent for the identical two-custodian shape is cited so a rapp-qonto rotation script is not built from a bare `bao kv patch` -- the provider/consumer consistency reason key-cape gave when declining to ship a wrapper, which railiance-platform endorsed unprompted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-10 08:02:10 +02:00
blocked_on: "Narrowed again 2026-09-09: the AUTHORITY is answered, the ARTIFACT is not. railiance-platform (msg 7c7228ac) confirmed steps 1-2 are theirs: executed by the platform operator attended, never by ops-warden, secrets-engine autonomously, or any unattended agent; transport is the governed openbao-platform-admin-login lane invoked only through `warden access openbao-platform-admin-login --exec -- <command>` with a unique metadata receipt path (RPF-WP-0017 output containment); authority is founder_required attended OIDC via netkingdom role=platform-admin. What is still missing is a reviewed rotation CCR — a two-custodian CAS rotation with a service restart is a distinct version-guarded operation, not an implementation detail of this lane, and it must name the CAS precondition and expected version on both custodians, sibling-field preservation, the restart window, bounded predecessor retention, and the reconcile-to-same-version failure step. That CCR is railiance-platform to write under RPF-WP-0035 once an owner asks for the rotation; ops-warden has asked key-cape whether to schedule it. Executable precedent for the same two-custodian shape: railiance-platform scripts/keycape_approval_custody.py, with its dated receipt under docs/evidence/ and review packet under docs/credential-lane-designs/. Prior (2026-09-08) narrowing to rotation steps 1-2 only: successor generation and the CAS write to both custodians (platform/workloads/rapp-qonto/keycape-client field client_secret, and sso/keycape-rapp-qonto-client key client-secret) remain custody/deployment acts. The key-cape-native exchange now exists (keycape service-token, 2026-09-05, KEY-WP-0014-T03) and step 3 verification exists as one command (keycape verify-client, 2026-09-08, including predecessor rejection and identical-secret detection); both are documented in key-cape/docs/native-authentication.md. The prior blocker recorded both as absent, which was accurate on 2026-08-28 and is not accurate now — corrected by key-cape (msg 08d42f47). Re-checked against key-cape source 2026-09-08."
reviewed: "2026-09-09"
docs: narrow qonto blocker, record key-cape lane ownership key-cape corrected two blockers that had stopped being true after our 2026-08-28 source-read: - rapp-qonto-keycape-client: `keycape service-token` (2026-09-05) is the native exchange the blocker recorded as absent, and `keycape verify-client` (2026-09-08) is rotation step 3 as one command. Narrowed to steps 1-2 -- successor generation and the CAS write -- rather than cleared, as they asked. rotation.automatable -> false so a future executable driver is not told a lane with no admitted custody transport is drivable; the per-step truth moves into the steps. - key-cape-oidc-login: ownership ACCEPTED by key-cape, so verified moves from asked-and-waiting to owner-confirmed. Lane stays interim -- acceptance covers the identity half, while the fetch_command yields an OpenBao token whose mount, role mapping and enforcement are not key-cape's. Two tests pinned `key-cape-oidc-login` to sitting `asked-and-waiting`, so answering the question broke them -- they failed on good news. Both now assert the property instead: an unverified blocker is stale regardless of date, over whatever lanes are in that state. Verifying the routing answer against our own front door turned up a defect: `warden plan` returns `autonomous` for a custody *write* and answers it with read transports, because it has no read-versus-mutate intent. Recorded as WARDEN-WP-0038 (proposed) -- the WP-0033-T06 shape, as a class this time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-08 14:55:02 +02:00
verified: owner-confirmed
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
rapp_id: rapp-qonto
name: qonto
deployable: rapp-qonto
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
auth_method: "OpenBao platform workload lane; KeyCape client_secret_basic exchange"
path_template: "platform/workloads/rapp-qonto/keycape-client"
fetch_command: "bao kv get -field=client_secret platform/workloads/rapp-qonto/keycape-client"
exec_capable: true
lane: secret
rotation:
method: rotate
owner: key-cape
docs: narrow qonto blocker, record key-cape lane ownership key-cape corrected two blockers that had stopped being true after our 2026-08-28 source-read: - rapp-qonto-keycape-client: `keycape service-token` (2026-09-05) is the native exchange the blocker recorded as absent, and `keycape verify-client` (2026-09-08) is rotation step 3 as one command. Narrowed to steps 1-2 -- successor generation and the CAS write -- rather than cleared, as they asked. rotation.automatable -> false so a future executable driver is not told a lane with no admitted custody transport is drivable; the per-step truth moves into the steps. - key-cape-oidc-login: ownership ACCEPTED by key-cape, so verified moves from asked-and-waiting to owner-confirmed. Lane stays interim -- acceptance covers the identity half, while the fetch_command yields an OpenBao token whose mount, role mapping and enforcement are not key-cape's. Two tests pinned `key-cape-oidc-login` to sitting `asked-and-waiting`, so answering the question broke them -- they failed on good news. Both now assert the property instead: an unverified blocker is stale regardless of date, over whatever lanes are in that state. Verifying the routing answer against our own front door turned up a defect: `warden plan` returns `autonomous` for a custody *write* and answers it with read transports, because it has no read-versus-mutate intent. Recorded as WARDEN-WP-0038 (proposed) -- the WP-0033-T06 shape, as a class this time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-08 14:55:02 +02:00
