Add WP-0030 delegation register; refresh INTENT and SCOPE

Founder directive: ops-warden works with, never replaces or duplicates, secrets-engine / tenant-engine / user-engine. Covering an unfilled gap is acceptable only as a tracked interim with a named intended owner. - INTENT §9 "Cover gaps, but never silently own them"; success criterion 7; tenant-engine and user-engine added to the literacy table; non-goal on permanently owning another component's lane - WP-0030 (proposed): delegation: metadata, backfill, warden route gaps, promotion gate, publish the register to owner repos - history/2026-08-11-delegation-surface-assessment.md: 2 of 24 lanes carry exec_owner; 11 proxies record no intended owner - SCOPE refreshed to 2026-08-11 (was 6 workplans behind); completeness C5 -> C4 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 11:11:01 +02:00 · 2026-08-11 11:11:01 +02:00 · 9d42dd5abd
commit 9d42dd5abd
parent 95ecfe51e2
6 changed files with 512 additions and 15 deletions
--- a/INTENT.md
+++ b/INTENT.md
@ -89,6 +89,8 @@ ops-warden should be fluent in the platform architecture documented in
 | **OpenBao** | Runtime secrets — API keys, dynamic creds, leases, audit | Instruct custody paths; SSH engine is signing backend only; proxy reads as caller when `exec_capable` |
 | **secrets-engine** | Owner-native secret-exec (`secrets-engine exec`) | Route provisioned exec lanes (e.g. npm publish); ops-warden does not hold tokens |
 | **railiance-platform** (credential broker) | Scoped lease grants (`credential exec`) | Route `warden-sign` token needs; ops-warden does not mint OpenBao tokens |
+| **tenant-engine** | Tenant/client secret custody and front door | Route tenant lanes once fronted; ops-warden's current tenant proxies are interim (§9) |
+| **user-engine** | End-user identity and account lifecycle | No ops-warden lane today; route rather than absorb |
 | **ops-warden** | Operational SSH certificates — short-lived host access | **Own and issue** this lane |
 | **ops-bridge** | Tunnel transport — consumes certs via `cert_command` | Primary consumer; document integration |
 | **railiance-infra** | Host principals, force-command, SSH hardening | Instruct host-side deployment; do not own Ansible |
@ -201,6 +203,31 @@ must know the current posture, state it in its answers, and tighten defaults
 when the posture graduates (first customer data, first non-founder operator,
 production tier). Posture is declared configuration, not tribal knowledge.

+### 9. Cover gaps, but never silently own them
+
+*(added 2026-08-11, founder directive — see WARDEN-WP-0030)*
+
+ops-warden **works with, and never replaces or duplicates**, secrets-engine,
+tenant-engine, user-engine and the other NetKingdom security components.
+
+It may nonetheless *cover* a need that no component systematically provides yet —
+that is a legitimate service, and the `warden access` proxy makes it cheap. The
+danger is precisely that cheapness: an absorbed need looks permanent, stops
+registering as a missing capability, and quietly turns a routing layer into a
+second secrets broker.
+
+So every execution position other than SSH issuance is **interim by default**:
+
+- record the component that *should* own the front door, and what is missing
+- treat the cover as a tracked gap, not as ownership
+- delegate the moment that component ships its front door, keeping the proxy
+  only as a fallback (`exec_owner` / `exec_command` — the WP-0019 pattern)
+
+A gap ops-warden covers silently is worse than a gap it refuses, because the
+refusal is visible and the cover is not. Filling the gap properly — with the
+owner's governance, custody, and policy — is the goal; ops-warden holding the
+lane is the temporary means.
+
 ---

 ## Credential flow (target mental model)
@ -267,6 +294,9 @@ ops-warden is succeeding when:
 5. Non-SSH secrets remain **out of ops-warden storage** — only documented paths.
 6. Security blockers can be classified by environment posture, workload maturity,
   owner route, and non-secret evidence instead of by vague credential risk.
+7. Every ops-warden execution position is explicitly **permanent** (SSH issuance) or
+   explicitly **interim** with a named intended owner and blocker — so gaps ops-warden
+   covers stay visible as gaps and can be handed back.

 ---

@ -279,6 +309,9 @@ ops-warden is succeeding when:
 - Host-side SSH configuration deployment
 - **Duplicating or restating another subsystem's procedure** — routing material
  points at the owner's docs; it does not fork them
+- **Permanently owning a lane that belongs to another component** — covering an
+  unfilled gap is acceptable and expected; keeping it after the owner can front it,
+  or holding it without recording that it is interim, is not (§9)
 - SSO / Teleport at scale (trigger per Access Management Directive §6.2)

 ---
--- a/SCOPE.md
+++ b/SCOPE.md
@ -17,7 +17,7 @@ access guidance aligned with NetKingdom canon.

