WARDEN-WP-0033-T05: split the stale cadences, and record how a blocker was verified
The 90-day --stale-days default on `warden route gaps` was not a loose threshold, it was an inert one: the delegation register was created 2026-08-15, so it could not have fired before November. It was inherited from the catalog pointer cadence and applied to a claim with a completely different half-life. Two changes. DEFAULT_BLOCKER_STALE_DAYS = 14 now governs interim blockers, while DEFAULT_STALE_DAYS = 90 keeps governing pointer freshness -- "is this the right owner and page" is quarterly, "has the owner answered" is not. 14 is calibrated on blockers that actually cost something: ten days for the secrets-engine lanes, one for RISK-F-0001, roughly fifty for FLEX-WP-0007. The second change matters more. `reviewed` records when someone touched an entry, which is indistinguishable from re-checking it -- six lanes read as freshly reviewed today because I typed in them. `verified:` now says how the claim was established, and asked-and-waiting explicitly does NOT count: that is the state the secrets-engine blocker sat in for ten days while looking current. A lane in that state is stale at zero days old, and key-cape-oidc-login proves it works. 8 of 14 interim lanes are honestly marked unverified rather than given a fresh date they did not earn. --fail-on-stale exits 3 for a cron or gate. No CI test on age: a date-triggered failure breaks the build for whoever commits next instead of whoever owns the blocker. The CI test is structural -- every interim lane must record how it was verified -- so it fails on the commit that introduces the omission. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
parent
a565e62b2f
commit
55f0f47a02
8 changed files with 335 additions and 24 deletions
|
|
@ -73,6 +73,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: railiance-platform
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
# Concrete broker lane — RAILIANCE-WP-0005 pilot (live 2026-07-01):
|
||||
# credential exec injects VAULT_TOKEN only into the child process; ops-warden
|
||||
# issues SSH certs and never mints or holds OpenBao tokens.
|
||||
|
|
@ -109,6 +110,7 @@ entries:
|
|||
intended_owner: railiance-platform
|
||||
blocked_on: "NOT A DELEGABLE LANE. Refused by secrets-engine 2026-08-21: this is a generic routing template (path_template is a <domain>/<workload>/<bundle> pattern), not one secret lane, so there is no front door for anyone to own. ops-warden agrees. The concrete lanes it resolves to are delegated individually; this entry stays a pointer and should not be counted as an interim cover."
|
||||
reviewed: "2026-08-21"
|
||||
verified: unverified
|
||||
# Structured handoff (WP-0014) — reference example. Templates only, no values.
|
||||
# ops-warden does not own this secret; it advises and (exec_capable) proxies the
|
||||
# fetch *as the caller* via `warden access`, never holding or persisting the value.
|
||||
|
|
@ -143,6 +145,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: secrets-engine
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0001 (commit 8f617fc):
|
||||
# status=active, access_frontdoor.readiness=ready, resolvable=true; positive fetch
|
||||
# passed and negative (non-whynot) login denied. Zero-placeholder fetch: an automated
|
||||
|
|
@ -186,6 +189,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: flex-auth
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: key-cape-oidc-login
|
||||
title: Interactive login, OIDC token, or MFA
|
||||
|
|
@ -204,6 +208,7 @@ entries:
|
|||
intended_owner: key-cape
|
||||
blocked_on: "REFUSED by secrets-engine 2026-08-21: login, MFA and identity-token issuance are key-cape/Keycloak's; secrets-engine may consume OIDC for OpenBao auth but does not own the login capability. ops-warden agrees — intended_owner corrected from secrets-engine to key-cape. Not yet asked of key-cape."
|
||||
reviewed: "2026-08-21"
|
||||
verified: asked-and-waiting
|
||||
# Login lane (WP-0014 T4) — interactive auth bootstrap, not a secret read. No
|
||||
# secret-read gate (you have no identity yet) and no caller-auth precheck (the
|
||||
# point is to obtain one). warden runs it interactively as the caller and never
|
||||
|
|
@ -229,6 +234,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: ops-bridge
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: railiance-infra-principals
|
||||
title: Host SSH principal file or force-command deployment
|
||||
|
|
@ -246,6 +252,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: railiance-infra
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: inter-hub-bootstrap-ssh
|
||||
title: Inter-Hub bootstrap SSH envelope
|
||||
|
|
@ -263,6 +270,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: railiance-infra
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: activity-core-issue-sink
|
||||
title: activity-core IssueSink → issue-core REST emission
|
||||
|
|
@ -280,6 +288,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: activity-core
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: issue-core-ingestion-api-key
|
||||
title: issue-core ingestion API key (OpenBao KV + ESO)
|
||||
|
|
@ -306,6 +315,7 @@ entries:
|
|||
intended_owner: secrets-engine
|
||||
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
|
||||
reviewed: "2026-08-21"
|
||||
verified: owner-confirmed
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0002 / RAILIANCE-WP-0009
|
||||
# (promoted 2026-07-02): policy workload-kv-read-issue-core-runtime and k8s auth role
|
||||
# external-secrets-issue-core applied; ExternalSecret issue-core/issue-core-runtime
|
||||
|
|
@ -353,6 +363,7 @@ entries:
|
|||
intended_owner: secrets-engine
|
||||
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
|
||||
reviewed: "2026-08-21"
|
||||
verified: owner-confirmed
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011
|
||||
# (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret
|
||||
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
|
||||
|
|
@ -390,6 +401,7 @@ entries:
|
|||
intended_owner: secrets-engine
|
||||
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
|
||||
reviewed: "2026-08-21"
|
||||
verified: owner-confirmed
|
||||
# High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04).
|
||||
risk: high
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0003 / RAILIANCE-WP-0010
|
||||
|
|
@ -430,6 +442,7 @@ entries:
|
|||
intended_owner: railiance-platform
|
||||
blocked_on: "Rotation is re-establish, a multi-step procedure ops-warden only describes"
|
||||
reviewed: "2026-08-11"
|
||||
verified: unverified
|
||||
# High-risk: WebDAV upload token + AGE recovery escrow (WP-0026 T04).
|
||||
risk: high
|
||||
# CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07.
|
||||
|
|
@ -475,6 +488,7 @@ entries:
|
|||
intended_owner: secrets-engine
|
||||
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
|
||||
reviewed: "2026-08-21"
|
||||
verified: owner-confirmed
|
||||
# High-risk: site-admin PAT (WP-0026 T04).
|
||||
risk: high
|
||||
# CCR-2026-0006: approved by platform-operator 2026-07-12; policy
|
||||
|
|
@ -517,6 +531,7 @@ entries:
|
|||
intended_owner: tenant-engine
|
||||
blocked_on: "Custody at tenants/binky/... but rotation owner is binky-control — split lifecycle, no front door reconciling it"
|
||||
reviewed: "2026-08-11"
|
||||
verified: unverified
|
||||
risk: high
|
||||
# CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned
|
||||
# values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17:
|
||||
|
|
@ -551,6 +566,7 @@ entries:
|
|||
intended_owner: tenant-engine
|
||||
blocked_on: "Same split lifecycle as binky-company-email-imap; no tenant-engine front door"
|
||||
reviewed: "2026-08-11"
|
||||
verified: unverified
|
||||
risk: high
|
||||
# CCR-2026-0008: policy + OIDC role applied; secret at tenants/binky/qonto-api
|
||||
