coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0026 T06: rotation guidance registry + warden rotate-guide
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
- routing model: RotationGuide (method rotate|re-establish, steps, owner,
  automatable), RouteEntry.rotation + has_rotation + vends_secret.
- catalog parser: validate rotation block; secret-material screen gains a
  prose-safe mode (high-entropy detector only) so authored steps aren't tripped
  by substrings like "s."/"exists.".
- CLI: `warden rotate-guide <id>` (human + --json); route show --json now
  carries has_rotation + rotation.
- scorecard: catalog_rotation_coverage — every active secret-vending lane must
  carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist
  criterion 9.
- data: rotation blocks for all 7 active vending lanes + the draft
  railiance-backup lane (re-establish: age keypair regen + re-encrypt).
- fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm
  so "npm token" routes to the generic lane (restores test_access expectations).
- tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py;
  scorecard count 6 -> 7.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-16 14:40:30 +02:00
parent ac09f21ad3
commit c3eb59ea04
9 changed files with 385 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/WARDEN-WP-0026-credential-disclosure-hygiene.md
View file

@ -158,11 +158,23 @@ a lane (advisory; no auto-rotation here).
```task
id: WARDEN-WP-0026-T06
status: todo
status: done
priority: high
state_hub_task_id: "b8a43aee-18c7-46cd-9cfe-1f73234746d3"
```
Done 2026-07-16: `rotation:` block (method rotate|re-establish, ordered steps,
owner, automatable) added to the routing model/parser (`RotationGuide`,
`RouteEntry.rotation`, `vends_secret`), screened for secret material in a prose-safe
mode. `warden rotate-guide <id>` (human + `--json`) surfaces the guidance; `warden
route show --json` carries `has_rotation` + `rotation`. Coverage enforced by the new
`catalog_rotation_coverage` scorecard check (every active secret-vending lane must
have a block) and promotion checklist criterion 9. Rotation blocks authored for all
7 active vending lanes + the draft railiance-backup lane (re-establish example: age
keypair regen + re-encrypt). Tests in `tests/test_routing.py`. Also fixed a
pre-existing keyword collision (bare `npm` on the forgejo-admin lane → `forgejo-npm`)
so "npm token" routes to the generic lane again.
Give every catalog lane **structured-but-advisory** renewal guidance, held in the
ops-warden registry (not in OpenBao). Add a `rotation:` block per catalog entry
capturing: `method` (rotate | re-establish), ordered `steps` (provider re-mint /