coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Close ADHOC-2026-08-11: hand warden-sign AppRole to WP-0027
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
T03 stays parked (neither apply nor withdraw). Neither un-park trigger has
fired, so the ad-hoc is finished and WP-0027 T02 owns the question.
This commit is contained in:
tegwick 2026-08-15 20:35:12 +02:00
parent 817af8bc6e
commit bfa0eda327
3 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
wiki/playbooks/ops-bridge-tunnel-cert.md
View file

@ -71,9 +71,10 @@ Confirm exit 0 and cert line starts with `ssh-ed25519-cert-v01@openssh.com`.
> tunnel host**, which is an open question, not an oversight: running the broker there
> requires placing the railiance-platform checkout and its *issuer* token on that host.
> A narrower alternative — a `warden-sign` AppRole scoped to `ssh/sign/{agt,adm,atm}-role`
> — is validated but **parked** (`workplans/ADHOC-2026-08-11.md` T03, secrets-engine
> `SECRETS-WP-0004`). **Resolve the token source before the live cutover**; do not
> default to a long-lived exported token on the tunnel host.
> — is validated but **parked** on `WARDEN-WP-0027` T02 (break-glass / trust-root;
> closed out of `workplans/ADHOC-2026-08-11.md` T03). secrets-engine
> `SECRETS-WP-0004` holds the dry-run only. **Resolve the token source before the
> live cutover**; do not default to a long-lived exported token on the tunnel host.
---