Ship WARDEN-WP-0030: delegation register for every catalog lane
Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
This commit is contained in:
parent
8d3706fa06
commit
c93e3c9b43
11 changed files with 619 additions and 29 deletions
|
|
@ -27,6 +27,9 @@
|
|||
# status active (surfaced by default) | draft (hidden unless --all)
|
||||
# steps ONLY when warden_executes: true
|
||||
# cert_command ONLY when warden_executes: true
|
||||
# delegation WP-0030 register. mode: native | interim | permanent.
|
||||
# intended_owner required unless permanent; blocked_on required
|
||||
# when interim. Absence is implicit interim with unknown owner.
|
||||
|
||||
version: 1
|
||||
|
||||
|
|
@ -41,6 +44,9 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
|
||||
reviewed: "2026-06-18"
|
||||
status: active
|
||||
delegation:
|
||||
mode: permanent
|
||||
reviewed: "2026-08-15"
|
||||
cert_command: "warden sign <actor> --pubkey <path>"
|
||||
steps:
|
||||
- "Confirm the actor is in inventory (`warden inventory list`); add with `warden inventory add` if not — see wiki/ActorInventoryPatterns.md."
|
||||
|
|
@ -58,6 +64,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-07-01"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: railiance-platform
|
||||
reviewed: "2026-08-15"
|
||||
# Concrete broker lane — RAILIANCE-WP-0005 pilot (live 2026-07-01):
|
||||
# credential exec injects VAULT_TOKEN only into the child process; ops-warden
|
||||
# issues SSH certs and never mints or holds OpenBao tokens.
|
||||
|
|
@ -87,6 +97,11 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-06-27"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# Structured handoff (WP-0014) — reference example. Templates only, no values.
|
||||
# ops-warden does not own this secret; it advises and (exec_capable) proxies the
|
||||
# fetch *as the caller* via `warden access`, never holding or persisting the value.
|
||||
|
|
@ -115,6 +130,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-06-29"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: secrets-engine
|
||||
reviewed: "2026-08-15"
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0001 (commit 8f617fc):
|
||||
# status=active, access_frontdoor.readiness=ready, resolvable=true; positive fetch
|
||||
# passed and negative (non-whynot) login denied. Zero-placeholder fetch: an automated
|
||||
|
|
@ -152,6 +171,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/responsibility-map.md
|
||||
reviewed: "2026-06-18"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: flex-auth
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: key-cape-oidc-login
|
||||
title: Interactive login, OIDC token, or MFA
|
||||
|
|
@ -163,6 +186,11 @@ entries:
|
|||
canon_ref: net-kingdom/docs/canon/standards/iam-profile_v0.2.md
|
||||
reviewed: "2026-06-27"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# Login lane (WP-0014 T4) — interactive auth bootstrap, not a secret read. No
|
||||
# secret-read gate (you have no identity yet) and no caller-auth precheck (the
|
||||
# point is to obtain one). warden runs it interactively as the caller and never
|
||||
|
|
@ -182,6 +210,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
|
||||
reviewed: "2026-06-24"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: ops-bridge
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: railiance-infra-principals
|
||||
title: Host SSH principal file or force-command deployment
|
||||
|
|
@ -193,6 +225,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/responsibility-map.md
|
||||
reviewed: "2026-06-18"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: railiance-infra
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: inter-hub-bootstrap-ssh
|
||||
title: Inter-Hub bootstrap SSH envelope
|
||||
|
|
@ -204,6 +240,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path
|
||||
reviewed: "2026-06-24"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: railiance-infra
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: activity-core-issue-sink
|
||||
title: activity-core IssueSink → issue-core REST emission
|
||||
|
|
@ -215,6 +255,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-06-18"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: activity-core
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: issue-core-ingestion-api-key
|
||||
title: issue-core ingestion API key (OpenBao KV + ESO)
|
||||
|
|
@ -226,6 +270,11 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-07-02"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0002 / RAILIANCE-WP-0009
|
||||
# (promoted 2026-07-02): policy workload-kv-read-issue-core-runtime and k8s auth role
|
||||
# external-secrets-issue-core applied; ExternalSecret issue-core/issue-core-runtime
|
||||
|
|
@ -258,6 +307,11 @@ entries:
|
|||
canon_ref: reuse-surface/specs/FederationHubAPI.md
|
||||
reviewed: "2026-07-07"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011
|
||||
# (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret
|
||||
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
|
||||
|
|
@ -290,6 +344,11 @@ entries:
|
|||
canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
|
||||
reviewed: "2026-07-02"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04).
|
||||
risk: high
|
||||
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0003 / RAILIANCE-WP-0010
|
||||
|
|
@ -325,6 +384,11 @@ entries:
|
|||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-07-16"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: railiance-platform
|
||||
blocked_on: "Rotation is re-establish, a multi-step procedure ops-warden only describes"
|
||||
reviewed: "2026-08-11"
|
||||
# High-risk: WebDAV upload token + AGE recovery escrow (WP-0026 T04).
|
||||
risk: high
|
||||
# CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07.
|
||||
|
|
@ -365,6 +429,11 @@ entries:
|
|||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-07-13"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-11"
|
||||
# High-risk: site-admin PAT (WP-0026 T04).
|
||||
risk: high
|
||||
# CCR-2026-0006: approved by platform-operator 2026-07-12; policy
|
||||
|
|
@ -402,6 +471,11 @@ entries:
|
|||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-07-17"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: tenant-engine
|
||||
blocked_on: "Custody at tenants/binky/... but rotation owner is binky-control — split lifecycle, no front door reconciling it"
|
||||
reviewed: "2026-08-11"
|
||||
risk: high
|
||||
# CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned
|
||||
# values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17:
|
||||
|
|
@ -431,6 +505,11 @@ entries:
|
|||
canon_ref: binky-control/integrations/qonto-mcp.md
|
||||
reviewed: "2026-07-21"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: tenant-engine
|
||||
blocked_on: "Same split lifecycle as binky-company-email-imap; no tenant-engine front door"
|
||||
reviewed: "2026-08-11"
|
||||
risk: high
|
||||
# CCR-2026-0008: policy + OIDC role applied; secret at tenants/binky/qonto-api
|
||||
# (fields API_KEY, API_USER). Map to QONTO_API_KEY / QONTO_ORGANIZATION_ID for
|
||||
|
|
@ -461,6 +540,11 @@ entries:
|
|||
canon_ref: key-cape/docs/qonto-runtime-identity-contract.md
|
||||
reviewed: "2026-07-27"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: key-cape
|
||||
blocked_on: "client_secret_basic exchange is a key-cape protocol procedure, not a KV read; rotation already automatable"
|
||||
reviewed: "2026-08-11"
|
||||
risk: high
|
||||
auth_method: "OpenBao platform workload lane; KeyCape client_secret_basic exchange"
|
||||
path_template: "platform/workloads/rapp-qonto/keycape-client"
|
||||
|
|
@ -486,6 +570,11 @@ entries:
|
|||
canon_ref: binky-control/integrations/executor-worker-secrets.md
|
||||
reviewed: "2026-07-17"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: railiance-platform
|
||||
blocked_on: "re-establish plus an alternative host-local key path; two ways in, neither owner-fronted (also agent-harness)"
|
||||
reviewed: "2026-08-11"
|
||||
risk: high
|
||||
# Provisioned 2026-07-17 on railiance01: ed25519 keypair on host, OpenBao copy at
|
||||
# platform/workloads/agent-harness/forgejo-deploy-key, write deploy key on
|
||||
|
|
@ -516,6 +605,11 @@ entries:
|
|||
canon_ref: binky-control/integrations/executor-worker-secrets.md
|
||||
reviewed: "2026-07-17"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: railiance-platform
|
||||
blocked_on: "AppRole is a host-standing credential; no owner front door for minting or rotating role_id+secret_id"
|
||||
reviewed: "2026-08-15"
|
||||
risk: high
|
||||
# Provisioned 2026-07-17: role agent-harness-binky-mail bound to existing policy
|
||||
# workload-kv-read-binky-company-email-imap; role_id/secret_id delivered to
|
||||
|
|
@ -548,6 +642,10 @@ entries:
|
|||
canon_ref: net-kingdom/docs/object-storage-sts-credential-vending.md
|
||||
reviewed: "2026-06-24"
|
||||
status: draft
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: net-kingdom
|
||||
reviewed: "2026-08-15"
|
||||
|
||||
- id: database-dynamic-credentials
|
||||
title: Database dynamic credentials (OpenBao secrets engine)
|
||||
|
|
@ -559,6 +657,10 @@ entries:
|
|||
canon_ref: rapp-postgres/docs/canon-drafts/shared-platform-relational-storage_v0.1-draft.md
|
||||
reviewed: "2026-08-10"
|
||||
status: active
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: rapp-postgres
|
||||
reviewed: "2026-08-15"
|
||||
risk: high
|
||||
exec_capable: false
|
||||
|
||||
|
|
@ -572,6 +674,11 @@ entries:
|
|||
canon_ref: ops-mason/plans/rein-openweights-openrouter-approle.md
|
||||
reviewed: "2026-07-27"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: ops-mason
|
||||
blocked_on: "AppRole is a host-standing credential; no owner-fronted exec for the OpenRouter key read"
|
||||
reviewed: "2026-08-15"
|
||||
risk: standard
|
||||
# Built 2026-07-27 by ops-mason (MASON-WP-0001-T05), approved by Bernd
|
||||
# Worsch 2026-07-27. Policy + AppRole live; reins/ KV v2 mount created
|
||||
|
|
@ -621,6 +728,11 @@ entries:
|
|||
canon_ref: railiance-platform/docs/apps-pg.md
|
||||
reviewed: "2026-08-09"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: railiance-apps
|
||||
blocked_on: "Runtime Secret applied via railiance-apps make target; OpenBao path planned; confirm whether user-engine should front USER_ENGINE_PROXY_SECRET"
|
||||
reviewed: "2026-08-15"
|
||||
risk: standard
|
||||
# K8s assembly is the live handoff today (same pattern as vergage-teilnahme-env).
|
||||
# OpenBao KV platform/workloads/coulomb/coulomb-social/runtime-env is the
|
||||
|
|
@ -650,6 +762,10 @@ entries:
|
|||
canon_ref: audit-core/docs/operator-runbook.md
|
||||
reviewed: "2026-08-13"
|
||||
status: draft
|
||||
delegation:
|
||||
mode: native
|
||||
intended_owner: ops-mason
|
||||
reviewed: "2026-08-15"
|
||||
auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
|
||||
path_template: "platform/workloads/audit-core/senders"
|
||||
policy_ref: "external-secrets-audit-core"
|
||||
|
|
@ -667,6 +783,11 @@ entries:
|
|||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-08-12"
|
||||
status: active
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: secrets-engine
|
||||
blocked_on: "secrets-engine has not confirmed whether exec --catalog generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)"
|
||||
reviewed: "2026-08-15"
|
||||
risk: high
|
||||
# CCR-2026-0010 approved 2026-08-12; applied same day (EMAIL-WP-0004-T03):
|
||||
# policies external-secrets-email-connect + workload-kv-read-email-connect-transactional,
|
||||
|
|
@ -703,6 +824,11 @@ entries:
|
|||
canon_ref: ops-mason/plans/reef-storage-scaleway-bootstrap.md
|
||||
reviewed: "2026-08-14"
|
||||
status: draft
|
||||
delegation:
|
||||
mode: interim
|
||||
intended_owner: railiance-platform
|
||||
blocked_on: "Founder bootstrap API key; draft until provisioned; no owner-fronted exec"
|
||||
reviewed: "2026-08-15"
|
||||
risk: high
|
||||
# CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
|
||||
# Not the Barman runtime key (platform-pg-backup-s3).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue