ops-warden/docs/adr/ADR-0003-cover-gaps-never-silently-own-them.md

---
id: ops-warden-adr-0003
type: adr
title: "ADR-0003 — Cover gaps, but never silently own them"
domain: infotech
repo: ops-warden
status: accepted
version: "1.0"
revision: "1"
owner: ops-warden
binds: "ops-warden"
created: "2026-07-01"
updated: "2026-08-18"
last_reviewed: "2026-08-18"
review_interval: 6m
enforced_by: "registry/routing/catalog.yaml delegation:; warden route gaps"
supersedes: ""
successor: ""
---

# ADR-0003 — Cover gaps, but never silently own them

## Status

Accepted. Stated as INTENT §9, made structural by WARDEN-WP-0030 (delegation
register).

## Context

ops-warden owns exactly one lane: SSH certificate issuance. It nonetheless fronts
around eleven credential lanes as a caller-identity proxy, because no other
component fronts them yet and a worker blocked on a credential is a worker blocked.

Covering a gap is legitimate and this repo intends to keep doing it. The failure is
subtler: **a cover that is never recorded as a cover becomes ownership by default.**
Nobody decides to permanently own another component's lane. It happens because the
interim arrangement worked, nobody wrote down that it was interim, and the intended
owner never learned they were expected to build a front door.

By August 2026 the primitive to hand a lane back existed and was proven — `exec_owner`
/ `exec_command`, used by secrets-engine for npm publish and by the railiance-platform
credential broker for warden-sign — and was used by 2 of 24 lanes. The other
twenty-two had no record of who *should* own them.

## Decision

**Every catalog entry carries a `delegation:` block**, with a `mode:` of:

| `mode` | Meaning |
| --- | --- |
| `permanent` | Ours forever. SSH certificate issuance, and nothing else |
| `native` | The owner has a front door; we route to it and execute nothing |
| `interim` | We are covering a gap. Requires `intended_owner:` and `blocked_on:` |

**`interim` without an `intended_owner` is not permitted.** If we cannot name who
should own it, we have not understood the lane well enough to be fronting it.

**`blocked_on:` must name a specific condition, not a mood.** "No front door yet" is
not a blocker; "secrets-engine has not confirmed whether `exec --catalog` generalizes
over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)" is. A blocker with a
question and a date can be chased. A blocker without one is an excuse with a
timestamp.

**The interim set is queryable**: `warden route gaps` lists it with review dates and
staleness. A cover that nobody can enumerate is a cover nobody will retire.

**A blocker is a claim about the world at a date, and expires.** `reviewed:` is
bumped only on a real re-check, never inherited. This was learned the hard way:
`RISK-F-0001` invalidated one of our blockers within a day and nothing would have
re-checked it.

## Consequences

**Retiring a cover is a normal, expected event rather than a renegotiation.** When
an owner ships their front door the lane flips `interim` → `native`. This has
happened twice and both were routine.

**Other repos can see what we are holding for them.** The register is why key-cape
and user-engine were able to confirm or decline lanes in August 2026 — the question
was answerable because it had been written down. One of those answers was "not ours",
which is a legitimate and useful outcome.

**We accept looking worse than we are.** `warden route gaps` publishes a list of
things this repo is doing that it would rather not be doing. That is the intent: the
alternative is a repo that looks clean because nobody counted.

**This register is not a risk register.** Interim lanes are tracked work with an
owner and a date, not defects. They do not get bulk-filed into `risk-nexus`, which
needs to stay small enough to read. Defects go there; gaps stay here.

## Related

- `INTENT.md` §9 — the principle this formalizes
- `history/2026-08-11-delegation-surface-assessment.md` — the assessment that forced it
- `.claude/rules/finding-routing.md` — the register-versus-findings boundary