Ship WARDEN-WP-0030: delegation register for every catalog lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Every execution position is now explicit. Catalog entries carry
delegation.mode (permanent / native / interim) with intended owner and
blocker. warden route gaps lists the interim set. Promotion requires
the ownership question. Doctrine lives in AccessRouting.md; the
register was published to the named owner repos.
This commit is contained in:
tegwick 2026-08-15 20:54:58 +02:00
parent 8d3706fa06
commit c93e3c9b43
11 changed files with 619 additions and 29 deletions

View file

@ -76,6 +76,44 @@ boundary in `OperatorAccessAssist.md`.
---
## Interim custodianship
ops-warden **works with, and never replaces or duplicates**, the NetKingdom
components that own identity, custody, authorization, and tenant/user lifecycle
(`INTENT.md` §9). Covering a gap is legitimate. Silently becoming the owner of
that gap is not.
The only lane ops-warden executes with its own authority is **SSH issuance**
(`ssh-cert-host-access`). Every other execution position — including every
`warden access` proxy — is **interim by default**. A catalog entry without a
`delegation:` block is treated as interim with an unknown owner: absence is a
question, not a settlement.
| `delegation.mode` | Meaning |
| --- | --- |
| `permanent` | ops-warden is the designed owner of this front door (SSH only, today) |
| `native` | the intended owner already fronts it; ops-warden routes (and may keep a proxy as fallback) |
| `interim` | ops-warden covers the gap until `intended_owner` ships the missing front door named in `blocked_on` |
Delegation targets — the components that should own a front door once they have
one:
| Target | What they should front |
| --- | --- |
| **secrets-engine** | owner-native secret-exec (`secrets-engine exec --catalog <id>`) |
| **tenant-engine** | tenant/client secret custody and tenant-lane front door |
| **user-engine** | end-user / account-lifecycle secrets that belong with user identity |
| **railiance-platform** | OpenBao cluster, credential broker, platform workload procedure |
| **flex-auth** | authorization decisions (already native — ops-warden only points) |
| **key-cape** | identity login and client-credential protocol (OIDC, `client_secret_basic`) |
Query the register with `warden route gaps`. An interim lane is retired by
setting `exec_owner` / `exec_command` (the WP-0019 pattern) and flipping
`delegation.mode` to `native` once the owner's front door is proven. Do not
delete a working proxy on the way.
---
## Routing lookup CLI (`warden route`)
Agents and operators query the pointer catalog directly instead of re-deriving
@ -86,6 +124,7 @@ material.
```bash
warden route list [--json] [--all] [--tag <keyword>] # active-only unless --all
warden route list --stale [--stale-days 90] [--all] [--json] # past review cadence
warden route gaps [--json] [--all] # interim register (owner + blocker)
warden route show <id> [--json] # owner + pointers; SSH adds steps
warden route find "<free text need>" [--json] [--all] # rank by keyword overlap
```
@ -145,6 +184,7 @@ owner repo's shipped path.
| **On canon change** | When net-kingdom security docs change, review affected `canon_ref` entries immediately |
| **On owner ship** | When an owning repo merges a new OpenBao path or playbook, promote `draft``active` and bump `reviewed` |
| **On agent confusion** | If `warden route find` misses a common query, add `need_keywords` or a playbook — do not restate owner procedure in the catalog |
| **On interim review** | Run `warden route gaps` — re-check each `blocked_on` against the intended owner; flip to `native` when their front door exists |
### Stale check (operators and agents)
@ -177,6 +217,7 @@ moved but anchors still resolve.
- `CredentialRouting.md` — worker decision tree and routing table
- `NetKingdomSecurityMap.md` — component literacy
- `INTENT.md` — steward mission ("issue SSH, route the rest")
- `INTENT.md` — steward mission ("issue SSH, route the rest"); §9 interim custodianship
- `workplans/WARDEN-WP-0030-delegation-register.md` — delegation register
- `workplans/WARDEN-WP-0010-access-routing-charter.md` — charter + no-double-source rule
- `net-kingdom/docs/platform-identity-security-architecture.md` — platform canon

View file

@ -81,7 +81,9 @@ These needs are also carried in the machine-readable pointer catalog
The catalog is a **pointer-and-assist layer**: it names the owner, links the doc,
and carries secret-free handoff templates for `warden access`. Only the SSH row is
something ops-warden executes with its own authority. Non-SSH `exec_capable` rows
run the owner's tool as the caller and preserve owner custody.
run the owner's tool as the caller and preserve owner custody. Every execution
position is classified `permanent` / `native` / `interim` (`warden route gaps`
lists the interim set — WARDEN-WP-0030).
| Catalog `id` | What ops-warden answers | What the worker does next |
| --- | --- | --- |

View file

@ -24,10 +24,21 @@ Before changing `status: draft` → `status: active`:
| 7 | **Review date** | Update `reviewed:` in catalog entry |
| 8 | **Verification** | Positive + negative proof via **`bao token capabilities`** — never `bao kv get` (see below) |
| 9 | **Rotation guidance** | Secret-vending lanes carry a `rotation:` block; `warden rotate-guide <id>` returns steps. Enforced by the `catalog_rotation_coverage` scorecard check (WP-0026 T06) |
| 10 | **Delegation** | Entry carries a `delegation:` block (WP-0030). `mode: permanent` only for ops-warden's own front door. `mode: native` when the owner already fronts it. `mode: interim` requires `intended_owner` and `blocked_on`; the promotion note must name both and the retirement condition |
Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
If `delegation.mode` is `interim`, the promotion note (PR body or State Hub
progress) must state:
1. who the intended owner is
2. what is missing (`blocked_on`)
3. what would let ops-warden step back (`exec_owner` + proven owner front door)
A proxy that works is not enough to promote without answering the ownership
question. `warden route gaps` must list the lane after merge if it is interim.
---
## Capabilities-safe lane verification (WARDEN-WP-0026 T01)
@ -113,4 +124,6 @@ playbook prose alone.
## See also
- `wiki/CredentialRouting.md` — draft table index
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference
- `wiki/AccessRouting.md#interim-custodianship` — delegation register doctrine
- `warden route gaps` — queryable interim register