Route lanes inside the SEC-DSM preference hierarchy.

SSH certificates stay the ephemeral credential this repo issues. Static secrets stay with their owner.

Assistant: grok
Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4

.claude/rules/credential-routing.md

@@ -8,6 +8,12 @@ ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Eve
 other credential need belongs to another subsystem. **Do not** message
 `ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
 
+Secrets practice follows SecurityCanon `SEC-DSM` 1.0.0
+(`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`).
+Use its preference hierarchy (§5) and decision procedure (§37) before proposing
+a new lane. SSH certificates are the ephemeral credential this repo issues.
+Static secrets stay with their owner. This repo routes to that owner.
+
 ### Lookup (do this first)
 
 **Always plan before drafting any founder credential step** (WARDEN-WP-0029):

AGENTS.md

@@ -190,6 +190,33 @@ get wrong.
 <!-- Append repo-specific agent instructions below this marker.
      The state-hub template sync preserves content after this line. -->
 
+## Secrets practice guide
+
+From 2026-10-11, secrets practice follows SecurityCanon `SEC-DSM` 1.0.0:
+
+`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`
+
+Gate House teaches that standard. This repo operates lanes inside it. SSH
+certificates (`warden sign`) are the short-lived credential this repo issues.
+Every other credential is routed, not stored here.
+
+Before adding or changing a lane, apply §5 and §37:
+
+- Prefer native or federated identity, then an ephemeral credential, then an
+  automatically rotated secret, then a vaulted static secret.
+- Do not become the vault (`DSM-AP-002`, `DSM-AP-006`, `DSM-AP-015`). OpenBao
+  remains custody. This repo remains the conduit.
+- Do not have a human carry a secret (`DSM-HUM-001`). Desk paste-once and
+  `warden access --out` / `--exec` / `--wrap` stay the sanctioned transports.
+- Do not write secret values into audit, chat, workplans, or stdout
+  (`DSM-AUDIT-002`).
+- A tool that can read a secret is agent authority (`DSM-AP-020`,
+  `DSM-AGENT-008`). High-risk lanes stay behind the agent read boundary.
+
+A residual static secret that cannot be eliminated is still someone else's
+custody. The catalog entry points at the owner and records rotation and
+revocation. It does not hold the value.
+
 ## Experiential memory (WARDEN-WP-0024)
 
 ops-warden shares a **phase-memory** store across worker ticks, coding agent

wiki/CredentialRouting.md

@@ -13,6 +13,14 @@ for `exec_capable` catalog lanes, can proxy the owner's tool **as the caller**.
 That is a transparent conduit, not custody: do not paste secrets into Git,
 State Hub, agent chat, or workplans.
 
+Practice follows SecurityCanon `SEC-DSM` 1.0.0
+(`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`),
+which Gate House teaches. Prefer, in order: native identity, federated identity,
+an ephemeral credential, an automatically rotated secret, then a vaulted static
+secret (§5, decision procedure §37). SSH certificates are the ephemeral path
+this repo issues. A static secret stays in the owner's custody. This page routes
+to that owner. It does not collect the value.
+
 ---
 
 ## Quick decision tree