coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer

Browse source 
Three fixes, the first of which is my own botched edit from an hour ago.

1. The "six delivery modes" claim was never actually removed. I ran a str.replace
   with no assertion on the result, it matched nothing, and the print said "ok".
   The wrong claim sat in all seven lanes while I told secrets-engine it was
   fixed. This edit asserts 5/1/1 and fails loudly otherwise.

2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now
   records that secrets-engine holds the entry and that the interim proxy retires
   on approved native verification in T05 -- not on acceptance. Retiring early
   would drop the cover before the replacement is proven.

3. Two lanes REFUSED, and both refusals are right:
   - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape.
     Login and identity-token issuance were never secrets-engine's. Not yet asked
     of key-cape, and the record says so.
   - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle>
     routing template, not one secret lane, so there is no front door to own.
     interim -> native with railiance-platform named: OpenBao is itself the front
     door and this entry is a pointer to it, never an interim cover. It should
     not have been inflating the interim count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 09:04:54 +02:00
parent b30626edcf
commit 675e04e8e6
2 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
registry/generated/high-risk-data-paths.yaml
View file

@ -10,11 +10,11 @@
# declares it, and is null where the field set has not been established --
# null means unknown, never 'one field'.
generated_at: "2026-08-21T06:37:27Z"
generated_at: "2026-08-21T07:04:54Z"
source: ops-warden/registry/routing/catalog.yaml
catalog_revision: "c357ce5908e562755f3c41c24074edc9d231e6ce"
catalog_revision_date: "2026-08-21T08:36:42+02:00"
catalog_dirty: false
catalog_dirty: true
high_risk_lane_count: 19
concrete_path_count: 14