coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Route explicit attended OpenBao administration to governed login
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 18:44:02 +02:00
parent 958352089b
commit d79f065955
3 changed files with 55 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/warden/routing/catalog.py
View file

@ -206,6 +206,14 @@ def _openbao_configuration_need(query: str) -> bool:
first; reads and surveys continue through ordinary catalog ranking.
"""
text = query.lower().replace("-", " ")
# The attended administration front door is itself explicit intent. Its
# reviewed operation may concern signer custody or KV metadata rather than
# one of the control nouns below; keyword ranking must not turn that into a
# metadata-survey approval. This selects identity, never grants authority.
if (re.search(r"\battended\b", text)
and re.search(r"\bplatform\s+administration\b", text)
and re.search(r"\bopenbao\b", text)):
return True
control = re.search(r"\b(?:polic(?:y|ies)|auth\s+roles?|token\s+roles?|"
r"database\s*(?:/| )\s*config|secrets?\s+engine)\b", text)
change = re.search(r"\b(?:configure|configuring|create|apply|install|update|"