coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Declare ops-warden's tenancy posture
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
net-kingdom ruled that zone membership rides tenancy.yaml under a reserved
zones: key, and ops-warden had no such file — so declaring zones later implies
declaring the six-axis vector first. This is that file.

Current: I1 A1 E0 P n/a R n/a V0, validated against the canon schema.

Graded honestly against the standard's own worked examples rather than
flatteringly. A1 not A2: there is a single choke point on the signing path, but
it binds an actor to principals, not a request to the tenants it may act for,
and tenant context is a constant. E0 is accurate and is not a defect to
remediate — ops-warden holds no tenant-keyed data because ADR-0002 forbids it
custody, and claiming E1 on the strength of OpenBao's enforcement would be
someone else's control counted as ours. V0 because the code path for a local-CA
fallback exists but has never been exercised, and §13 does not accept "the code
path exists" as evidence.

implemented: A3 is the one place ops-warden is ahead of its current level —
flex-auth delegation is built and was verified live against the enforcing pin
(decision:f3f7c88f9585582a). It is not current because ADR-0006 defers it.

The zones: key is deliberately absent with the reason written in: no zone
vocabulary exists yet, so any value would be fabricated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 22:20:44 +02:00
parent 9008ded1b0
commit f528c1df31
2 changed files with 150 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
SCOPE.md
View file

@ -483,6 +483,7 @@ keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, l
| `wiki/CredentialRouting.md` | Which subsystem for each credential need |
| `wiki/WorkloadSecurityPosture.md` | Secret-store posture, workload maturity, and blocker triage |
| `registry/routing/catalog.yaml` | Machine-readable routing pointer catalog |
| `tenancy.yaml` | Declared tenancy posture (`I1 A1 E0 P n/a R n/a V0`) and why each axis sits where it does |
| `wiki/NetKingdomSecurityMap.md` | Platform security component map |
| `examples/warden.production.example.yaml` | Production warden.yaml template |
| `wiki/PolicyGatedSigning.md` | flex-auth opt-in gate + registry rollout |