coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Ship WARDEN-WP-0030: delegation register for every catalog lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Every execution position is now explicit. Catalog entries carry
delegation.mode (permanent / native / interim) with intended owner and
blocker. warden route gaps lists the interim set. Promotion requires
the ownership question. Doctrine lives in AccessRouting.md; the
register was published to the named owner repos.
This commit is contained in:
tegwick 2026-08-15 20:54:58 +02:00
parent 8d3706fa06
commit c93e3c9b43
11 changed files with 619 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

4
wiki/CredentialRouting.md
View file

@ -81,7 +81,9 @@ These needs are also carried in the machine-readable pointer catalog
The catalog is a **pointer-and-assist layer**: it names the owner, links the doc,
and carries secret-free handoff templates for `warden access`. Only the SSH row is
something ops-warden executes with its own authority. Non-SSH `exec_capable` rows
run the owner's tool as the caller and preserve owner custody.
run the owner's tool as the caller and preserve owner custody. Every execution
position is classified `permanent` / `native` / `interim` (`warden route gaps`
lists the interim set — WARDEN-WP-0030).
| Catalog `id` | What ops-warden answers | What the worker does next |
| --- | --- | --- |