 ---

-## Where we are (2026-07-01)
+## Where we are (2026-08-11)

 ops-warden **issues short-lived SSH certificates and routes every other credential
 need to the subsystem that owns it.** SSH signing is **production-verified** on
@ -59,12 +59,28 @@ contract smoke (`--sign-smoke`); the playbook leads with the gate and the pilot
 (`agt-state-hub-bridge`) is handed to ops-bridge. The live tunnel cutover is
 ops-bridge's to execute.

-**INTENT alignment:** SSH issuance mission met in production. ops-warden workplans
-through WP-0021 are finished; WP-0022 (audit) and WP-0023 (INTENT–SCOPE closeout)
-ship in July 2026. Remaining distance is in other repos' lanes: ops-bridge running
-the cert_command pilot cutover, flex-auth runtime deployment (FLEX-WP-0007, unblocks
-`policy.enabled: true`), and the owner-driven WP-0015 canon landing — plus ongoing
-operator hygiene.
+**Credential hygiene and the policy front door** shipped through July 2026:
+disclosure hygiene and rotation guidance (WP-0026 — `warden taint`,
+`warden rotate-guide`, agent read-boundary on high-risk lanes), the tenant secret
+custody pattern (WP-0028, first lane binky company email IMAP), experiential memory
+across worker/agent sessions (WP-0024), the Forgejo admin PAT lane (WP-0025), and the
+posture-aware policy front door (WP-0029 — `warden plan`, `warden desk`, declared
+`organization_posture: build` as a third axis). WP-0027 (tamper-resistant governance,
+mass rotation/lockdown) is drafted and sits in `backlog`.
+
+**Delegation register** is the open question (WP-0030, proposed). ops-warden fronts
+11 catalog lanes as a caller-identity proxy with no record of which component *should*
+own that front door. The primitive to delegate exists and is proven
+(`exec_owner`/`exec_command` — secrets-engine for npm publish, the credential broker
+for warden-sign) but is used by 2 of 24 lanes. See
+`history/2026-08-11-delegation-surface-assessment.md`.
+
+**INTENT alignment:** SSH issuance mission met in production. All ops-warden workplans
+through WP-0029 are finished except WP-0027 (`backlog`) and WP-0030 (`proposed`).
+Remaining distance is in other repos' lanes: ops-bridge running the cert_command pilot
+cutover, flex-auth runtime deployment (FLEX-WP-0007, unblocks `policy.enabled: true`),
+the owner-driven WP-0015 canon landing, and — newly named — the missing owner front
+doors that keep ops-warden holding interim lanes (secrets-engine, tenant-engine).

 ### Issue vs route

@ -84,6 +100,12 @@ ops-warden executes exactly one lane with its own authority and routes/assists t
 Full role and boundary: `wiki/AccessRouting.md`. The catalog is a **pointer layer** —
 it never restates an owner's procedure (authored `steps` exist only for the SSH lane).

+**Interim by default.** SSH issuance is the only lane ops-warden owns permanently.
+Where it proxies or assists, it is covering a need no component fronts yet — a
+legitimate service, but a *tracked gap*, retired to the owner once their front door
+exists (INTENT §9). Recording that intent per lane is WP-0030; today only
+`whynot-design-npm-publish` and `ops-warden-warden-sign-token` carry it.
+
 Gap analysis: `history/2026-07-01-intent-scope-gap-analysis.md` (current);
 `history/2026-06-24-intent-scope-gap-analysis.md` (prior);
 `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` (SSH lane);
@ -101,14 +123,15 @@ Gap analysis: `history/2026-07-01-intent-scope-gap-analysis.md` (current);
 | NetKingdom evolution reflected in docs | Met |
 | Non-SSH secrets stay out of ops-warden | Met |
 | Workload posture / maturity model for secret-flow blockers | Met — two-axis standard + descriptors + conformance checker + dev doubles (WP-0015) |
+| Every execution position explicitly permanent or interim with a named owner | **Not met** — 2 of 24 lanes carry `exec_owner`; 11 proxy lanes record no intended owner (WP-0030) |

-**Maturity vector:** `D5 / A5 / C5 / R4` (Discovery / Availability / Completeness / Reliability)
+**Maturity vector:** `D5 / A5 / C4 / R4` (Discovery / Availability / Completeness / Reliability)

 | Dimension | Level | Meaning today |
 | --- | --- | --- |
 | D5 | Discovery | Routing wiki + security map + pointer catalog + NK canon cross-links |
 | A5 | Availability | CLI + `warden route` + `warden access` advisory & proxy front door + `warden policy` + opt-in policy gate + agent `--json` |
-| C5 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, two owner-native exec routes documented (secrets-engine npm, credential broker warden-sign). Open items are external: flex-auth prod flip + ops-bridge live cutover |
+| C4 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, disclosure hygiene, tenant custody, policy front door. **Down from C5:** delegation is unrecorded on 11 of 24 lanes, so ops-warden's interim positions are not distinguishable from designed ones (WP-0030) |
 | R4 | Reliability | Live OpenBao sign + credential-broker policy-gate smoke evidence on Railiance (2026-07-01) |

