WARDEN-WP-0029: optimize workplan sequence, constraints, reuse map
Reorder for delivery (T02/T05 → T01 → T04 → T03), raise T05 priority for catalog-staleness root cause, add compose/third-axis/desk non-goals, and document reuse.coulomb.social building blocks.
This commit is contained in:
parent
cb762e06cb
commit
5c6b71b83b
1 changed files with 93 additions and 57 deletions
|
|
@ -10,6 +10,7 @@ topic_slug: custodian
|
|||
planning_priority: high
|
||||
planning_order: 29
|
||||
created: "2026-07-18"
|
||||
updated: "2026-07-18"
|
||||
state_hub_workstream_id: "6e396e7e-99c5-43aa-98a0-27f157de12a3"
|
||||
---
|
||||
|
||||
|
|
@ -34,16 +35,74 @@ this workplan) capture the direction.
|
|||
1. `warden plan "<need>"` — a policy decision front door: given a need, answer
|
||||
*autonomous / founder-act-required / unroutable*, with the exact commands
|
||||
or the exact founder act, posture-stated.
|
||||
2. Declared **organization posture** (`build`) that answers and scorecards
|
||||
reference.
|
||||
2. Declared **organization posture** (`build`) as a **third axis** beside env
|
||||
posture (dev/test/prod) and workload maturity (M0–M3).
|
||||
3. A **founder interaction surface**: local web page for the rare founder
|
||||
acts (approve, OIDC-login prompt, paste-once secret capture straight into
|
||||
OpenBao) — no values through CLI history or files.
|
||||
4. Catalog freshness + agent guidance so ask-warden-first is the enforced
|
||||
default.
|
||||
|
||||
## Design constraints (optimized 2026-07-18)
|
||||
|
||||
- **Compose, do not fork:** `warden plan` must call the routing catalog +
|
||||
`expand_handoff` / `resolvable`; it must not re-implement keyword matching
|
||||
or invent a second catalog.
|
||||
- **Org posture is a third axis:** do not overload env posture or maturity.
|
||||
- **Desk MVP is build-phase only:** localhost, OS-session trust, stdlib HTTP
|
||||
server (pattern: net-kingdom `security-bootstrap-console`). No core-hub /
|
||||
whynot dependency for v1.
|
||||
- **Reuse map (reuse.coulomb.social):** flex-auth (policy-evaluate), key-cape
|
||||
(OIDC act), net-kingdom bootstrap console (localhost desk shape),
|
||||
railiance-platform (OpenBao custody). Do not rebuild those owners.
|
||||
|
||||
## Delivery sequence
|
||||
|
||||
```text
|
||||
T02 (org posture) ─┐
|
||||
T05 (catalog freshness) ─┼─→ T01 (warden plan composes both)
|
||||
T04 (playbook sweep) ───┘ (parallel once plan shape known)
|
||||
T03 (desk) ← after T01 can emit founder_required with a typed act
|
||||
```
|
||||
|
||||
T05 is high priority: catalog staleness was the incident root cause.
|
||||
|
||||
## Tasks
|
||||
|
||||
### T02 — Declared organization posture (build phase)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0029-T02
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "73ae528c-384d-43dd-a62a-455a32ec1ea5"
|
||||
```
|
||||
|
||||
Add `organization_posture: build` as a **third axis** in registry policy
|
||||
configuration (alongside env posture dev/test/prod and workload maturity
|
||||
M0–M3 — do not overload those axes), with build-phase policy relaxations
|
||||
spelled out (workstation OIDC acceptable, per-repo deploy keys, advisory
|
||||
flex-auth) and the graduation triggers (first customer data, first
|
||||
non-founder operator, prod tier). `warden plan`, `warden policy`, and
|
||||
scorecard must state the posture in their output.
|
||||
|
||||
### T05 — Catalog freshness + agent guidance
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0029-T05
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "2121d102-806a-424a-8b62-bd25d7a9324e"
|
||||
```
|
||||
|
||||
The stale-CLI failure mode: `warden` resolved an old **bundled** catalog and
|
||||
hid an existing lane. Add a catalog version/freshness check (source path,
|
||||
content hash or mtime, package version, warn when using bundled fallback or
|
||||
when reviewed entries are stale; `warden route list` shows catalog date) and
|
||||
update AGENTS/CLAUDE guidance in ops-warden: agents must run `warden plan`
|
||||
before ever drafting a founder credential step. (Consuming-repo snippets are
|
||||
out of band — pointer only.)
|
||||
|
||||
### T01 — `warden plan` decision front door
|
||||
|
||||
```task
|
||||
|
|
@ -54,44 +113,13 @@ state_hub_task_id: "32e4a755-fb74-4979-920f-32d44888df9d"
|
|||
```
|
||||
|
||||
New command: `warden plan "<need>" [--actor agt-...] [--domain ...]`.
|
||||
Resolves the routing catalog + posture + policy gates and returns a typed
|
||||
**Composes** routing catalog (`find` / `RouteEntry`) + `expand_handoff` +
|
||||
`resolvable` + organization posture + policy gate status. Returns a typed
|
||||
verdict: `autonomous` (with the exec-capable command sequence),
|
||||
`founder_required` (with the minimal founder act, e.g. "OIDC login role X" or
|
||||
"Red-lane approval Y"), or `unroutable` (with a CCR proposal stub). JSON
|
||||
output for agents. Every plan call audited (metadata only).
