coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Adopt tenants/<tenant>/… custody (not platform/workloads). Document
onboarding, add draft binky-company-email-imap catalog entry, and mark
T01–T04/T06–T07 done. Founder Red provision remains T05.
This commit is contained in:
tegwick 2026-07-17 00:09:28 +02:00
parent b971403dad
commit 98a2339b81
7 changed files with 634 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
wiki/playbooks/catalog-lane-promotion.md
View file

@ -87,10 +87,11 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
---
## Draft lanes (2026-07-16)
## Draft lanes (2026-07-17)
| Catalog `id` | Blocker |
| --- | --- |
| `binky-company-email-imap` | Founder Red provision of IMAP values (CCR-2026-0007 applied; mount/policy/role live) |
| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
@ -98,6 +99,9 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
capabilities-safe re-verify (WP-0026 T07); primary field `NC_WEBDAV_TOKEN`;
`risk: high` + EXPOSED taint on version 2 (operator may rotate optionally).
**Tenant path (WP-0028):** new client secrets use mount `tenants/`, not
`platform/workloads/`. See `wiki/playbooks/tenant-secret-onboarding.md`.
Re-run promotion when the owning repo closes the blocker; do not promote on
playbook prose alone.