# Credential and access routing

**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
for inference. Run this check **before** requesting secrets, API keys, SSH access,
login tokens, or database passwords — in any repo, not only `ops-warden`.

ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
other credential need belongs to another subsystem. **Do not** message
`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.

### Lookup (do this first)

**Always plan before drafting any founder credential step** (WARDEN-WP-0029):

```bash
warden plan "<describe your need>" --json
# verdict: autonomous | founder_required | unroutable
```

```bash
warden route find "<describe your need>" --json
warden route show <catalog-id> --json
```

Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
If a known lane is missing, reinstall from checkout (stale bundled catalog).

| Agent runtime | How to orient |
| --- | --- |
| **Codex / Grok** (shell, HTTP State Hub) | `warden plan` first; inbox `to_agent=ops-warden` is for coordination, not secret vending |
| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden plan` / `warden route` for credential ownership |
| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody via `warden plan` |

### Quick routing table

| I need… | Owner | ops-warden executes? |
| --- | --- | --- |
| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
| Authorization decision | flex-auth | No — route only |
| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |

### Anti-patterns (do not do these)

- Drafting founder steps ("paste PAT to `/tmp`", "click admin UI") without `warden plan`
- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
- Pasting secrets into Git, State Hub, workplans, logs, or chat
- Steady-state **file drops** of credentials under `/tmp` (use `warden desk` paste-once
  or `warden access --out/--exec/--wrap`)
- **Reading a secret value onto a captured stdout.** `bao kv get <path>` (full table)
  or `bao kv get -field=X` piped/redirected/run in an agent session dumps the value
  into a logged context — the 2026-07-16 disclosure. To *verify* a lane use
  `bao token capabilities` (allow/deny), never a read (WP-0026 T01).

### Safe fetch transports (WP-0026 T02)

When a value must actually move, use a sanctioned transport that keeps it off
stdout. `warden access <need> --fetch` refuses to stream a value to a non-terminal
stdout unless you pass `--unsafe-stdout` (interactive human sessions only):

| Transport | Command | Result |
| --- | --- | --- |
| **File** | `warden access <need> --out FILE` | value written to a mode-0600 file, never shown |
| **Env (exec)** | `warden access <need> --exec -- <cmd>` | value injected into the child process env only |
| **Wrapping token** | `warden access <need> --wrap` | a single-use, short-TTL OpenBao wrapping token to `bao unwrap` in your own context |

### Agent read-boundary on high-risk lanes (WP-0026 T04)

When `WARDEN_AGENT_ID` is set and the catalog lane is `risk: high`, raw value
streaming is refused (exit 7). Use `--out` / `--exec` / `--wrap` / `--fingerprint`
only. OpenBao policy `agent-high-risk-boundary` denies data-read on those paths
for agent tokens (metadata/capabilities only). See
`wiki/playbooks/agent-read-boundary.md`.

### EXPOSED taint (WP-0026 T05)

`warden taint <catalog-id>` reports KV v2 `custom_metadata` (`exposed_at`,
`exposed_version`, …) without reading secret data. Convention:
`wiki/playbooks/exposed-taint.md`.

### Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through **reuse-surface** federation
(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
every repo's agent instructions because it is high-frequency, high-risk, and easy to
get wrong.

**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`