# Not drivable end to end: steps 1-2 are custody/deployment acts with no
# admitted execution transport, so an executable driver (WARDEN-WP-0027
# Strand B) must not treat this lane as automatable. Step 3 alone is one
# owner command today — the precision lives in the steps, not the flag.
automatable: false
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
steps:
docs: narrow qonto blocker, record key-cape lane ownership key-cape corrected two blockers that had stopped being true after our 2026-08-28 source-read: - rapp-qonto-keycape-client: `keycape service-token` (2026-09-05) is the native exchange the blocker recorded as absent, and `keycape verify-client` (2026-09-08) is rotation step 3 as one command. Narrowed to steps 1-2 -- successor generation and the CAS write -- rather than cleared, as they asked. rotation.automatable -> false so a future executable driver is not told a lane with no admitted custody transport is drivable; the per-step truth moves into the steps. - key-cape-oidc-login: ownership ACCEPTED by key-cape, so verified moves from asked-and-waiting to owner-confirmed. Lane stays interim -- acceptance covers the identity half, while the fetch_command yields an OpenBao token whose mount, role mapping and enforcement are not key-cape's. Two tests pinned `key-cape-oidc-login` to sitting `asked-and-waiting`, so answering the question broke them -- they failed on good news. Both now assert the property instead: an unverified blocker is stale regardless of date, over whatever lanes are in that state. Verifying the routing answer against our own front door turned up a defect: `warden plan` returns `autonomous` for a custody *write* and answers it with read transports, because it has no read-versus-mutate intent. Recorded as WARDEN-WP-0038 (proposed) -- the WP-0033-T06 shape, as a class this time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C Assistant: claude-code Assistant-Model: opus Assistant-Process: 1276224@bnt-lap001 Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3
2026-09-08 14:55:02 +02:00
- "Generate a fresh newline-free secret through an approved execution transport; never print it. NOT automatable — no admitted execution and rollback contract (see delegation.blocked_on)."
- "CAS-write the same value to platform/workloads/rapp-qonto/keycape-client and sso/keycape-rapp-qonto-client preserving siblings, then restart KeyCape in the agreed window. NOT automatable — same blocker; on failure reconcile both custodians to the same version before declaring rollback complete."
- "Verify positive qonto:read exchange plus predecessor-secret and excessive-scope denial without printing tokens: run the owner command keycape verify-client (key-cape/docs/native-authentication.md)."
Route rapp-qonto workload identity
2026-07-27 20:37:09 +02:00
Add NetKingdom SSO credential routing lanes Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
2026-08-23 21:43:12 +02:00
- id: net-kingdom-lldap-bind-credential
title: NetKingdom LLDAP bind credential for identity and privacyIDEA resolver
need_keywords: [net-kingdom, netkingdom, sso, lldap, ldap, bind, directory, resolver, privacyidea, privacyIDEA, credential, password]
owner_repo: railiance-platform
subsystem: OpenBao + NetKingdom SSO/MFA
warden_executes: false
wiki_ref: wiki/playbooks/net-kingdom-sso-bind-credentials.md#worker-checklist
canon_ref: net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
reviewed: "2026-08-23"
status: active
delegation:
mode: native
intended_owner: railiance-platform
blocked_on: "Concrete OpenBao path, field contract, owner update procedure, and approved attended reconciliation handoff are not published yet; do not enable fetch or proxy execution."
reviewed: "2026-08-23"
verified: unverified
risk: high
workload_ref:
applicability: not-applicable
reason: "Provider/control-plane bind credential; identity-provisioner and privacyIDEA consumers are governed by NetKingdom rather than a single declared workload."
auth_method: "Owner-approved railiance-platform OpenBao custody path; provider reconciliation remains an attended NetKingdom operation"
lane: secret
exec_capable: false
rotation:
method: re-establish
owner: railiance-platform
automatable: false
steps:
- "Rotate through the owner-approved OpenBao/provider procedure; never export the live Kubernetes Secret or place a value in argv, logs, State Hub, or chat."
- "Reload identity-provisioner and reconcile privacyIDEA's lldap-coulomb resolver in the same approved window."
- "Verify replacement lookup, predecessor denial, readiness, and cleanup using sanitized evidence only."
