From 9770d6ad661fcd2fe8c2982fb4f31e7ee9a2d961 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 1 Sep 2026 00:51:52 +0200 Subject: [PATCH] docs: close Warden credential workplans Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663 --- ...-WP-0035-policy-nexus-forgejo-source-read-route.md | 11 +++++++++-- ...> WARDEN-WP-0036-attended-login-openbao-output.md} | 6 +++--- 2 files changed, 12 insertions(+), 5 deletions(-) rename workplans/{WARDEN-WP-0034-attended-login-openbao-output.md => WARDEN-WP-0036-attended-login-openbao-output.md} (93%) diff --git a/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md b/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md index 79e4e0d..af56f05 100644 --- a/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md +++ b/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md @@ -4,7 +4,7 @@ type: workplan title: "Register the Policy Nexus Forgejo source-read route" domain: infotech repo: ops-warden -status: active +status: finished owner: codex topic_slug: policy-nexus-forgejo-source-read created: "2026-09-01" @@ -27,10 +27,17 @@ resolvable while remaining subject to Warden's high-risk agent read boundary. ```task id: WARDEN-WP-0035-T02 -status: progress +status: done priority: high ``` Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove the installed route resolves and can hand the value only to a sanctioned child transport without printing or persisting it. + +Completed 2026-09-01. All 406 selected tests passed, including the generated +high-risk data-path boundary. The no-cache installed CLI resolves the exact +lane, and `warden plan` returns only sanctioned `--exec`, `--out`, and `--wrap` +transports for an agent caller. Policy Nexus Actions run 32 separately proved +the installed credential against the complete private-source fetch and release +path without exposing the value. diff --git a/workplans/WARDEN-WP-0034-attended-login-openbao-output.md b/workplans/WARDEN-WP-0036-attended-login-openbao-output.md similarity index 93% rename from workplans/WARDEN-WP-0034-attended-login-openbao-output.md rename to workplans/WARDEN-WP-0036-attended-login-openbao-output.md index 8dee644..8607194 100644 --- a/workplans/WARDEN-WP-0034-attended-login-openbao-output.md +++ b/workplans/WARDEN-WP-0036-attended-login-openbao-output.md @@ -1,5 +1,5 @@ --- -id: WARDEN-WP-0034 +id: WARDEN-WP-0036 type: workplan title: "Accept contained OpenBao login output only after helper persistence" domain: infotech @@ -14,7 +14,7 @@ updated: "2026-09-01" ## Repair attended-login handoff ```task -id: WARDEN-WP-0034-T01 +id: WARDEN-WP-0036-T01 status: done priority: high ``` @@ -27,7 +27,7 @@ failure. ## Verify live contained operation ```task -id: WARDEN-WP-0034-T02 +id: WARDEN-WP-0036-T02 status: done priority: high ```