 ---
@ -165,6 +188,19 @@ for the rest.
 - **Unified audit trail** (WP-0022): append-only `audit.jsonl`, secret-material guard,
  instrumentation on sign/access/worker paths, `warden activity` CLI merging legacy
  logs + optional State Hub notes (`wiki/AuditTrail.md`)
+- **Experiential memory** (WP-0024, `src/warden/memory.py`) — recorded outcomes feed
+  routing and coordination; no secret values, guardrail allowlist unchanged
+- **Disclosure hygiene** (WP-0026): `warden taint <catalog-id>` (KV `custom_metadata`,
+  no data read), `warden rotate-guide`, safe fetch transports (`--out` / `--exec` /
+  `--wrap`) with refusal to stream to non-terminal stdout, and the agent read-boundary
+  on `risk: high` lanes (exit 7 when `WARDEN_AGENT_ID` is set)
+- **Tenant secret custody** (WP-0028): tenant vs `platform/workloads/...` path
+  convention, policy/CCR/catalog ownership, first lane `binky-company-email-imap`
+- **Policy front door** (WP-0029): `warden plan "<need>" [--json]` returning
+  `autonomous` / `founder_required` (typed act) / `unroutable` (CCR stub);
+  `warden desk` loopback founder surface (approve, OIDC login, paste-once provision
+  straight into OpenBao); `organization_posture: build` as posture axis C; catalog
+  freshness reporting on `warden route list` and in plan JSON

 ### Stewardship (documentation and alignment)

@ -198,8 +234,25 @@ for the rest.

 | WP | Focus |
 | --- | --- |
+| WP-0017 | Access front-door discoverability |
+| WP-0018 | `whynot-design-npm-publish` — first concrete secret lane (production-exercised) |
+| WP-0019 | Route provisioned secret-exec lanes to secrets-engine (`exec_owner` pattern) |
+| WP-0020 | Coordination worker (`warden worker`) |
+| WP-0021 | Scheduled worker tick (systemd --user timer, kill switch) |
 | WP-0022 | Unified audit trail + `warden activity` |
 | WP-0023 | INTENT–SCOPE alignment closeout |
+| WP-0024 | Experiential memory across worker/agent sessions (`src/warden/memory.py`) |
+| WP-0025 | Forgejo admin PAT OpenBao lane (CCR-2026-0006) |
+| WP-0026 | Credential disclosure hygiene — `warden taint`, `warden rotate-guide`, agent read-boundary, safe fetch transports |
+| WP-0028 | Tenant secret custody pattern — tenant vs platform paths; first lane binky company email IMAP |
+| WP-0029 | Policy front door — `warden plan`, `warden desk`, `organization_posture: build` third axis |
+
+### Open ops-warden work
+
+| WP | Status | Focus |
+| --- | --- | --- |
+| WP-0027 | `backlog` | Tamper-resistant credential governance + mass rotation/lockdown (Strand B follow-on to WP-0026) |
+| WP-0030 | `proposed` | Delegation register — record intended owner + blocker on every interim lane, `warden route gaps`, promotion gate |

 Remaining production distance is also in other repos' lanes (see Known gaps).

@ -212,6 +265,8 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 | Principals sync warden ↔ railiance-infra | ops-warden + infra | `scripts/check_principals_drift.py` — operator runs periodically |
 | NK-WP-0009 joint SSH tutorial | net-kingdom | Parallel coordination track |
 | WP-0015 canon landing (generic `WorkloadMaturityLevel` + M0-M3 requirements) | net-kingdom + info-tech-canon | ops-warden drafted + offered (coordination msgs); owner-driven landing |
+| Owner front doors for workload secret lanes | secrets-engine | 6 lanes proxied by ops-warden that `secrets-engine exec` could front, as WP-0019 did for npm publish |
+| Owner front door for tenant secret lanes | tenant-engine | WP-0028 defined the custody pattern; 3 tenant lanes still fronted by ops-warden proxy |

 ---

@ -231,6 +286,9 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 - OpenBao / Vault cluster deployment → `railiance-platform`
 - Human admin SSH key generation (self-service `ssh-keygen`)
 - Session recording, SIEM, SSO / Teleport at scale
+- **Permanently owning another component's lane.** Covering an unfilled gap is in
+  scope and expected; keeping it once secrets-engine / tenant-engine / user-engine
+  can front it — or holding it without recording that it is interim — is not (INTENT §9)

 ---

@ -284,12 +342,24 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 - **Audit + activity:** WP-0022 shipped — `warden activity`, `wiki/AuditTrail.md`
 - **INTENT closeout:** WP-0023 shipped — INTENT refresh, production flip/cutover
  checklists, catalog promotion cadence, broker hint on missing `VAULT_TOKEN`
- **Active work:** none open in ops-warden after WP-0022/0023; remaining distance is
-  other repos' lanes
+- **Disclosure hygiene:** WP-0026 shipped — `warden taint`, `warden rotate-guide`,
+  safe fetch transports (`--out`/`--exec`/`--wrap`), agent read-boundary on `risk: high`
+  lanes (`wiki/playbooks/agent-read-boundary.md`)
+- **Tenant custody:** WP-0028 shipped — tenant vs platform path convention; first lane
+  `binky-company-email-imap`. Front door is still an ops-warden proxy (tenant-engine gap)
+- **Policy front door:** WP-0029 shipped — `warden plan "<need>"` (autonomous /
+  founder_required / unroutable), `warden desk` founder interaction surface, declared
+  `organization_posture: build` as a third posture axis, catalog freshness reporting
+- **Delegation:** 24 catalog lanes — 1 executed by ops-warden (SSH), 2 delegated via
+  `exec_owner`, 11 proxied with **no intended owner recorded**, 10 route-only. Addressed
+  by WP-0030 (proposed)
+- **Active work:** WP-0027 (`backlog`), WP-0030 (`proposed`); remaining production
+  distance is other repos' lanes
 - **Integration docs:** cert_command migration, token hygiene (broker-first), principals
  drift (`wiki/playbooks/`)
- **Latest assessment:** `history/2026-07-01-intent-scope-gap-analysis.md`
- **Latest workplans:** WP-0022 (audit), WP-0023 (INTENT–SCOPE closeout) — shipped July 2026
+- **Latest assessment:** `history/2026-08-11-delegation-surface-assessment.md`
+- **Latest workplans:** WP-0029 (policy front door) shipped July 2026; WP-0030
+  (delegation register) proposed 2026-08-11

 ---

@ -335,7 +405,9 @@ Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operato
 | `railiance-platform` | OpenBao deployment and platform secrets |
 | `flex-auth` | Authorization; policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
 | `key-cape` | Identity / IAM Profile lightweight mode |
-| `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) |
+| `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) and holds 6 more as interim proxies pending its front doors |
+| `tenant-engine` | Intended owner of tenant/client secret front doors; ops-warden holds 3 tenant lanes as interim proxies (WP-0028 pattern, WP-0030 register) |
+| `user-engine` | End-user identity/account lifecycle; no ops-warden lane today — route rather than absorb |
 | `state-hub` | Workplan registry |

 ---
@ -388,7 +460,9 @@ keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, l
 | `wiki/AuditTrail.md` | Unified metadata-only audit + `warden activity` |
 | `wiki/playbooks/catalog-lane-promotion.md` | draft → active catalog promotion checklist |
 | `wiki/CertCommandInterface.md` | cert_command contract |
-| `history/2026-07-01-intent-scope-gap-analysis.md` | Current INTENT↔SCOPE gap analysis |
+| `history/2026-08-11-delegation-surface-assessment.md` | Current assessment — where ops-warden covers gaps and who should own them |
+| `workplans/WARDEN-WP-0030-delegation-register.md` | Delegation register plan (proposed) |
+| `history/2026-07-01-intent-scope-gap-analysis.md` | Prior INTENT↔SCOPE gap analysis |
 | `workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md` | Alignment closeout plan |
 | `history/2026-06-24-intent-scope-gap-analysis.md` | Prior gap analysis |
 | `history/2026-06-27-workload-security-posture-charter.md` | WP-0015 posture/conformance charter |
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -0,0 +1,99 @@
+# Work Records — ops-warden
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | ADHOC-2026-06-27 | finished | — | workplans/ADHOC-2026-06-27.md |
+| workplan | ADHOC-2026-06-29 | finished | — | workplans/ADHOC-2026-06-29.md |
+| workplan | ADHOC-2026-08-11 | active | — | workplans/ADHOC-2026-08-11.md |
+| workplan | WARDEN-WP-0016 | finished | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| workplan | WARDEN-WP-0017 | finished | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| workplan | WARDEN-WP-0018 | finished | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| workplan | WARDEN-WP-0019 | finished | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| workplan | WARDEN-WP-0020 | finished | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| workplan | WARDEN-WP-0021 | finished | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| workplan | WARDEN-WP-0022 | finished | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| workplan | WARDEN-WP-0023 | finished | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| workplan | WARDEN-WP-0024 | finished | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| workplan | WARDEN-WP-0025 | finished | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| workplan | WARDEN-WP-0026 | finished | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| workplan | WARDEN-WP-0027 | backlog | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| workplan | WARDEN-WP-0028 | finished | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| workplan | WARDEN-WP-0029 | finished | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | ADHOC-2026-06-27-T01 | done | — | workplans/ADHOC-2026-06-27.md |
+| task | ADHOC-2026-06-29-T01 | done | — | workplans/ADHOC-2026-06-29.md |
+| task | ADHOC-2026-08-11-T01 | done | — | workplans/ADHOC-2026-08-11.md |
+| task | ADHOC-2026-08-11-T02 | done | — | workplans/ADHOC-2026-08-11.md |
+| task | ADHOC-2026-08-11-T03 | wait | — | workplans/ADHOC-2026-08-11.md |
+| task | WARDEN-WP-0016-T01 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T02 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T03 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0016-T04 | done | — | workplans/WARDEN-WP-0016-ops-bridge-tunnel-cert-pilot.md |
+| task | WARDEN-WP-0017-T01 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0017-T02 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0017-T03 | done | — | workplans/WARDEN-WP-0017-access-front-door-discoverability.md |
+| task | WARDEN-WP-0018-T01 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0018-T02 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0018-T03 | done | — | workplans/WARDEN-WP-0018-whynot-design-npm-lane-activation.md |
+| task | WARDEN-WP-0019-T01 | done | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| task | WARDEN-WP-0019-T02 | done | — | workplans/WARDEN-WP-0019-route-to-secrets-engine.md |
+| task | WARDEN-WP-0020-T01 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T02 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T03 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T04 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0020-T05 | done | — | workplans/WARDEN-WP-0020-ops-warden-worker.md |
+| task | WARDEN-WP-0021-T01 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T02 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T03 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T04 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0021-T05 | done | — | workplans/WARDEN-WP-0021-enable-scheduled-worker-tick.md |
+| task | WARDEN-WP-0022-T01 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T02 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T03 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0022-T04 | done | — | workplans/WARDEN-WP-0022-audit-trail-and-activity.md |
+| task | WARDEN-WP-0023-T01 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T02 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T03 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T04 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T05 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T06 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0023-T07 | done | — | workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md |
+| task | WARDEN-WP-0024-T01 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T02 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T03 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T04 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T05 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T06 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0024-T07 | done | — | workplans/WARDEN-WP-0024-experiential-memory-and-agent-sessions.md |
+| task | WARDEN-WP-0025-T01 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T02 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T03 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T04 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0025-T05 | done | — | workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md |
+| task | WARDEN-WP-0026-T01 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T02 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T03 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T04 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T05 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T06 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0026-T07 | done | — | workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md |
+| task | WARDEN-WP-0027-T01 | cancel | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0027-T02 | cancel | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0027-T03 | cancel | — | workplans/WARDEN-WP-0027-credential-governance-lockdown.md |
+| task | WARDEN-WP-0028-T01 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T02 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T03 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T04 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T05 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T06 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0028-T07 | done | — | workplans/WARDEN-WP-0028-tenant-secret-custody.md |
+| task | WARDEN-WP-0029-T01 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T02 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T03 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T04 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
+| task | WARDEN-WP-0029-T05 | done | — | workplans/WARDEN-WP-0029-policy-front-door-and-founder-surface.md |
--- a/history/2026-08-11-delegation-surface-assessment.md
+++ b/history/2026-08-11-delegation-surface-assessment.md
@ -0,0 +1,87 @@
+# Delegation surface assessment — 2026-08-11
+
+**Trigger:** founder directive — ops-warden should work with, but never replace or
+duplicate, secrets-engine, tenant-engine, user-engine and other NetKingdom
+components. Covering an unfilled gap is acceptable if the gap stays visible, gets
+filled with proper governance, and ops-warden then delegates.
+
+**Method:** enumerate `registry/routing/catalog.yaml` by execution mode; check
+`wiki/AccessRouting.md` and `wiki/playbooks/catalog-lane-promotion.md` for existing
+interim/delegation doctrine; compare against SCOPE/INTENT claims.
+
+---
+
+## 1. Execution surface (24 catalog entries)
+
+| Mode | Count | Entries |
+| --- | --- | --- |
+| `warden_executes: true` — ops-warden's own authority | 1 | `ssh-cert-host-access` |
+| `exec_owner:` set — delegated, route-primary/proxy-fallback | 2 | `whynot-design-npm-publish` (secrets-engine), `ops-warden-warden-sign-token` (railiance-platform broker) |
+| `exec_capable` proxy, **no** `exec_owner` | 11 | `openbao-api-key`, `key-cape-oidc-login`, `issue-core-ingestion-api-key`, `reuse-surface-hub-write-token`, `openrouter-llm-connect`, `railiance-backup-offsite-lane`, `forgejo-admin-api-token`, `binky-company-email-imap`, `binky-qonto-api`, `rapp-qonto-keycape-client`, `agent-harness-forgejo-deploy` |
+| route-only pointer | 10 | remainder |
+
+**Finding.** The delegation primitive exists, is proven in production, and is used by
+**2 of 24** lanes. Eleven lanes have ops-warden as the de facto front door with no
+record of who should own it instead.
+
+## 2. The doctrine is not written down
+
+- `wiki/AccessRouting.md` — the canonical "what ops-warden answers" page — contains
+  **no mention of secrets-engine** and no section on interim positions. A worker or
+  agent reading it cannot tell that `warden access` proxying a workload secret is a
+  stopgap rather than the design.
+- `wiki/playbooks/catalog-lane-promotion.md` gates draft→active on the lane
+  *working* (zero placeholders, resolvable, tests green). It never asks whether
+  ops-warden should be the one executing it.
+- The delegation intent for `whynot-design-npm-publish` lives in WP-0019 prose and
+  SCOPE; the *machine-readable* expression (`exec_owner`) was a by-product, not a
+  policy applied catalog-wide.
+
+Consequence: an absorbed need is indistinguishable from a designed one. Ownership
+drift is invisible by construction, which is exactly the failure mode the directive
+targets.
+
+## 3. Drafted classification of the eleven
+
+Not authoritative — architecture judgement belongs to the founder (WP-0030 T02).
+
+| Lane | Draft reading | Intended owner / blocker |
+| --- | --- | --- |
+| `key-cape-oidc-login` | **Permanent** | Login is key-cape's; the proxy is caller convenience, not custody |
+| `openbao-api-key` | **Permanent (by design)** | Generic escape hatch for any OpenBao path; a catch-all, not a lane |
+| `binky-company-email-imap` | Interim | **tenant-engine** — WP-0028 defined the tenant custody pattern; no tenant front door executes it |
+| `binky-qonto-api` | Interim | **tenant-engine** — same |
+| `rapp-qonto-keycape-client` | Interim | **tenant-engine** / key-cape — tenant workload client credential |
+| `issue-core-ingestion-api-key` | Interim | **secrets-engine** — same shape WP-0019 closed for npm publish |
+| `openrouter-llm-connect` | Interim | **secrets-engine** — high-risk provider key |
+| `reuse-surface-hub-write-token` | Interim | **secrets-engine** |
+| `railiance-backup-offsite-lane` | Interim | **secrets-engine** / railiance-platform |
+| `forgejo-admin-api-token` | Interim | **secrets-engine** |
+| `agent-harness-forgejo-deploy` | Interim | **secrets-engine** |
+
+**No lane names `user-engine` as owner.** It appears only as a *consumer* inside
+`coulomb-social-runtime-env` (route-only, owned by railiance-platform), whose rotation
+guidance points at the OpenBao path `user-engine/user-engine-runtime` for
+`USER_ENGINE_PROXY_SECRET`. So a user-engine runtime secret exists and is routed, but
+user-engine fronts nothing itself. Whether it should own that lane is worth confirming
+rather than assuming either way.
+
+## 4. Secondary finding — SCOPE drift
+
+`SCOPE.md` "Where we are" was dated **2026-07-01** and stated *"Active work: none
+open in ops-warden after WP-0022/0023."* Six workplans have shipped since
+(WP-0024–0026, WP-0028, WP-0029 finished; WP-0027 sits in `backlog`), adding
+`warden plan`, `warden desk`, `warden taint`, `warden rotate-guide`, experiential
+memory, the tenant custody pattern, and the build-phase organization posture axis.
+SCOPE understated the repo by roughly six weeks of work. Corrected in this pass.
+
+## 5. Recommendation
+
+WARDEN-WP-0030 — record `delegation:` (mode / intended_owner / blocked_on) on every
+entry, expose `warden route gaps`, gate promotion on the ownership question, and
+publish the resulting interim register to the owner repos. Absence of a delegation
+block should read as *interim, owner unknown* — a question — never as settled
+ownership.
+
+The measure of success is not fewer proxies. It is that no proxy exists without an
+answer to *"who should own this front door, and what is missing?"*
--- a/workplans/ADHOC-2026-08-11.md
+++ b/workplans/ADHOC-2026-08-11.md
@ -42,6 +42,7 @@ an anchor that does not exist. The intended heading is `## Routing catalog index
 id: ADHOC-2026-08-11-T02
 status: done
 priority: medium
+state_hub_task_id: "546a4299-314c-448d-b2fb-201ddc50353c"
 ```

 `fix-consistency` flagged 11 unread messages older than 3 days, two of them as possible
@ -75,6 +76,7 @@ read. Inbox is now empty.
 id: ADHOC-2026-08-11-T03
 status: wait
 priority: medium
+state_hub_task_id: "b930df62-b8dd-45ae-b0a5-98298cdfa1b6"
 ```

 secrets-engine (msg `80456912`, 2026-06-29) is holding a validated non-mutating dry-run
--- a/workplans/WARDEN-WP-0030-delegation-register.md
+++ b/workplans/WARDEN-WP-0030-delegation-register.md
@ -0,0 +1,202 @@
+---
+id: WARDEN-WP-0030
+type: workplan
+title: "Delegation register — make gap-covering interim, visible, and retirable"
+domain: infotech
+repo: ops-warden
+status: proposed
+owner: claude
+topic_slug: custodian
+planning_priority: high
+planning_order: 30
+created: "2026-08-11"
+updated: "2026-08-11"
+---
+
+# WARDEN-WP-0030 — Delegation register
+
+## Origin
+
+Founder directive 2026-08-11: **ops-warden should work with, but never replace or
+duplicate, secrets-engine, tenant-engine, user-engine and other NetKingdom
+components.** It is acceptable for ops-warden to cover a gap where needed security
+functionality is not yet systematically provided — *provided* the gap is kept in
+mind, filled, and given proper governance, after which ops-warden delegates to the
+improved component.
+
+The directive is already half-lived and nowhere written. Survey of
+`registry/routing/catalog.yaml` on 2026-08-11 (24 entries):
+
+| Execution mode | Count | Meaning |
+| --- | --- | --- |
+| `warden_executes: true` | 1 | ops-warden's own lane (`ssh-cert-host-access`) |
+| `exec_owner:` set | 2 | Delegated — route-primary, proxy-fallback |
+| `exec_capable` proxy, no `exec_owner` | 11 | **ops-warden is the de facto front door** |
+| route-only | 10 | Pointer, nothing to delegate |
+
+The delegation primitive already exists and works: `exec_owner` / `exec_command` /
+`pointer_command` (`whynot-design-npm-publish` → secrets-engine, WP-0019;
+`ops-warden-warden-sign-token` → railiance-platform credential broker,
+RAILIANCE-WP-0005 T08). It is used by 2 of 24 lanes.
+
+Nothing distinguishes the other eleven — "ops-warden proxies because that is the
+right end state" reads identically to "ops-warden proxies because no owner front
+door was ever built." Supporting evidence of the doctrine gap:
+
+- `wiki/AccessRouting.md` does not mention secrets-engine at all and has no section
+  on interim positions.
+- `wiki/playbooks/catalog-lane-promotion.md` gates draft→active on the lane
+  *working*, never on whether ops-warden should be the one running it.
+
+## Goal
+
+Make every ops-warden execution position **explicitly interim or explicitly
+permanent**, with the intended owner and blocking condition recorded in the
+machine-readable layer — so gap-covering is a tracked, retirable state rather than
+silent ownership drift.
+
+Success is not removing proxies. Success is that no proxy exists without an answer
+to *"who should own this front door, and what is missing?"*
+
+## Non-goals
+
+- Removing or degrading any working lane. Proxies keep working until the owner's
+  front door exists and is proven.
+- Building the missing front doors. That work belongs to secrets-engine,
+  tenant-engine, user-engine, and railiance-platform — this workplan produces the
+  register they need, not their implementations.
+- A second catalog or a parallel schema. `delegation:` extends the existing entry
+  shape; `warden route gaps` composes the existing loader.
+
+## Design constraints
+
+- **Interim is the default.** A lane without a `delegation:` block is treated as
+  `interim` with an unknown owner, not as settled. Absence must read as a question.
+- **Founder classifies, agent drafts.** Which of the eleven are legitimately
+  permanent is an architecture judgement (`key-cape-oidc-login` plausibly is; the
+  tenant/workload secret lanes plausibly are not). T02 lands a *drafted*
+  classification for review; the founder's answer is authoritative.
+- **No restating owner procedure.** The register names the intended owner and the
+  blocker; it does not describe how that owner will implement their front door.
+  Same pointer-layer discipline as the rest of the catalog.
+
+## Tasks
+
+### T01 — Interim custodianship doctrine
+
+```task
+id: WARDEN-WP-0030-T01
+status: todo
+priority: high
+```
+
+Add a doctrine section to `wiki/AccessRouting.md` stating the boundary: the only
+lane ops-warden executes with its own authority is SSH issuance; every other
+execution position is interim, held because the owning component does not yet cover
+the need, and retired to that owner once it does. Name secrets-engine,