- id: net-kingdom-privacyidea-admin-token
title: NetKingdom privacyIDEA administrative token for attended resolver reconciliation
need_keywords: [net-kingdom, netkingdom, sso, mfa, privacyidea, privacyIDEA, pi-admin, admin, token, resolver, lldap, credential]
owner_repo: railiance-platform
subsystem: OpenBao + privacyIDEA
warden_executes: false
wiki_ref: wiki/playbooks/net-kingdom-sso-bind-credentials.md#worker-checklist
canon_ref: net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
reviewed: "2026-08-23"
status: active
delegation:
mode: native
intended_owner: railiance-platform
blocked_on: "Concrete OpenBao path, field contract, token expiry/revocation contract, and approved attended reconciliation handoff are not published yet; do not enable fetch or proxy execution."
reviewed: "2026-08-23"
verified: unverified
risk: high
workload_ref:
applicability: not-applicable
reason: "Provider-admin credential for attended privacyIDEA reconciliation, not a workload delivery lane."
auth_method: "Owner-approved railiance-platform OpenBao custody path; privacyIDEA reconciliation remains an attended NetKingdom operation"
lane: secret
exec_capable: false
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "Obtain a fresh owner-approved privacyIDEA administrative token through the sanctioned custody path; never print or persist it in the routing layer."
- "Run only the reviewed NetKingdom attended resolver reconciliation with explicit apply and bounded cleanup."
- "Verify MFA/provider health, predecessor rejection or expiry, and sanitized cleanup evidence."
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
- id: agent-harness-forgejo-deploy
title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
WARDEN-WP-0029: implement plan front door, org posture, desk, freshness Ship posture-aware access planning: organization_posture=build (axis C), catalog freshness warnings, warden plan verdicts, localhost founder desk, and playbook/agent guidance that retire /tmp file-drop patterns. Compose route catalog + handoff rather than a second routing layer.
2026-07-18 16:59:37 +02:00
need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
owner_repo: railiance-platform
subsystem: OpenBao + Forgejo + agent-harness
warden_executes: false
wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
canon_ref: binky-control/integrations/executor-worker-secrets.md
reviewed: "2026-07-17"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: railiance-platform
blocked_on: "re-establish plus an alternative host-local key path; two ways in, neither owner-fronted (also agent-harness)"
reviewed: "2026-08-11"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "agent-harness has not published an authoritative workload identity declaration."
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
# Provisioned 2026-07-17 on railiance01: ed25519 keypair on host, OpenBao copy at
# platform/workloads/agent-harness/forgejo-deploy-key, write deploy key on
# coulomb/executor-sandbox (title agent-harness-railiance01). Git push verified.
auth_method: "caller's own OpenBao token (policy workload-kv-read-agent-harness-forgejo) or host-local key at ~/.local/agent-harness/ssh/forgejo-deploy"
path_template: "platform/workloads/agent-harness/forgejo-deploy-key"
fetch_command: "bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key"
policy_ref: "flex-auth check secret.read:agent-harness-forgejo"
WARDEN-WP-0029: implement plan front door, org posture, desk, freshness Ship posture-aware access planning: organization_posture=build (axis C), catalog freshness warnings, warden plan verdicts, localhost founder desk, and playbook/agent guidance that retire /tmp file-drop patterns. Compose route catalog + handoff rather than a second routing layer.
2026-07-18 16:59:37 +02:00
# Assist proxy for public key metadata field (private key stays host-local / high-risk).
exec_capable: true
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
lane: secret
rotation:
method: re-establish
owner: railiance-platform
automatable: false
steps:
- "On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/ (mode 600); do not paste the private key into chat or Git."
- "`bao kv put platform/workloads/agent-harness/forgejo-deploy-key SSH_PRIVATE_KEY=@file SSH_PUBLIC_KEY=@file` then register the public key as a write deploy key on coulomb/executor-sandbox (and binky-control at cutover); remove the old deploy key."
- "Verify `ssh -p 30022 -i <key> -T git@forgejo.coulomb.social` authenticates as the deploy key; test push to executor-sandbox only."
- id: agent-harness-binky-mail-approle
title: agent-harness AppRole for non-interactive Binky company-email IMAP read
need_keywords: [agent-harness, approle, binky, mail, imap, EXECUTOR_APPROLE_DIR, unattended]
owner_repo: railiance-platform
subsystem: OpenBao AppRole + agent-harness + email-connect
warden_executes: false
wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-3-mail-approle
canon_ref: binky-control/integrations/executor-worker-secrets.md
reviewed: "2026-07-17"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: railiance-platform
blocked_on: "AppRole is a host-standing credential; no owner front door for minting or rotating role_id+secret_id"
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "agent-harness has not published an authoritative workload identity declaration."
feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle with playbook pointers; provisioned 2026-07-17 (metadata only).
2026-07-17 23:57:55 +02:00
# Provisioned 2026-07-17: role agent-harness-binky-mail bound to existing policy
# workload-kv-read-binky-company-email-imap; role_id/secret_id delivered to
# railiance01 ~/.local/agent-harness/approle-binky-mail (0600). Positive IMAP field
# lengths verified; negative forgejo-admin deny verified. token_ttl=15m max=30m
# token_num_uses=8. Human OIDC role unchanged.
auth_method: "AppRole login role=agent-harness-binky-mail (role_id+secret_id on worker host via EXECUTOR_APPROLE_DIR)"
path_template: "tenants/binky/company-email/imap"
fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID # then bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
exec_capable: false
lane: secret
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "bao write -f auth/approle/role/agent-harness-binky-mail/secret-id → new secret_id; deliver mode-0600 to railiance01 EXECUTOR_APPROLE_DIR; shred old secret_id file."
- "Optionally re-mint IMAP password (see binky-company-email-imap) if the mailbox credential itself rotated."
- "Verify AppRole login + field presence (lengths only); confirm default/other policies still deny sibling paths."
Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 20:48:39 +02:00
# --- draft: owner path not yet shipped; hidden from default lookup ---
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
- id: object-storage-sts
title: Object-storage STS / temporary S3 credentials
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Temporary S3 credentials are still credentials (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Generic STS credential-vending pattern; concrete consumers carry workload references."
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
need_keywords: [s3, sts, object-storage, minio, artifact-store, temporary, credentials, bucket, vending]
owner_repo: net-kingdom
subsystem: flex-auth + OpenBao + artifact-store
warden_executes: false
wiki_ref: wiki/playbooks/object-storage-sts.md#worker-checklist
canon_ref: net-kingdom/docs/object-storage-sts-credential-vending.md
reviewed: "2026-06-24"
status: draft
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: net-kingdom
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
- id: database-dynamic-credentials
title: Database dynamic credentials (OpenBao secrets engine)
need_keywords: [database, db, postgres, cnpg, dynamic, credentials, password, lease, openbao]
Route dynamic database credentials to rapp-postgres
2026-08-10 19:37:05 +02:00
owner_repo: rapp-postgres
subsystem: rapp-postgres + railiance-platform OpenBao broker
docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog Implements WARDEN-WP-0010 (charter + pointer catalog). ops-warden issues short-lived SSH certificates and routes every other credential need to the subsystem that owns it — no desk metaphor, one execution lane. - wiki/AccessRouting.md: role/boundary, issue-vs-route matrix, anti-patterns - registry/routing/catalog.yaml: machine-readable pointer layer (6 active + 1 draft). No-double-source rule enforced structurally — authored steps/cert_command only on the warden_executes:true SSH entry; every wiki_ref anchor resolves - wiki/CredentialRouting.md: catalog-keyed index + no-duplicate-interfaces note - INTENT/SCOPE/AGENTS/repo-boundary/capability: aligned to the new framing; SCOPE notes A3 -> A4 lands with WP-0011 warden route CLI - WP-0011/0012 + WP-0010: state_hub id writeback; WP-0010 marked done Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 20:44:53 +02:00
warden_executes: false
Complete WARDEN-WP-0012 routing scenario playbooks Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
2026-06-25 10:27:23 +02:00
wiki_ref: wiki/playbooks/database-dynamic-credentials.md#worker-checklist
Route dynamic database credentials to rapp-postgres
2026-08-10 19:37:05 +02:00
canon_ref: rapp-postgres/docs/canon-drafts/shared-platform-relational-storage_v0.1-draft.md
reviewed: "2026-08-10"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: rapp-postgres
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Route dynamic database credentials to rapp-postgres
2026-08-10 19:37:05 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: not-applicable
reason: "Generic database credential-vending pattern; concrete consumers carry workload references."
Route dynamic database credentials to rapp-postgres
2026-08-10 19:37:05 +02:00
exec_capable: false
Catalog: rein-openweights AppRole for non-interactive OpenRouter key read Proposed by ops-mason (MASON-WP-0001-T05), built and approved 2026-07-27 (Bernd Worsch). New pointer-only entry mirroring agent-harness-binky-mail-approle's shape: AppRole login, no operator present, scoped to exactly one KV path (reins/rein-openweights/openrouter, new reins/ KV v2 mount -- no existing mount fit without widening scope beyond what was approved). status: draft until the founder completes paste-once-provision and glas-harness/GLAS-WP-0002-T02's live verification succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:22:59 +02:00
- id: rein-openweights-openrouter-approle
title: rein-openweights AppRole for non-interactive OpenRouter key read
need_keywords: [rein-openweights, approle, openrouter, glas-harness, unattended, REIN_OPENWEIGHTS_APPROLE_DIR]
owner_repo: ops-mason
subsystem: OpenBao AppRole + rein-openweights
warden_executes: false
wiki_ref: wiki/playbooks/rein-openweights-openrouter-approle.md#worker-checklist
canon_ref: ops-mason/plans/rein-openweights-openrouter-approle.md
reviewed: "2026-07-27"
Promote rein-openweights-openrouter-approle: draft -> active Founder completed paste-once-provision; glas-harness/GLAS-WP-0002-T02's live verification succeeded for real (AppRole login, KV v2 read, real OpenRouter call, real commit, OPENROUTER_API_KEY unset throughout). Two real fixes recorded along the way: platform-admin's policy needed a new reins/* entry (every other KV mount was already listed there), and the consumer policy itself needed the KV v2 data/+metadata/ path shape instead of the bare KV v1 path it was originally written against. Full account in ops-mason/plans/rein-openweights-openrouter-approle.md section 7. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:51:57 +02:00
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: ops-mason
blocked_on: "AppRole is a host-standing credential; no owner-fronted exec for the OpenRouter key read"
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Catalog: rein-openweights AppRole for non-interactive OpenRouter key read Proposed by ops-mason (MASON-WP-0001-T05), built and approved 2026-07-27 (Bernd Worsch). New pointer-only entry mirroring agent-harness-binky-mail-approle's shape: AppRole login, no operator present, scoped to exactly one KV path (reins/rein-openweights/openrouter, new reins/ KV v2 mount -- no existing mount fit without widening scope beyond what was approved). status: draft until the founder completes paste-once-provision and glas-harness/GLAS-WP-0002-T02's live verification succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:22:59 +02:00
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "rein-openweights has not published an authoritative workload identity declaration."
Catalog: rein-openweights AppRole for non-interactive OpenRouter key read Proposed by ops-mason (MASON-WP-0001-T05), built and approved 2026-07-27 (Bernd Worsch). New pointer-only entry mirroring agent-harness-binky-mail-approle's shape: AppRole login, no operator present, scoped to exactly one KV path (reins/rein-openweights/openrouter, new reins/ KV v2 mount -- no existing mount fit without widening scope beyond what was approved). status: draft until the founder completes paste-once-provision and glas-harness/GLAS-WP-0002-T02's live verification succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:22:59 +02:00
# Built 2026-07-27 by ops-mason (MASON-WP-0001-T05), approved by Bernd
# Worsch 2026-07-27. Policy + AppRole live; reins/ KV v2 mount created
# (no existing mount fit without widening scope beyond what was
# approved). token_num_uses corrected from OpenBao's own default (0 =
Promote rein-openweights-openrouter-approle: draft -> active Founder completed paste-once-provision; glas-harness/GLAS-WP-0002-T02's live verification succeeded for real (AppRole login, KV v2 read, real OpenRouter call, real commit, OPENROUTER_API_KEY unset throughout). Two real fixes recorded along the way: platform-admin's policy needed a new reins/* entry (every other KV mount was already listed there), and the consumer policy itself needed the KV v2 data/+metadata/ path shape instead of the bare KV v1 path it was originally written against. Full account in ops-mason/plans/rein-openweights-openrouter-approle.md section 7. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:51:57 +02:00
# unlimited) to 8, matching agent-harness-binky-mail. Policy path shape
# also corrected post-build: originally written against the bare KV
# path (KV v1 shape), which silently denies everything on a v2 mount --
# fixed to grant on <mount>/data/<path> + <mount>/metadata/<path>.
# platform-admin's own policy also needed a new "reins/*" entry before
# the founder's paste-once-provision could write the value (every
# other KV mount was already listed there; this one predated the fix).
# Promoted draft -> active: founder completed paste-once-provision and
# glas-harness/GLAS-WP-0002-T02's live verification succeeded --
# real AppRole login, real KV v2 read, real OpenRouter call, real
# commit, with OPENROUTER_API_KEY unset throughout.
Catalog: rein-openweights AppRole for non-interactive OpenRouter key read Proposed by ops-mason (MASON-WP-0001-T05), built and approved 2026-07-27 (Bernd Worsch). New pointer-only entry mirroring agent-harness-binky-mail-approle's shape: AppRole login, no operator present, scoped to exactly one KV path (reins/rein-openweights/openrouter, new reins/ KV v2 mount -- no existing mount fit without widening scope beyond what was approved). status: draft until the founder completes paste-once-provision and glas-harness/GLAS-WP-0002-T02's live verification succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 01:22:59 +02:00
auth_method: "AppRole login role=rein-openweights (role_id+secret_id via REIN_OPENWEIGHTS_APPROLE_DIR)"
path_template: "reins/rein-openweights/openrouter"
fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID # then bao kv get -field=api_key reins/rein-openweights/openrouter"
exec_capable: false
lane: secret
rotation:
method: rotate
owner: ops-mason
automatable: false
steps:
- "bao write -f auth/approle/role/rein-openweights/secret-id -> new secret_id; deliver mode-0600 to REIN_OPENWEIGHTS_APPROLE_DIR; shred old secret_id file."
- "Optionally re-mint the OpenRouter key itself if it rotated independently."
- "Verify AppRole login + field presence (length only); confirm default/other policies still deny sibling paths."
Route coulomb-social runtime env credentials via ops-warden catalog Add coulomb-social-runtime-env lane and playbook. Points operators at railiance-apps env-secret assembly; ops-warden never holds values.
2026-08-09 02:11:34 +02:00
- id: coulomb-social-runtime-env
title: coulomb.social runtime env Secret (SECRET_KEY, DATABASE_URL, USER_ENGINE_PROXY_SECRET)
need_keywords:
- coulomb-social
- coulomb.social
- coulomb social
- csoc
- runtime-env
- coulomb-social-env
- django secret_key
- user-engine-proxy
- apps-pg coulomb
owner_repo: railiance-platform
subsystem: K8s Secrets + apps-pg (OpenBao path planned)
warden_executes: false
wiki_ref: wiki/playbooks/coulomb-social-runtime-env.md#worker-checklist
canon_ref: railiance-platform/docs/apps-pg.md
reviewed: "2026-08-09"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: railiance-apps
Answer flex-auth caller-auth question; refresh two delegation lanes Inbox triage (ADHOC-2026-08-17), three messages, all answered and marked read. flex-auth (FLEX-WP-0015 T02) reported that /v1/check and /v1/batch_check authenticate no caller — any workload with cluster reach can assert any subject and get an authoritative allow. It lands here because ops-warden owns workload identity in this estate and its pre-sign gate is a flex-auth PEP. Recommendation recorded in wiki/NetKingdomSecurityMap.md: Kubernetes ServiceAccount TokenReview with a projected, audience-scoped token. Rejected the shared-secret header — it manufactures a risk: high lane with a rotation owner per caller on the authorization path, the exact interim-proxy debt WP-0030 exists to stop growing. Deferred mTLS pending an owner for a workload X.509 CA. Bind `system` to the authenticated SA at auth time, but keep the resource-type allowlist in the policy package rather than the admission layer. Warn-only rollout; policy.enabled must not flip while /v1/check answers unauthenticated callers. Recorded as a pattern, not a catalog entry. Catalog delegation refreshes: - coulomb-social-runtime-env: USER_ENGINE_PROXY_SECRET ownership settled (decision 8fe22037, USER-WP-0021) — intended_owner stays railiance-apps, answered clause dropped from blocked_on, consumers: [user-engine] recorded. - rapp-qonto-keycape-client: blocked_on no longer implies an in-flight KEY-WP-0008 dependency; the key-cape-native exchange command is unopened work. uv run pytest -q → 338 passed, 4 deselected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 22:55:33 +02:00
blocked_on: "Runtime Secret applied via railiance-apps make target; OpenBao path planned but CCR not applied"
reviewed: "2026-08-17"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Answer flex-auth caller-auth question; refresh two delegation lanes Inbox triage (ADHOC-2026-08-17), three messages, all answered and marked read. flex-auth (FLEX-WP-0015 T02) reported that /v1/check and /v1/batch_check authenticate no caller — any workload with cluster reach can assert any subject and get an authoritative allow. It lands here because ops-warden owns workload identity in this estate and its pre-sign gate is a flex-auth PEP. Recommendation recorded in wiki/NetKingdomSecurityMap.md: Kubernetes ServiceAccount TokenReview with a projected, audience-scoped token. Rejected the shared-secret header — it manufactures a risk: high lane with a rotation owner per caller on the authorization path, the exact interim-proxy debt WP-0030 exists to stop growing. Deferred mTLS pending an owner for a workload X.509 CA. Bind `system` to the authenticated SA at auth time, but keep the resource-type allowlist in the policy package rather than the admission layer. Warn-only rollout; policy.enabled must not flip while /v1/check answers unauthenticated callers. Recorded as a pattern, not a catalog entry. Catalog delegation refreshes: - coulomb-social-runtime-env: USER_ENGINE_PROXY_SECRET ownership settled (decision 8fe22037, USER-WP-0021) — intended_owner stays railiance-apps, answered clause dropped from blocked_on, consumers: [user-engine] recorded. - rapp-qonto-keycape-client: blocked_on no longer implies an in-flight KEY-WP-0008 dependency; the key-cape-native exchange command is unopened work. uv run pytest -q → 338 passed, 4 deselected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 22:55:33 +02:00
# USER_ENGINE_PROXY_SECRET ownership settled 2026-08-16 (Bernd; State Hub decision
# 8fe22037-5bbb-4487-bb86-e4beccee454b, USER-WP-0021): it is infrastructure trust
# between ingress and workload, not a user-domain fact. intended_owner stays
# railiance-apps; user-engine is consumer-only and claims no lane here.
consumers: [user-engine]
Route coulomb-social runtime env credentials via ops-warden catalog Add coulomb-social-runtime-env lane and playbook. Points operators at railiance-apps env-secret assembly; ops-warden never holds values.
2026-08-09 02:11:34 +02:00
risk: standard
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "coulomb-social has not published an authoritative workload identity declaration."
Route coulomb-social runtime env credentials via ops-warden catalog Add coulomb-social-runtime-env lane and playbook. Points operators at railiance-apps env-secret assembly; ops-warden never holds values.
2026-08-09 02:11:34 +02:00
# K8s assembly is the live handoff today (same pattern as vergage-teilnahme-env).
# OpenBao KV platform/workloads/coulomb/coulomb-social/runtime-env is the
# future custody home — CCR not yet applied; resolvable via operator script.
auth_method: "kubectl as platform operator (or bao OIDC when OpenBao lane is provisioned)"
path_template: "k8s:coulomb-social/coulomb-social-env"
fetch_command: "cd ~/railiance-apps && make coulomb-social-env-secret-dry-run # then make coulomb-social-env-secret (values never printed)"
exec_capable: false
lane: secret
resolvable: true
rotation:
method: rotate
owner: railiance-apps
automatable: false
steps:
- "SECRET_KEY: make coulomb-social-env-secret COULOMB_SOCIAL_ENV_SECRET_ARGS='--rotate-secret-key' then rollout restart deploy/coulomb-social."
- "USER_ENGINE_PROXY_SECRET: rotate user-engine/user-engine-runtime, re-run make coulomb-social-env-secret, restart app."
- "DATABASE_URL: platform rotates apps-pg role password secret; re-run make coulomb-social-env-secret; restart app."
Route email-connect transactional SMTP and ingest token. Catalog id email-connect-transactional (active) with OpenBao pointer playbook for CCR-2026-0010 / EMAIL-WP-0004 custody.
2026-08-12 13:32:11 +02:00
Add draft routing entry audit-core-senders Pointer-only. Database leases stay on database-dynamic-credentials. Promote after the Mason AppRole build is verified.
2026-08-13 10:27:13 +02:00
- id: audit-core-senders
title: audit-core sender registry (write and operator-read tokens)
Grade every catalog lane; record ADR-0007 Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 23:44:58 +02:00
# Vends write and operator-read tokens (WARDEN-WP-0032-T05).
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "audit-core has not published an authoritative workload identity declaration."
Add draft routing entry audit-core-senders Pointer-only. Database leases stay on database-dynamic-credentials. Promote after the Mason AppRole build is verified.
2026-08-13 10:27:13 +02:00
need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
owner_repo: ops-mason
subsystem: OpenBao + audit-core
warden_executes: false
wiki_ref: wiki/playbooks/audit-core-senders.md#worker-checklist
canon_ref: audit-core/docs/operator-runbook.md
reviewed: "2026-08-13"
status: draft
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: native
intended_owner: ops-mason
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
Add draft routing entry audit-core-senders Pointer-only. Database leases stay on database-dynamic-credentials. Promote after the Mason AppRole build is verified.
2026-08-13 10:27:13 +02:00
auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
path_template: "platform/workloads/audit-core/senders"
policy_ref: "external-secrets-audit-core"
exec_capable: false
resolvable: false
lane: secret
Route email-connect transactional SMTP and ingest token. Catalog id email-connect-transactional (active) with OpenBao pointer playbook for CCR-2026-0010 / EMAIL-WP-0004 custody.
2026-08-12 13:32:11 +02:00
- id: email-connect-transactional
title: email-connect transactional SMTP and caller ingest token
need_keywords: [email-connect, transactional, smtp, ionos, starttls, ingest, invitation, verification, EMAIL_CONNECT_SMTP_PASSWORD, EMAIL_CONNECT_INGEST_TOKEN]
owner_repo: railiance-platform
subsystem: OpenBao + email-connect
warden_executes: false
wiki_ref: wiki/playbooks/email-connect-transactional.md#worker-checklist
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
reviewed: "2026-08-12"
status: active
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: secrets-engine
Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer Three fixes, the first of which is my own botched edit from an hour ago. 1. The "six delivery modes" claim was never actually removed. I ran a str.replace with no assertion on the result, it matched nothing, and the print said "ok". The wrong claim sat in all seven lanes while I told secrets-engine it was fixed. This edit asserts 5/1/1 and fails loudly otherwise. 2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now records that secrets-engine holds the entry and that the interim proxy retires on approved native verification in T05 -- not on acceptance. Retiring early would drop the cover before the replacement is proven. 3. Two lanes REFUSED, and both refusals are right: - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape. Login and identity-token issuance were never secrets-engine's. Not yet asked of key-cape, and the record says so. - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle> routing template, not one secret lane, so there is no front door to own. interim -> native with railiance-platform named: OpenBao is itself the front door and this entry is a pointer to it, never an interim cover. It should not have been inflating the interim count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:04:54 +02:00
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
Reframe the secrets-engine blocker on seven interim lanes The blocker asked whether `secrets-engine exec --catalog` generalizes over arbitrary OpenBao lanes. Asked 2026-08-11, chased 08-15, never answered. Rather than chase a third time, read their code. It generalizes by construction: catalog.py takes mount and path as plain fields, `kv` is a general kind, and six delivery modes are supported. What exists is two catalog entries -- warden-sign and whynot-design-npm-publish -- which are exactly the two lanes this register already marks native. So the blocker was misframed for ten days. Not "can the engine do this" but "who authors the entries and who operates them", which is smaller and had never been put to them. Register now says that, and ops-warden has offered to author all seven entries against their schema for them to accept or reject. Applying the rule this repo already had and missed twice this week: re-read a blocker before trusting it. A blocker is a claim about the world at a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 01:26:07 +02:00
reviewed: "2026-08-21"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: owner-confirmed
Route email-connect transactional SMTP and ingest token. Catalog id email-connect-transactional (active) with OpenBao pointer playbook for CCR-2026-0010 / EMAIL-WP-0004 custody.
2026-08-12 13:32:11 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "email-connect has not published an authoritative workload identity declaration."
Route email-connect transactional SMTP and ingest token. Catalog id email-connect-transactional (active) with OpenBao pointer playbook for CCR-2026-0010 / EMAIL-WP-0004 custody.
2026-08-12 13:32:11 +02:00
# CCR-2026-0010 approved 2026-08-12; applied same day (EMAIL-WP-0004-T03):
# policies external-secrets-email-connect + workload-kv-read-email-connect-transactional,
# KV platform/workloads/email-connect/transactional v1, ESO token Secret,
# ClusterSecretStore openbao-email-connect Ready, ExternalSecret SecretSynced,
# Deployment Ready on railiance01. Positive: user-engine /healthz 200 and
# bearer allow-list checks; negative: non-user-engine Connection refused,
# unauth 401. user-engine must receive ingest token under its own custody
# (not SMTP fields) for production outbox wiring (NK-WP-0024).
auth_method: "caller's own OpenBao token (operator OIDC, or ESO child token openbao-email-connect-eso-token)"
path_template: "platform/workloads/email-connect/transactional"
fetch_command: "bao kv get -field=EMAIL_CONNECT_SMTP_PASSWORD platform/workloads/email-connect/transactional"
policy_ref: "flex-auth check secret.read:email-connect"
exec_capable: true
resolvable: true
lane: secret
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "At IONOS, mint a new mailbox app password for the transactional identity; keep the old password until ESO refresh and pod Ready."
- "`bao kv put platform/workloads/email-connect/transactional EMAIL_CONNECT_SMTP_PASSWORD=@file` (and USERNAME/INGEST_TOKEN if those rotate); shred mode-0600 files."
- "ESO re-syncs email-connect/email-connect-runtime; roll email-connect. If INGEST_TOKEN changed, update user-engine runtime and roll user-engine."
- "Verify capabilities-safe on platform/data/workloads/email-connect/transactional; confirm /healthz Ready without printing secret values."
catalog: draft scaleway-bootstrap lane Pointer to the mason plan and playbook. Founder provision only; warden does not execute the fetch.
2026-08-14 17:36:17 +02:00
- id: scaleway-bootstrap
title: Scaleway org/project API key for reef-storage bucket create
need_keywords: [scaleway, s3, object-storage, bootstrap, reef-storage, backup, nl-ams]
owner_repo: railiance-platform
subsystem: OpenBao + Scaleway
warden_executes: false
wiki_ref: wiki/playbooks/scaleway-bootstrap.md#worker-checklist
canon_ref: ops-mason/plans/reef-storage-scaleway-bootstrap.md
reviewed: "2026-08-14"
status: draft
Ship WARDEN-WP-0030: delegation register for every catalog lane Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
2026-08-15 20:54:58 +02:00
delegation:
mode: interim
intended_owner: railiance-platform
blocked_on: "Founder bootstrap API key; draft until provisioned; no owner-fronted exec"
reviewed: "2026-08-15"
WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 13:26:10 +02:00
verified: unverified
catalog: draft scaleway-bootstrap lane Pointer to the mason plan and playbook. Founder provision only; warden does not execute the fetch.
2026-08-14 17:36:17 +02:00
risk: high
feat: adopt security zones and explicit workload refs Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:36:37 +02:00
workload_ref:
applicability: applicable
unknown_reason: "The attended Scaleway bootstrap execution unit has no authoritative workload identity declaration."
catalog: draft scaleway-bootstrap lane Pointer to the mason plan and playbook. Founder provision only; warden does not execute the fetch.
2026-08-14 17:36:17 +02:00
# CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
# Not the Barman runtime key (platform-pg-backup-s3).
auth_method: "caller's own OpenBao token (founder / operator workstation)"
path_template: "platform/workloads/railiance/scaleway/bootstrap"
fetch_command: "bao kv metadata get platform/workloads/railiance/scaleway/bootstrap"
exec_capable: false
resolvable: false
lane: secret
rotation:
method: rotate
owner: railiance-platform
automatable: false
steps:
- "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists."
- "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
- "Confirm metadata gone or version bumped; capabilities-safe only."
Reference in a new issue Copy permalink