ops-warden/tenancy.yaml

# ops-warden tenancy posture declaration
# Framework: net-kingdom/canon/standards/tenancy-posture_v0.1.md draft-9
# Conformance rule (§6): accuracy, not altitude. Nothing here is aspirational.
# Validate: python3 ~/net-kingdom/tools/tenancy-posture/validate.py tenancy.yaml

schema_version: "0.1"
framework: netkingdom-tenancy-posture
service: ops-warden
role: ssh-certificate-authority

workload_identity:
  name: ops-warden
  kind: operational-control-plane
  responsible_repo: ops-warden
  identity_bindings:
    - scheme: kubernetes-service-account
      authority: railiance01
      subject: system:serviceaccount:ops-warden:ops-warden
      principal_type: service
      environment: prod

tenancy:
  current:
    I: 1
    A: 1
    E: 0
    P: "n/a"
    R: "n/a"
    V: 0
  implemented:
    A: 3
  target:
    I: 1
    A: 3
    E: 0
    P: "n/a"
    R: "n/a"
    V: 1
  reviewed: "2026-08-19"
  review_due: "2027-02-18"
  service_class: interactive
  permanent: [P, R]

  gap:
    I: >-
      ops-warden has a tenant notion — `policy.tenant` in warden.yaml, and the
      tenant/platform path split introduced by WP-0028 — but it is a static
      configuration constant, not a claim verified on an inbound call. `warden`
      is a CLI invoked by an operator or agent; its caller is an OS user and no
      token is presented to it. Subject id comes from `WARDEN_POLICY_SUBJECT`
      or falls back to the actor name, which is §4.1's "taken from the request"
      case exactly. I1.

      Not declared permanent. `warden desk` (WP-0029) already performs an OIDC
      login against key-cape, so a verified inbound identity is reachable
      rather than structurally excluded. It is simply not built, and I2 would
      require it on the signing path, not just the desk.
    A: >-
      There is a single choke point on the signing path — inventory membership,
      actor type, and the TTL ceiling — but it binds an *actor* to principals,
      not a request to the tenants it may act for. Tenant context is a
      constant, so "bound once, centrally" (§4.2 A2) would be true only in a
      trivial sense that overclaims. A1.

      `implemented: A3` is the honest separate fact: delegation to flex-auth as
      PDP is built (`src/warden/policy.py`, `check_sign_policy`) and was
      verified live on 2026-08-19 against the enforcing `flex-auth-ops-warden`
      pin — `decision:f3f7c88f9585582a`, with an anonymous `/v1/check`
      returning 401. It is not `current` because `policy.enabled` is false, and
      it is false by decision rather than by blocker: `ADR-0006` scopes
      enforcement to security zones, which `zone-engine` is defining
      (`ZONE-WP-0001`). Evidence:
      `history/2026-08-19-flex-auth-caller-identity-evidence.md`.

      A4 is not a target here. The AuthZEN interface question belongs to
      flex-auth as the decision point; ops-warden would follow it, not lead it.
    E: >-
      E0 is accurate and is not a defect to remediate. ops-warden holds no
      tenant-partitioned data: `registry/routing/catalog.yaml` is a pointer
      layer carrying no secret values (`ADR-0001`, CI-enforced) and no `tenant`
      field on any entry; local state (`signatures.log`, `audit.jsonl`,
      `access-audit.log`) is operator-scoped and keyed by actor, not tenant.

      The tenant boundaries ops-warden *routes* to — `tenants/binky/...` versus
      `platform/workloads/...` — are enforced by OpenBao policy, which is the
      owner's control, not ops-warden's. Claiming E1 on the strength of someone
      else's enforcement is the overclaim §6 prohibits. Under `ADR-0002`
      ops-warden is a transparent conduit and takes no custody, so it has no
      tenant data to key. Raising E would mean acquiring data it is out of
      scope to hold.
    P: >-
      n/a and permanent. No primary datastore: state is files under
      `~/.local/state/warden` on the invoking operator's machine, and
      §3.3 scopes P to the primary datastore. Custody of secrets is explicitly
      out of scope (`SCOPE.md`, `ADR-0002`), so ops-warden will not acquire a
      tenant-bearing substrate.
    R: >-
      n/a and permanent, on the same ground as P: no tenant data at rest.

      Named honestly rather than hidden behind the n/a: ops-warden *does* keep
      local operator records indefinitely — `audit.jsonl` is append-only by
      design (WP-0022) and `signatures.log` has no retention position. They are
      metadata-only and guarded against secret material, and they are not
      tenant data, so they do not move this axis. But "no declared retention
      for local audit" is a real gap on a different axis than this file grades,
      and is recorded here so it is not lost.
    V: >-
      V0. `warden sign` depends synchronously on OpenBao at
      `https://bao.coulomb.social` (railiance01) and, once enabled, on the
      flex-auth pin reached through the ops-bridge tunnel
      `flex-auth-ops-warden-railiance01`. §4.6.1 takes the minimum across that
      path, and none of it has an exercised recovery objective.

      A `backend: local` CA exists in the code and is covered by tests, but it
      has never been exercised as a production degraded mode, and §13 does not
      accept "the code path exists" as V evidence. Target V1 means documenting
      and actually rehearsing recovery of the signing path — not adding
      redundancy, which the substrate cannot currently support: `reef-railiance`
      is single-node with a shared control plane, and under Decision 4.6.1 that
      caps V for everything bound to it (see NK-WP-0027).

zones:
  standard: security-zones_v0.1
  membership: z1-operational
  responsible_party: team:platform-security
  justification: >-
    The attended platform signing service has a bounded operational scope and
    internal metadata exposure. It has M1 evidence, but no SLO history, on-call
    rotation, or incident exercise that would support z2-protected.
  context:
    maturity: M1
    criticality: medium
    data_classification: internal
  evidence:
    - ref: docs/evidence/security-zone-admission-2026-08-22.md
      supports: [M1, platform-only-scope, basic-slo, data-handling-note]
    - ref: history/2026-08-19-flex-auth-caller-identity-evidence.md
      supports: [production-policy-path, authenticated-caller]
  reviewed: "2026-08-22"
  review_due: "2026-11-22"

evidence:
  A: >-
    Built and verified live 2026-08-19 against the enforcing
    `flex-auth-ops-warden` pin: `decision:f3f7c88f9585582a`, anonymous
    `/v1/check` 401. Record:
    `history/2026-08-19-flex-auth-caller-identity-evidence.md`. Re-establish on
    demand with `scripts/check_policy_caller_identity.py`. Why it is implemented
    and not current: `docs/adr/ADR-0006-enforcement-is-zone-scoped.md`.
  E: >-
    `docs/adr/ADR-0002-conduit-not-broker.md` and `ADR-0001` (catalog is a
    pointer layer, CI-enforced) — why no tenant-keyed data exists to enforce on.
  P: >-
    No datastore. State is operator-local files under `~/.local/state/warden`.
  V: >-
    Production signing path verified 2026-06-17
    (`history/2026-06-17-openbao-production-verify.md`). No recovery exercise
    exists for that path, which is why this is V0 and not V1.

notes:
  - >-
    ops-warden issues short-lived SSH certificates and routes every other
    credential need to its owner.
  - >-
    Five of six axes are low because it deliberately holds nothing. The low
    grades on E, P and R are the intended consequence of ADR-0002 and ADR-0005,
    not deferred work, and raising them would mean acquiring data ops-warden is
    out of scope to hold.
  - >-
    The two axes with real movement are A — built, deferred by ADR-0006 pending
    the zone model — and V, which needs a rehearsed recovery and is capped by
    the substrate until NK-WP-0027 lands.