|
||||
|
||||
### T02 — Declared organization posture (build phase)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0029-T02
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "73ae528c-384d-43dd-a62a-455a32ec1ea5"
|
||||
```
|
||||
|
||||
Add `organization_posture: build` to the posture/registry configuration
|
||||
(alongside env posture dev/test/prod and workload maturity M0–M3), with the
|
||||
build-phase policy relaxations spelled out (workstation OIDC acceptable,
|
||||
per-repo deploy keys, advisory flex-auth) and the graduation triggers (first
|
||||
customer data, first non-founder operator, prod tier). `warden plan` and
|
||||
scorecard must state the posture in their output.
|
||||
|
||||
### T03 — Founder interaction surface (local web approval page)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0029-T03
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "2ea768b7-d756-4c45-ac65-1670e069fafb"
|
||||
```
|
||||
|
||||
`warden desk` (working name): serves a localhost, short-lived page when a
|
||||
plan needs a founder act — renders the exact action in plain language
|
||||
(approve/deny, launch OIDC login, or paste-once secret capture that writes
|
||||
straight to the OpenBao path and never echoes). No values in terminal
|
||||
scrollback, shell history, or files. Metadata-only audit per interaction.
|
||||
Build-phase scope: localhost only, no auth beyond OS session; hardening
|
||||
graduates with posture.
|
||||
`founder_required` (with a typed founder act: `oidc_login` | `approve` |
|
||||
`paste_once_provision`), or `unroutable` (with a CCR proposal stub). JSON
|
||||
output for agents. Every plan call audited (metadata only). Does **not**
|
||||
duplicate keyword matching or hold secret values.
|
||||
|
||||
### T04 — Retire file-drop patterns from playbooks
|
||||
|
||||
|
|
@ -104,41 +132,49 @@ state_hub_task_id: "61d25118-14ec-4846-8d53-3e09d437cac3"
|
|||
|
||||
Sweep wiki/playbooks (starting with
|
||||
`forgejo-admin-api-token.md` `/tmp/forgejo-tegwick-api-token` steady-state
|
||||
remnants) and replace file drops with `warden access --exec` / `--fetch`
|
||||
lanes or T03 paste-once capture. Update the two live consumers:
|
||||
railiance-platform `forgejo_package_prune` docs and binky-control cutover
|
||||
runbook.
|
||||
remnants) and replace file drops with `warden access --exec` / `--out` /
|
||||
`--wrap` lanes or T03 paste-once capture. Document consumer follow-ups
|
||||
(railiance-platform `forgejo_package_prune`, binky-control cutover) as
|
||||
pointers — in-repo playbooks must not instruct founder file drops.
|
||||
|
||||
### T05 — Catalog freshness + agent guidance
|
||||
### T03 — Founder interaction surface (local web approval page)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0029-T05
|
||||
id: WARDEN-WP-0029-T03
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "2121d102-806a-424a-8b62-bd25d7a9324e"
|
||||
state_hub_task_id: "2ea768b7-d756-4c45-ac65-1670e069fafb"
|
||||
```
|
||||
|
||||
The stale-CLI failure mode: `warden` resolved an old catalog and hid an
|
||||
existing lane. Add a catalog version/freshness check (warn when installed
|
||||
catalog is older than repo/registry head; `warden route list` shows catalog
|
||||
date) and update AGENTS/CLAUDE guidance in ops-warden + consuming repos:
|
||||
agents must run `warden plan` before ever drafting a founder credential
|
||||
step.
|
||||
`warden desk`: serves a localhost, short-lived page when a plan needs a
|
||||
founder act — renders the exact action in plain language (approve/deny,
|
||||
launch OIDC login, or paste-once secret capture that writes straight to the
|
||||
OpenBao path and never echoes). No values in terminal scrollback, shell
|
||||
history, or durable files. Metadata-only audit per interaction.
|
||||
|
||||
**Build-phase non-goals:** multi-user auth, remote bind, core-hub / whynot
|
||||
UI stack. Pattern: stdlib `ThreadingHTTPServer` on `127.0.0.1` only (see
|
||||
net-kingdom security-bootstrap-console). Hardening graduates with org
|
||||
posture.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- `warden plan "forgejo deploy key for binky-control"` returns `autonomous`
|
||||
with the admin-lane command sequence; `warden plan` for a new tenant
|
||||
secret returns `founder_required` with exactly one founder act.
|
||||
with the admin-lane command sequence; `warden plan` for a need that only
|
||||
matches a non-resolvable / provision-needed path returns `founder_required`
|
||||
with exactly one typed founder act.
|
||||
- Posture `build` visible in plan output and scorecard.
|
||||
- One real founder act completed through the web surface with zero secret
|
||||
values in CLI/files.
|
||||
- No playbook instructs a founder file drop.
|
||||
- `warden desk` can complete one founder act (approve or paste-once) with
|
||||
zero secret values in CLI/files/audit payload.
|
||||
- No in-repo playbook instructs a founder file drop as steady state.
|
||||
- Catalog freshness is visible on `warden route list` / plan JSON.
|
||||
|
||||
## See also
|
||||
|
||||
- INTENT.md §7 (founder escalated, never tasked) and §8 (build-phase posture)
|
||||
- WARDEN-WP-0025 (forgejo admin token lane), WARDEN-WP-0026/0027 (disclosure
|
||||
hygiene, governance lockdown)
|
||||
- reuse.coulomb.social: `capability.authorization.policy-evaluate`,
|
||||
`capability.iam.key-cape`, `capability.security.iam-tooling-suite`
|
||||
- binky-control DEC-2026-003 (first consumer: cutover without founder
|
||||
mechanics)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue