Ship WARDEN-WP-0030: delegation register for every catalog lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Every execution position is now explicit. Catalog entries carry
delegation.mode (permanent / native / interim) with intended owner and
blocker. warden route gaps lists the interim set. Promotion requires
the ownership question. Doctrine lives in AccessRouting.md; the
register was published to the named owner repos.
This commit is contained in:
tegwick 2026-08-15 20:54:58 +02:00
parent 8d3706fa06
commit c93e3c9b43
11 changed files with 619 additions and 29 deletions

View file

@ -123,15 +123,15 @@ Gap analysis: `history/2026-07-01-intent-scope-gap-analysis.md` (current);
| NetKingdom evolution reflected in docs | Met |
| Non-SSH secrets stay out of ops-warden | Met |
| Workload posture / maturity model for secret-flow blockers | Met — two-axis standard + descriptors + conformance checker + dev doubles (WP-0015) |
| Every execution position explicitly permanent or interim with a named owner | **Not met** — 2 of 24 lanes carry `exec_owner`; 11 proxy lanes record no intended owner (WP-0030) |
| Every execution position explicitly permanent or interim with a named owner | **Met** — every catalog entry carries `delegation:`; `warden route gaps` lists the interim set (WP-0030) |
**Maturity vector:** `D5 / A5 / C4 / R4` (Discovery / Availability / Completeness / Reliability)
**Maturity vector:** `D5 / A5 / C5 / R4` (Discovery / Availability / Completeness / Reliability)
| Dimension | Level | Meaning today |
| --- | --- | --- |
| D5 | Discovery | Routing wiki + security map + pointer catalog + NK canon cross-links |
| A5 | Availability | CLI + `warden route` + `warden access` advisory & proxy front door + `warden policy` + opt-in policy gate + agent `--json` |
| C4 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, disclosure hygiene, tenant custody, policy front door. **Down from C5:** delegation is unrecorded on 11 of 24 lanes, so ops-warden's interim positions are not distinguishable from designed ones (WP-0030) |
| C5 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, disclosure hygiene, tenant custody, policy front door, delegation register (WP-0030) |
| R4 | Reliability | Live OpenBao sign + credential-broker policy-gate smoke evidence on Railiance (2026-07-01) |
---
@ -350,16 +350,16 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
- **Policy front door:** WP-0029 shipped — `warden plan "<need>"` (autonomous /
founder_required / unroutable), `warden desk` founder interaction surface, declared
`organization_posture: build` as a third posture axis, catalog freshness reporting
- **Delegation:** 24 catalog lanes — 1 executed by ops-warden (SSH), 2 delegated via
`exec_owner`, 11 proxied with **no intended owner recorded**, 10 route-only. Addressed
by WP-0030 (proposed)
- **Active work:** WP-0027 (`backlog`), WP-0030 (`proposed`); remaining production
distance is other repos' lanes
- **Delegation:** 27 catalog lanes carry `delegation:` (WP-0030). SSH is
`permanent`; owner-fronted lanes are `native`; interim proxies name
`intended_owner` + `blocked_on`. Query: `warden route gaps`.
- **Active work:** WP-0027 (`backlog`); remaining production distance is other
repos' lanes (and retiring interim covers as those owners ship front doors)
- **Integration docs:** cert_command migration, token hygiene (broker-first), principals
drift (`wiki/playbooks/`)
- **Latest assessment:** `history/2026-08-11-delegation-surface-assessment.md`
- **Latest workplans:** WP-0029 (policy front door) shipped July 2026; WP-0030
(delegation register) proposed 2026-08-11
(delegation register) shipped August 2026
---