coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

feat: adopt security zones and explicit workload refs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:36:37 +02:00
parent 12c637cbf2
commit 7ce58ae638
52 changed files with 1547 additions and 658 deletions
Download patch file Download diff file Expand all files Collapse all files

31
registry/flex-auth/production_registry_snapshot.json
View file

@ -48,8 +48,8 @@
],
"metadata": {
"flex_auth_contract": "protected-system-v0",
"ops_warden_policy_gate": "v2",
"policy_enabled_config": "policy.enabled",
"ops_warden_policy_gate": "security-zones-v0.1",
"security_zone_standard": "security-zones_v0.1",
"tenant": "tenant:platform"
}
}
@ -66,7 +66,6 @@
"ssh-signing",
"adm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "adm-example",
@ -78,7 +77,10 @@
"allowed_principals": [
"adm-full"
],
"max_ttl_hours": 48
"max_ttl_hours": 48,
"security_zone": "unknown",
"security_zone_admission": "not-applicable",
"security_zone_reason": "human operator retains native actor identity"
}
},
{
@ -88,7 +90,6 @@
"ssh-signing",
"agt"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "agt-codex-interhub-bootstrap",
@ -100,7 +101,11 @@
"allowed_principals": [
"agt-interhub-bootstrap"
],
"max_ttl_hours": 2
"max_ttl_hours": 2,
"workload_id": "codex-interhub-bootstrap",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
},
{
@ -110,7 +115,6 @@
"ssh-signing",
"agt"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "agt-state-hub-bridge",
@ -122,7 +126,11 @@
"allowed_principals": [
"agt-task-bridge"
],
"max_ttl_hours": 24
"max_ttl_hours": 24,
"workload_id": "ops-bridge-tunnel",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
},
{
@ -132,7 +140,6 @@
"ssh-signing",
"atm"
],
"trust_zone": "platform",
"owner": "team:platform-security",
"attributes": {
"actor_id": "atm-backup-daily",
@ -144,7 +151,11 @@
"allowed_principals": [
"atm-backup-daily"
],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"workload_id": "backup-daily",
"security_zone": "unknown",
"security_zone_admission": "unknown",
"security_zone_reason": "workload_resolution_absent"
}
}
],