coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Compare commits

base: coulomb:b30626edcf985a4c8ab3cb569f70c36c3aef1a74
Branches Tags
coulomb:main
coulomb:mason/state-hub-forge-derivation-read
coulomb:v0.1.2
coulomb:v0.1.1
...
compare: coulomb:a565e62b2f20f5c44488367dbadff1a3d1460dcb
Branches Tags
coulomb:main
coulomb:mason/state-hub-forge-derivation-read
coulomb:v0.1.2
coulomb:v0.1.1

2 commits
b30626edcf ... a565e62b2f

Author SHA1 Message Date
tegwick
a565e62b2f Regenerate the artifact; correct the test that classified openbao-api-key as a gap
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
test_catalog_gaps_lists_only_interim asserted openbao-api-key was an interim
cover. It encoded the same classification the entry did, so it defended the
wrong answer rather than catching it -- the second time this session a test has
held a judgement still (see ADR-0008).

The staleness test added in T03 did its job on the first real change: it failed
the moment the catalog moved without the generated artifact being re-emitted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-21 09:06:08 +02:00
tegwick
675e04e8e6 Correct the delegation register after secrets-engine's SECRETS-WP-0006 answer 
Three fixes, the first of which is my own botched edit from an hour ago.

1. The "six delivery modes" claim was never actually removed. I ran a str.replace
   with no assertion on the result, it matched nothing, and the print said "ok".
   The wrong claim sat in all seven lanes while I told secrets-engine it was
   fixed. This edit asserts 5/1/1 and fails loudly otherwise.

2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now
   records that secrets-engine holds the entry and that the interim proxy retires
   on approved native verification in T05 -- not on acceptance. Retiring early
   would drop the cover before the replacement is proven.

3. Two lanes REFUSED, and both refusals are right:
   - key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape.
     Login and identity-token issuance were never secrets-engine's. Not yet asked
     of key-cape, and the record says so.
   - openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle>
     routing template, not one secret lane, so there is no front door to own.
     interim -> native with railiance-platform named: OpenBao is itself the front
     door and this entry is a pointer to it, never an interim cover. It should
     not have been inflating the interim count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-21 09:04:54 +02:00
3 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
registry/generated/high-risk-data-paths.yaml
View file

@ -10,10 +10,10 @@
# declares it, and is null where the field set has not been established --
# null means unknown, never 'one field'.
generated_at: "2026-08-21T06:37:27Z"
generated_at: "2026-08-21T07:04:54Z"
source: ops-warden/registry/routing/catalog.yaml
catalog_revision: "c357ce5908e562755f3c41c24074edc9d231e6ce"
catalog_revision_date: "2026-08-21T08:36:42+02:00"
catalog_revision: "675e04e8e67869f0e47a3ae55ab37b00112582f2"
catalog_revision_date: "2026-08-21T09:04:54+02:00"
catalog_dirty: false
high_risk_lane_count: 19
concrete_path_count: 14

20
registry/routing/catalog.yaml
View file

@ -105,9 +105,9 @@ entries:
reviewed: "2026-06-27"
status: active
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
mode: native
intended_owner: railiance-platform
blocked_on: "NOT A DELEGABLE LANE. Refused by secrets-engine 2026-08-21: this is a generic routing template (path_template is a <domain>/<workload>/<bundle> pattern), not one secret lane, so there is no front door for anyone to own. ops-warden agrees. The concrete lanes it resolves to are delegated individually; this entry stays a pointer and should not be counted as an interim cover."
reviewed: "2026-08-21"
# Structured handoff (WP-0014) — reference example. Templates only, no values.
# ops-warden does not own this secret; it advises and (exec_capable) proxies the
@ -201,8 +201,8 @@ entries:
status: active
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
intended_owner: key-cape
blocked_on: "REFUSED by secrets-engine 2026-08-21: login, MFA and identity-token issuance are key-cape/Keycloak's; secrets-engine may consume OIDC for OpenBao auth but does not own the login capability. ops-warden agrees — intended_owner corrected from secrets-engine to key-cape. Not yet asked of key-cape."
reviewed: "2026-08-21"
# Login lane (WP-0014 T4) — interactive auth bootstrap, not a secret read. No
# secret-read gate (you have no identity yet) and no caller-auth precheck (the
@ -304,7 +304,7 @@ entries:
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
reviewed: "2026-08-21"
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0002 / RAILIANCE-WP-0009
# (promoted 2026-07-02): policy workload-kv-read-issue-core-runtime and k8s auth role
@ -351,7 +351,7 @@ entries:
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
reviewed: "2026-08-21"
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011
# (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret
@ -388,7 +388,7 @@ entries:
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
reviewed: "2026-08-21"
# High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04).
risk: high
@ -473,7 +473,7 @@ entries:
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
reviewed: "2026-08-21"
# High-risk: site-admin PAT (WP-0026 T04).
risk: high
@ -836,7 +836,7 @@ entries:
delegation:
mode: interim
intended_owner: secrets-engine
blocked_on: "secrets-engine has not accepted the lane. Reframed 2026-08-21: exec --catalog does generalize — catalog.py takes mount/path as plain fields with six delivery modes — so the blocker is entry authoring and operation, not capability. Two entries exist, both already-native lanes. ops-warden offered to author all seven (msg cbd312f8); asked 2026-08-11, 08-15, 08-21"
blocked_on: "ACCEPTED by secrets-engine 2026-08-21 (SECRETS-WP-0006, decision ae676382). They drafted and hold the catalog entry; ops-warden reviewed it and both sides agree. Interim proxy remains with ops-warden until this lane passes approved native positive/negative verification (SECRETS-WP-0006-T05) — retire only then, not on acceptance."
reviewed: "2026-08-21"
risk: high
# CCR-2026-0010 approved 2026-08-12; applied same day (EMAIL-WP-0004-T03):

8
tests/test_routing.py
View file

@ -688,7 +688,13 @@ def test_catalog_gaps_lists_only_interim():
assert "ssh-cert-host-access" not in gap_ids
assert "whynot-design-npm-publish" not in gap_ids
assert "binky-company-email-imap" in gap_ids
assert "openbao-api-key" in gap_ids
# WARDEN-WP-0033: openbao-api-key was listed here as an interim cover. It is
# not one -- its path_template is a <domain>/<workload>/<bundle> routing
# pattern rather than a single secret lane, so there is no front door for
# anyone to take over. secrets-engine refused it on exactly that ground and
# ops-warden agrees. A pointer to OpenBao is not a gap ops-warden is holding,
# and counting it as one overstated the interim surface by a lane.
assert "openbao-api-key" not in gap_ids
assert all(catalog.get(i).is_interim for i in gap_ids)