coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Park the warden-sign AppRole with explicit un-park triggers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder decision 2026-08-11: neither withdraw nor proceed. The broker covers
the workstation, but unattended signing on a remote tunnel host is unresolved,
and there the AppRole is narrower than placing the broker's issuer token.

Recorded where each trigger will be hit: WP-0027 break-glass task (trust-root
design), and the ops-bridge cutover playbook (token source must be resolved
before going live). secrets-engine told to stop holding apply readiness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-11 14:32:04 +02:00
parent 9d42dd5abd
commit cd074caaaa
5 changed files with 74 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/WARDEN-WP-0027-credential-governance-lockdown.md
View file

@ -104,6 +104,19 @@ step is opt-in and attended.
trust-root and quorum, and soft-lockdown is executable via capabilities-based
policy toggles.
**Parked input — the warden-sign AppRole (2026-08-11).** secrets-engine holds a
validated dry-run for a `warden-sign` AppRole (policy + role, `update` on
`ssh/sign/{agt,adm,atm}-role` only). It was **parked** rather than withdrawn
specifically because it is an input to this task: today the credential broker is the
only *autonomous* path to a signing token, so if its issuer lapses, recovery is a
founder OIDC act. Whether a second autonomous path should exist — and whether it is
the AppRole or something this trust-root design supersedes — is a break-glass
question, not a routing one. Resolve it here. Context and the counter-argument
(AppRole is narrower in capability than placing the broker's issuer token on a remote
host) are in `workplans/ADHOC-2026-08-11.md` T03; secrets-engine was told to stop
holding apply readiness until this task or the ops-bridge cutover fires
(msg `863c7b57`).
## Task: Tamper-evident policy governance + reconcile
```task
@ -130,3 +143,6 @@ manifest, and an attended reconcile can restore it.
- `.claude/rules/credential-routing.md` — ops-warden custodies no secret values
- `railiance-platform` — OpenBao cluster, policy custody, credential broker
- `wiki/AccessRouting.md` — issue vs route vs assist boundary
- `workplans/ADHOC-2026-08-11.md` T03 — parked warden-sign AppRole; un-parks on this
workplan's break-glass task or the ops-bridge cert_command cutover
- `secrets-engine` `SECRETS-WP-0004` — the parked AppRole apply/handoff