coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

docs: project WP0027 infra review contract
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
This commit is contained in:
tegwick 2026-08-22 22:38:00 +02:00
parent 7fa6985f72
commit cdb44a8f23
2 changed files with 74 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

67
interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json Normal file
View file

@ -0,0 +1,67 @@
{
"schema_version": "review-contract/v1",
"contract_key": "WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA",
"subject": {
"kind": "task",
"id": "WARDEN-WP-0027-T02"
},
"scenario_id": "WARDEN-WP-0027-T02-DRILL-20260822-01",
"expires_at": "2026-08-23T20:00:00Z",
"authorizes_execution": false,
"evidence_boundary": "metadata_only",
"allowed_dispositions": [
"approve",
"request_changes"
],
"artifacts": {
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md": {
"algorithm": "sha256",
"digest": "ffa69764ad391db633f57ac70444e5781eee698bf9e362dfef31614fa43152dc"
}
},
"owners": [
{
"id": "railiance-infra",
"artifact_ids": [
"docs/evidence/WARDEN-WP-0027-T02-drill-scenario-2026-08-22.md"
],
"assertions": [
{
"id": "scenario-and-expiry-bound",
"statement": "This receipt applies only to scenario WARDEN-WP-0027-T02-DRILL-20260822-01 and expires at 2026-08-23T20:00:00Z."
},
{
"id": "provider-console-access-explicit",
"statement": "railiance-infra has independently verified provider-console access; it is not inferred from SSH, Warden, or cluster reachability."
},
{
"id": "distinct-abort-authority-accepted",
"statement": "railiance-infra accepts the distinct abort-authority role for this scenario and its bounded live window."
},
{
"id": "metadata-only-evidence",
"statement": "The receipt and its checks disclose no credential, token, recovery share, secret value, value-derived fingerprint, or provider-console detail."
},
{
"id": "execution-not-authorized",
"statement": "Approval is owner coordination evidence only and authorizes no console action, reboot, OpenBao seal or unseal, or other live execution."
}
],
"check_ids": [
"scenario-artifact-sha256",
"provider-console-access-attestation",
"distinct-abort-role-attestation",
"metadata-only-boundary"
]
}
],
"gates": [
{
"id": "WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA",
"policy": "all_required",
"owners": [
"railiance-infra"
]
}
]
}

7
workplans/WARDEN-WP-0027-credential-governance-lockdown.md
View file

@ -170,6 +170,13 @@ and railiance-master is asked only for a metadata-only 2-of-3 availability
attestation. All three owner receipts and a green fully parameterized preflight
are required before the final operator question.
The railiance-infra role is scoped by the authoritative review contract
`WARDEN-WP-0027-T02-DRILL-20260822-01-INFRA` in
`interfaces/reviews/WARDEN-WP-0027-T02-DRILL-20260822-01-railiance-infra.json`.
It binds the exact scenario artifact and expiry, requires explicit independent
provider-console and distinct-abort attestations, permits metadata-only evidence,
and states `authorizes_execution: false`.
## Task: Tamper-evident policy governance + reconcile
```task