+tenant-engine, user-engine, railiance-platform and flex-auth as the delegation
+targets. Cross-link INTENT.md §9.
+
+### T02 — `delegation:` metadata + backfill
+
+```task
+id: WARDEN-WP-0030-T02
+status: todo
+priority: high
+```
+
+Extend the catalog entry schema with:
+
+```yaml
+delegation:
+  mode: native | interim | permanent   # native = owner already fronts it
+  intended_owner: <repo>               # required unless mode: permanent
+  blocked_on: <what is missing>        # required when mode: interim
+  reviewed: "YYYY-MM-DD"
+```
+
+Backfill all 24 entries. `exec_owner` lanes become `mode: native`.
+`ssh-cert-host-access` becomes `mode: permanent` (ops-warden's own lane). The
+eleven undelegated proxies get a **drafted** classification plus intended owner,
+flagged in the workplan for founder review rather than asserted as settled.
+
+### T03 — `warden route gaps` + conformance test
+
+```task
+id: WARDEN-WP-0030-T03
+status: todo
+priority: medium
+```
+
+`warden route gaps [--json]` lists interim lanes with intended owner, blocker, and
+age since review — the queryable register. Add a routing test asserting every
+`exec_capable` non-`warden_executes` entry declares `delegation`, so a new proxy
+cannot be added without answering the ownership question. Surface stale interim
+entries in the existing drift/stale review cadence.
+
+### T04 — Promotion gate
+
+```task
+id: WARDEN-WP-0030-T04
+status: todo
+priority: medium
+```
+
+Update `wiki/playbooks/catalog-lane-promotion.md`: draft→active requires a
+`delegation` block. If `mode: interim`, the promotion note must state the intended
+owner and the retirement condition. Add the matching question to the lane-review
+checklist.
+
+### T05 — Publish the register to the owners
+
+```task
+id: WARDEN-WP-0030-T05
+status: todo
+priority: medium
+```
+
+Once T02 is reviewed, send the interim register to secrets-engine, tenant-engine,
+user-engine, railiance-platform and net-kingdom as a coordination message: here is
+what ops-warden currently fronts on your behalf, here is what would let us step
+back. This is the artefact that converts a private ops-warden position into a
+fleet-visible capability gap.
+
+## Acceptance
+
+- [ ] `wiki/AccessRouting.md` states the interim-custodianship boundary and names
+      the delegation targets
+- [ ] All 24 catalog entries carry `delegation`; `warden route gaps` returns the
+      interim set with owner + blocker
+- [ ] Routing test fails when a proxy lane omits `delegation`
+- [ ] Promotion playbook gates draft→active on the ownership question
+- [ ] Founder has reviewed the interim/permanent classification of the eleven
+- [ ] Register delivered to the named owner repos
+
+## Open question for the founder
+
+The eleven undelegated proxies are: `openbao-api-key`, `key-cape-oidc-login`,
+`issue-core-ingestion-api-key`, `reuse-surface-hub-write-token`,
+`openrouter-llm-connect`, `railiance-backup-offsite-lane`, `forgejo-admin-api-token`,
+`binky-company-email-imap`, `binky-qonto-api`, `rapp-qonto-keycape-client`,
+`agent-harness-forgejo-deploy`.
+
+Draft reading, for review in T02: `key-cape-oidc-login` is **permanent** (login is
+key-cape's and the proxy is convenience, not custody). `openbao-api-key` is the
+generic escape hatch and is arguably permanent-by-design. The two `binky-*` tenant
+lanes and `rapp-qonto-keycape-client` look like **tenant-engine** gaps (WP-0028
+defined the custody pattern; no tenant front door executes it). The workload secret
+lanes — `issue-core-*`, `openrouter-llm-connect`, `reuse-surface-*`,
+`railiance-backup-*`, `forgejo-admin-*`, `agent-harness-forgejo-deploy` — look like
+**secrets-engine** gaps of the same shape WP-0019 already closed for npm publish.
+No lane names **user-engine** as owner — it appears only as a consumer inside
+`coulomb-social-runtime-env` (`USER_ENGINE_PROXY_SECRET`, rotated at
+`user-engine/user-engine-runtime`). Whether user-engine should front that lane itself
+is worth confirming.
+
+## See also
+
+- INTENT.md §9 (cover gaps, never silently own them)
+- WARDEN-WP-0019 (route to secrets-engine — the pattern this generalizes)
+- WARDEN-WP-0028 (tenant secret custody pattern; front door still ops-warden's proxy)
+- `history/2026-08-11-delegation-surface-assessment.md`
+- `registry/routing/catalog.yaml`, `wiki/playbooks/catalog-lane-promotion.md`