# (fields API_KEY, API_USER). Map to QONTO_API_KEY / QONTO_ORGANIZATION_ID for
|
||||
|
|
@ -586,6 +602,7 @@ entries:
|
|||
intended_owner: key-cape
|
||||
blocked_on: "client_secret_basic exchange is a key-cape protocol procedure, not a KV read; KEY-WP-0008 finished 2026-08-15 without a key-cape-native exchange/rotation command, and the workplan that would add one is not yet opened (key-cape acked interim 2026-08-15)"
|
||||
reviewed: "2026-08-17"
|
||||
verified: unverified
|
||||
risk: high
|
||||
auth_method: "OpenBao platform workload lane; KeyCape client_secret_basic exchange"
|
||||
path_template: "platform/workloads/rapp-qonto/keycape-client"
|
||||
|
|
@ -616,6 +633,7 @@ entries:
|
|||
intended_owner: railiance-platform
|
||||
blocked_on: "re-establish plus an alternative host-local key path; two ways in, neither owner-fronted (also agent-harness)"
|
||||
reviewed: "2026-08-11"
|
||||
verified: unverified
|
||||
risk: high
|
||||
# Provisioned 2026-07-17 on railiance01: ed25519 keypair on host, OpenBao copy at
|
||||
# platform/workloads/agent-harness/forgejo-deploy-key, write deploy key on
|
||||
|
|
@ -651,6 +669,7 @@ entries:
|
|||
intended_owner: railiance-platform
|
||||
blocked_on: "AppRole is a host-standing credential; no owner front door for minting or rotating role_id+secret_id"
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
risk: high
|
||||
# Provisioned 2026-07-17: role agent-harness-binky-mail bound to existing policy
|
||||
# workload-kv-read-binky-company-email-imap; role_id/secret_id delivered to
|
||||
|
|
@ -689,6 +708,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: net-kingdom
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
|
||||
- id: database-dynamic-credentials
|
||||
title: Database dynamic credentials (OpenBao secrets engine)
|
||||
|
|
@ -704,6 +724,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: rapp-postgres
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
risk: high
|
||||
exec_capable: false
|
||||
|
||||
|
|
@ -722,6 +743,7 @@ entries:
|
|||
intended_owner: ops-mason
|
||||
blocked_on: "AppRole is a host-standing credential; no owner-fronted exec for the OpenRouter key read"
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
risk: standard
|
||||
# Built 2026-07-27 by ops-mason (MASON-WP-0001-T05), approved by Bernd
|
||||
# Worsch 2026-07-27. Policy + AppRole live; reins/ KV v2 mount created
|
||||
|
|
@ -776,6 +798,7 @@ entries:
|
|||
intended_owner: railiance-apps
|
||||
blocked_on: "Runtime Secret applied via railiance-apps make target; OpenBao path planned but CCR not applied"
|
||||
reviewed: "2026-08-17"
|
||||
verified: unverified
|
||||
# USER_ENGINE_PROXY_SECRET ownership settled 2026-08-16 (Bernd; State Hub decision
|
||||
# 8fe22037-5bbb-4487-bb86-e4beccee454b, USER-WP-0021): it is infrastructure trust
|
||||
# between ingress and workload, not a user-domain fact. intended_owner stays
|
||||
|
|
@ -816,6 +839,7 @@ entries:
|
|||
mode: native
|
||||
intended_owner: ops-mason
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
|
||||
path_template: "platform/workloads/audit-core/senders"
|
||||
policy_ref: "external-secrets-audit-core"
|
||||
|
|
@ -838,6 +862,7 @@ entries:
|
|||
intended_owner: secrets-engine
|
||||
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
|
||||
reviewed: "2026-08-21"
|
||||
verified: owner-confirmed
|
||||
risk: high
|
||||
# CCR-2026-0010 approved 2026-08-12; applied same day (EMAIL-WP-0004-T03):
|
||||
# policies external-secrets-email-connect + workload-kv-read-email-connect-transactional,
|
||||
|
|
@ -879,6 +904,7 @@ entries:
|
|||
intended_owner: railiance-platform
|
||||
blocked_on: "Founder bootstrap API key; draft until provisioned; no owner-fronted exec"
|
||||
reviewed: "2026-08-15"
|
||||
verified: unverified
|
||||
risk: high
|
||||
# CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
|
||||
# Not the Barman runtime key (platform-pg-backup-s3).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue