coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Routing: named client rotation outranks keycape-client-secret-generate

Browse source 
Activation made the generic generate lane win the reported rapp-qonto rotation
need (test_plan regression). Narrow its keywords and title to case-specific
terms, give rapp-qonto-keycape-client its secret/rotation keywords, and add a
two-way routing regression test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
This commit is contained in:
tegwick 2026-10-10 13:23:13 +02:00
parent 1f3ecf5d49
commit e70dfa6d02
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
registry/routing/catalog.yaml
View file

@ -952,7 +952,7 @@ entries:
- id: rapp-qonto-keycape-client
title: rapp-qonto KeyCape workload client
need_keywords: [rapp-qonto, qonto, keycape, oidc, client-credentials, service-token, workload-identity, binky]
need_keywords: [rapp-qonto, qonto, keycape, oidc, client-credentials, service-token, workload-identity, binky, client secret, secret, successor, rotate, rotation]
owner_repo: key-cape
subsystem: KeyCape + OpenBao
warden_executes: false
@ -1532,7 +1532,7 @@ entries:
lane: login
- id: keycape-client-secret-generate
title: Generate a KeyCape client secret inside OpenBao custody (SecurityCase mint-secret)
title: SecurityCase mint-secret, first KeyCape client secret generated in custody
# Pointer only, draft (WARDEN-WP-0044; railiance-platform RPF-WP-0054,
# message d951386f, 2026-10-09). Lane named by SecurityCaseType
# oidc-browser-relying-party 1.0, step mint-secret
@ -1552,7 +1552,10 @@ entries:
workload_ref:
applicability: not-applicable
reason: "Per-case generation lane; each case's consuming service gets its own {consuming_service}-keycape-client entry."
need_keywords: [keycape client secret, generate client secret, mint-secret, client-secret-generate, oidc client secret, keycape/client-secret-generate, generated in custody, security case]
# Case-specific terms only. Broad phrases such as "keycape client secret"
# outranked named per-client lanes (rapp-qonto-keycape-client) on rotation
# needs, and this lane refuses an existing path (first generation only).
need_keywords: [mint-secret, client-secret-generate, keycape/client-secret-generate, generated in custody, generated_in_custody, security case, securitycase, oidc-browser-relying-party]
owner_repo: railiance-platform
subsystem: railiance-platform credential broker + OpenBao platform/workloads/keycape/
warden_executes: false