Ship WARDEN-WP-0030: delegation register for every catalog lane
Every execution position is now explicit. Catalog entries carry delegation.mode (permanent / native / interim) with intended owner and blocker. warden route gaps lists the interim set. Promotion requires the ownership question. Doctrine lives in AccessRouting.md; the register was published to the named owner repos.
This commit is contained in:
parent
8d3706fa06
commit
c93e3c9b43
11 changed files with 619 additions and 29 deletions
|
|
@ -76,6 +76,44 @@ boundary in `OperatorAccessAssist.md`.
|
|||
|
||||
---
|
||||
|
||||
## Interim custodianship
|
||||
|
||||
ops-warden **works with, and never replaces or duplicates**, the NetKingdom
|
||||
components that own identity, custody, authorization, and tenant/user lifecycle
|
||||
(`INTENT.md` §9). Covering a gap is legitimate. Silently becoming the owner of
|
||||
that gap is not.
|
||||
|
||||
The only lane ops-warden executes with its own authority is **SSH issuance**
|
||||
(`ssh-cert-host-access`). Every other execution position — including every
|
||||
`warden access` proxy — is **interim by default**. A catalog entry without a
|
||||
`delegation:` block is treated as interim with an unknown owner: absence is a
|
||||
question, not a settlement.
|
||||
|
||||
| `delegation.mode` | Meaning |
|
||||
| --- | --- |
|
||||
| `permanent` | ops-warden is the designed owner of this front door (SSH only, today) |
|
||||
| `native` | the intended owner already fronts it; ops-warden routes (and may keep a proxy as fallback) |
|
||||
| `interim` | ops-warden covers the gap until `intended_owner` ships the missing front door named in `blocked_on` |
|
||||
|
||||
Delegation targets — the components that should own a front door once they have
|
||||
one:
|
||||
|
||||
| Target | What they should front |
|
||||
| --- | --- |
|
||||
| **secrets-engine** | owner-native secret-exec (`secrets-engine exec --catalog <id>`) |
|
||||
| **tenant-engine** | tenant/client secret custody and tenant-lane front door |
|
||||
| **user-engine** | end-user / account-lifecycle secrets that belong with user identity |
|
||||
| **railiance-platform** | OpenBao cluster, credential broker, platform workload procedure |
|
||||
| **flex-auth** | authorization decisions (already native — ops-warden only points) |
|
||||
| **key-cape** | identity login and client-credential protocol (OIDC, `client_secret_basic`) |
|
||||
|
||||
Query the register with `warden route gaps`. An interim lane is retired by
|
||||
setting `exec_owner` / `exec_command` (the WP-0019 pattern) and flipping
|
||||
`delegation.mode` to `native` once the owner's front door is proven. Do not
|
||||
delete a working proxy on the way.
|
||||
|
||||
---
|
||||
|
||||
## Routing lookup CLI (`warden route`)
|
||||
|
||||
Agents and operators query the pointer catalog directly instead of re-deriving
|
||||
|
|
@ -86,6 +124,7 @@ material.
|
|||
```bash
|
||||
warden route list [--json] [--all] [--tag <keyword>] # active-only unless --all
|
||||
warden route list --stale [--stale-days 90] [--all] [--json] # past review cadence
|
||||
warden route gaps [--json] [--all] # interim register (owner + blocker)
|
||||
warden route show <id> [--json] # owner + pointers; SSH adds steps
|
||||
warden route find "<free text need>" [--json] [--all] # rank by keyword overlap
|
||||
```
|
||||
|
|
@ -145,6 +184,7 @@ owner repo's shipped path.
|
|||
| **On canon change** | When net-kingdom security docs change, review affected `canon_ref` entries immediately |
|
||||
| **On owner ship** | When an owning repo merges a new OpenBao path or playbook, promote `draft` → `active` and bump `reviewed` |
|
||||
| **On agent confusion** | If `warden route find` misses a common query, add `need_keywords` or a playbook — do not restate owner procedure in the catalog |
|
||||
| **On interim review** | Run `warden route gaps` — re-check each `blocked_on` against the intended owner; flip to `native` when their front door exists |
|
||||
|
||||
### Stale check (operators and agents)
|
||||
|
||||
|
|
@ -177,6 +217,7 @@ moved but anchors still resolve.
|
|||
|
||||
- `CredentialRouting.md` — worker decision tree and routing table
|
||||
- `NetKingdomSecurityMap.md` — component literacy
|
||||
- `INTENT.md` — steward mission ("issue SSH, route the rest")
|
||||
- `INTENT.md` — steward mission ("issue SSH, route the rest"); §9 interim custodianship
|
||||
- `workplans/WARDEN-WP-0030-delegation-register.md` — delegation register
|
||||
- `workplans/WARDEN-WP-0010-access-routing-charter.md` — charter + no-double-source rule
|
||||
- `net-kingdom/docs/platform-identity-security-architecture.md` — platform canon
|
||||
|
|
|
|||
|
|
@ -81,7 +81,9 @@ These needs are also carried in the machine-readable pointer catalog
|
|||
The catalog is a **pointer-and-assist layer**: it names the owner, links the doc,
|
||||
and carries secret-free handoff templates for `warden access`. Only the SSH row is
|
||||
something ops-warden executes with its own authority. Non-SSH `exec_capable` rows
|
||||
run the owner's tool as the caller and preserve owner custody.
|
||||
run the owner's tool as the caller and preserve owner custody. Every execution
|
||||
position is classified `permanent` / `native` / `interim` (`warden route gaps`
|
||||
lists the interim set — WARDEN-WP-0030).
|
||||
|
||||
| Catalog `id` | What ops-warden answers | What the worker does next |
|
||||
| --- | --- | --- |
|
||||
|
|
|
|||
|
|
@ -24,10 +24,21 @@ Before changing `status: draft` → `status: active`:
|
|||
| 7 | **Review date** | Update `reviewed:` in catalog entry |
|
||||
| 8 | **Verification** | Positive + negative proof via **`bao token capabilities`** — never `bao kv get` (see below) |
|
||||
| 9 | **Rotation guidance** | Secret-vending lanes carry a `rotation:` block; `warden rotate-guide <id>` returns steps. Enforced by the `catalog_rotation_coverage` scorecard check (WP-0026 T06) |
|
||||
| 10 | **Delegation** | Entry carries a `delegation:` block (WP-0030). `mode: permanent` only for ops-warden's own front door. `mode: native` when the owner already fronts it. `mode: interim` requires `intended_owner` and `blocked_on`; the promotion note must name both and the retirement condition |
|
||||
|
||||
Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
|
||||
`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
|
||||
|
||||
If `delegation.mode` is `interim`, the promotion note (PR body or State Hub
|
||||
progress) must state:
|
||||
|
||||
1. who the intended owner is
|
||||
2. what is missing (`blocked_on`)
|
||||
3. what would let ops-warden step back (`exec_owner` + proven owner front door)
|
||||
|
||||
A proxy that works is not enough to promote without answering the ownership
|
||||
question. `warden route gaps` must list the lane after merge if it is interim.
|
||||
|
||||
---
|
||||
|
||||
## Capabilities-safe lane verification (WARDEN-WP-0026 T01)
|
||||
|
|
@ -113,4 +124,6 @@ playbook prose alone.
|
|||
## See also
|
||||
|
||||
- `wiki/CredentialRouting.md` — draft table index
|
||||
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference
|
||||
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference
|
||||
- `wiki/AccessRouting.md#interim-custodianship` — delegation register doctrine
|
||||
- `warden route gaps` — queryable interim register
|
||||
Loading…
Add table
Add a link
Reference in a new issue