From 3596e079b1e5ddad80ed4b51b14dfd3cd424cdd1 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Thu, 8 Oct 2026 19:35:00 +0200
Subject: [PATCH] Add WARDEN-WP-0043 for supplier credentials under
 platform/suppliers

ops-warden will route the path shape. The allowlist change and the
value writes stay with railiance-platform and the founder.

Assistant: grok
Assistant-Session: 01a11ab6-1534-7d63-8606-662b92a80ed6
---
 ...N-WP-0043-platform-supplier-credentials.md | 87 +++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 workplans/WARDEN-WP-0043-platform-supplier-credentials.md

diff --git a/workplans/WARDEN-WP-0043-platform-supplier-credentials.md b/workplans/WARDEN-WP-0043-platform-supplier-credentials.md
new file mode 100644
index 0000000..8b681ee
--- /dev/null
+++ b/workplans/WARDEN-WP-0043-platform-supplier-credentials.md
@@ -0,0 +1,87 @@
+---
+id: WARDEN-WP-0043
+type: workplan
+title: "Route supplier credentials under platform/suppliers"
+domain: infotech
+repo: ops-warden
+status: ready
+flavor: implementation
+owner: grok
+topic_slug: platform-suppliers
+created: "2026-10-08"
+updated: "2026-10-08"
+depends_on: []
+related:
+  - repo:railiance-platform
+  - repo:llm-connect
+---
+
+# WARDEN-WP-0043 — Supplier credentials under platform/suppliers
+
+Founder decision 2026-10-08: account credentials we hold with a supplier
+live at `platform/suppliers/<supplier>/<account>` on the existing `platform`
+KV mount. ops-warden routes that shape. It does not store the values and it
+does not apply OpenBao. The KV write and the credential-change allowlist
+belong to railiance-platform. Tenant commercial secrets stay on `tenants/`.
+
+Workload and rein paths that already have a reader stay where they are
+until that reader is retargeted:
+
+| Account | Path today |
+| --- | --- |
+| OpenRouter, llm-connect | `platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets` |
+| OpenRouter, rein-openweights | `reins/rein-openweights/openrouter` |
+| Scaleway bootstrap | `platform/workloads/railiance/scaleway/bootstrap` |
+| Scaleway backup space | `platform/workloads/railiance/backup/object-storage` |
+| IONOS transactional mailbox | `platform/workloads/email-connect/transactional` |
+| IONOS library mailbox | `platform/workloads/inbound-library/imap` |
+
+The future homes are `platform/suppliers/openrouter/llm-connect`,
+`platform/suppliers/openrouter/rein-openweights`,
+`platform/suppliers/scaleway/bootstrap`, `platform/suppliers/scaleway/backup`,
+`platform/suppliers/ionos/email-connect-smtp`, and
+`platform/suppliers/ionos/library-imap`. Further suppliers use the same
+two-level shape. llm-connect already tries the llm-connect supplier path
+and then the live workload path before `OPENROUTER_API_KEY`.
+
+## Catalog pointer
+
+```task
+id: WARDEN-WP-0043-T01
+status: todo
+priority: high
+```
+
+Add a pointer catalog entry and a short playbook for
+`platform/suppliers/<supplier>/<account>`. `warden_executes: false`. The
+owner of the KV write is railiance-platform. No secret values, no fetch
+of a live field, and no new `warden` verb.
+
+## Allow the path in credential changes
+
+```task
+id: WARDEN-WP-0043-T02
+status: wait
+priority: high
+blocked_on: message-from:railiance-platform
+```
+
+`railiance-platform/scripts/credential-change.py` accepts `platform/workloads/`
+and `tenants/` for a delegated change. `platform/suppliers/` needs that
+allowlist widened before a CCR can create these paths. ops-warden does not
+apply the change.
+
+## Provision supplier accounts
+
+```task
+id: WARDEN-WP-0043-T03
+status: wait
+priority: medium
+needs_human: true
+```
+
+New supplier material is written from a mode-0600 file on a trusted
+terminal, into `platform/suppliers/<supplier>/<account>`. IONOS is the
+first account that still needs that home. Existing workload and rein
+readers keep their current paths until each one is retargeted. Values do
+not go into git, State Hub, workplans, logs, or chat.