coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Close WARDEN-WP-0039 with fetch-pin receipts; activate audit-core-senders pointer

Browse source 
- WP-0039-T03: receipts against flex-auth-ops-warden-fetch with ops-warden's
  own caller token. Positive forgejo-admin-api-token allow; negatives for
  unknown need, wrong owner (403), wrong tenant and anonymous caller (401).
  Policy decisions only, no credential read. WP-0039 finished.
- audit-core-senders: active as a pointer on ops-mason's custody check
  (message 5a516911). Custody text corrected to OpenBao KV v2 read via ESO;
  delegation verified source-read.
- WP-0044: oidc-browser-relying-party 1.1 is plannable; the case-ref is taken
  at run time because it covers the case status.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
This commit is contained in:
tegwick 2026-10-10 15:26:38 +02:00
parent 9fd65ec4b5
commit b76ee0edae
5 changed files with 52 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

1
wiki/CredentialRouting.md
View file

@ -108,6 +108,7 @@ lists the interim set — WARDEN-WP-0030).
| `net-kingdom-lldap-bind-credential` | "railiance-platform custody for the LLDAP bind credential used by identity-provisioner and the privacyIDEA resolver" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
| `net-kingdom-privacyidea-admin-token` | "railiance-platform custody for the privacyIDEA administrative token used by attended resolver reconciliation" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
| `keycape-client-secret-generate` | "railiance-platform's broker generates a KeyCape client secret inside custody for an accepted SecurityCase. The value is never returned" | `bao login` to role `credential-broker-keycape-client-secret-generate`, then `credential.py generate --case-file ... --case-ref ...` (see playbook). Agents are refused |
| `audit-core-senders` | "ops-mason built the audit-core sender registry in OpenBao. audit-core reads it through ESO only" | Nobody reads the registry. A sender gets its own exact-path projection (see playbook table) |
Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.
High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.