From 6d2f1be9691b19e826898a2166ae4451e4802ae2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 23:41:31 +0200 Subject: [PATCH] Route lanes inside the SEC-DSM preference hierarchy. SSH certificates stay the ephemeral credential this repo issues. Static secrets stay with their owner. Assistant: grok Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4 --- .claude/rules/credential-routing.md | 6 ++++++ AGENTS.md | 27 +++++++++++++++++++++++++++ wiki/CredentialRouting.md | 8 ++++++++ 3 files changed, 41 insertions(+) diff --git a/.claude/rules/credential-routing.md b/.claude/rules/credential-routing.md index 54216e0..c3e999d 100644 --- a/.claude/rules/credential-routing.md +++ b/.claude/rules/credential-routing.md @@ -8,6 +8,12 @@ ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Eve other credential need belongs to another subsystem. **Do not** message `ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key. +Secrets practice follows SecurityCanon `SEC-DSM` 1.0.0 +(`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`). +Use its preference hierarchy (§5) and decision procedure (§37) before proposing +a new lane. SSH certificates are the ephemeral credential this repo issues. +Static secrets stay with their owner. This repo routes to that owner. + ### Lookup (do this first) **Always plan before drafting any founder credential step** (WARDEN-WP-0029): diff --git a/AGENTS.md b/AGENTS.md index 6cab836..dea050c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -190,6 +190,33 @@ get wrong. +## Secrets practice guide + +From 2026-10-11, secrets practice follows SecurityCanon `SEC-DSM` 1.0.0: + +`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md` + +Gate House teaches that standard. This repo operates lanes inside it. SSH +certificates (`warden sign`) are the short-lived credential this repo issues. +Every other credential is routed, not stored here. + +Before adding or changing a lane, apply §5 and §37: + +- Prefer native or federated identity, then an ephemeral credential, then an + automatically rotated secret, then a vaulted static secret. +- Do not become the vault (`DSM-AP-002`, `DSM-AP-006`, `DSM-AP-015`). OpenBao + remains custody. This repo remains the conduit. +- Do not have a human carry a secret (`DSM-HUM-001`). Desk paste-once and + `warden access --out` / `--exec` / `--wrap` stay the sanctioned transports. +- Do not write secret values into audit, chat, workplans, or stdout + (`DSM-AUDIT-002`). +- A tool that can read a secret is agent authority (`DSM-AP-020`, + `DSM-AGENT-008`). High-risk lanes stay behind the agent read boundary. + +A residual static secret that cannot be eliminated is still someone else's +custody. The catalog entry points at the owner and records rotation and +revocation. It does not hold the value. + ## Experiential memory (WARDEN-WP-0024) ops-warden shares a **phase-memory** store across worker ticks, coding agent diff --git a/wiki/CredentialRouting.md b/wiki/CredentialRouting.md index 6afff20..5a9b504 100644 --- a/wiki/CredentialRouting.md +++ b/wiki/CredentialRouting.md @@ -13,6 +13,14 @@ for `exec_capable` catalog lanes, can proxy the owner's tool **as the caller**. That is a transparent conduit, not custody: do not paste secrets into Git, State Hub, agent chat, or workplans. +Practice follows SecurityCanon `SEC-DSM` 1.0.0 +(`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`), +which Gate House teaches. Prefer, in order: native identity, federated identity, +an ephemeral credential, an automatically rotated secret, then a vaulted static +secret (§5, decision procedure §37). SSH certificates are the ephemeral path +this repo issues. A static secret stays in the owner's custody. This page routes +to that owner. It does not collect the value. + --- ## Quick decision tree