---
id: capability.security.ssh-certificate-issuance
name: Decision-bound SSH certificates
summary: warden sign with local and OpenBao backends and adm/agt/atm actors.
owner: ops-warden
status: draft
domain: helix_forge
tags:
- ssh
- certificate
- ca
- ops-warden
- openbao
- security
- netkingdom
- framework-reuse
maturity:
  discovery:
    current: D4
    target: D5
    confidence: medium
    rationale: 'SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command
      contract are documented; production OpenBao integration is documented but engine
      deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml)
      and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable.

      '
  availability:
    current: A3
    target: A5
    confidence: medium
    rationale: 'Source interface assessed 2026-10-14: warden sign with local and OpenBao
      backends and adm/agt/atm actors. Availability describes the delivery form, not
      production acceptance. Direct Tooling contact is a declared gap; certificate
      reachability is not target authorization.'
external_evidence:
  completeness:
    level: C3
    name: Functional Core
    confidence: medium
    basis: scope_vs_intent_and_consumer_expectations
    satisfied_expectations:
    - local and OpenBao/Vault-compatible signing backends
    - TTL policy enforcement per actor type
    - principals inventory and cert-side scorecard
    - signatures audit log and stale-cert cleanup
    - cert_command stdout contract for ops-bridge
    broken_expectations:
    - host-side principal deployment not owned here
    - OpenBao SSH engine mount not deployed from this repo
    out_of_scope_expectations:
    - long-lived API key custody
    - tunnel lifecycle management
    - Vault/OpenBao cluster operations
  reliability:
    level: R2
    name: Tolerable
    confidence: medium
    basis: consumer_quality_signals
    known_reliability_risks:
    - production signing depends on OpenBao availability and token policy
    - local backend requires protected CA key handling by operators
discovery:
  intent: warden sign with local and OpenBao backends and adm/agt/atm actors
  includes:
  - warden sign with local and OpenBao backends and adm/agt/atm actors
  excludes:
  - Direct Tooling contact is a declared gap; certificate reachability is not target
    authorization
  assumptions:
  - callers supply actor public keys; humans self-issue admin keys
  - production platform uses OpenBao with Vault-compatible SSH engine API
  use_cases:
  - ops-bridge tunnel cert_command
  - Inter-Hub bootstrap short-lived agent access
  - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
    connectivity'
  research_memos:
  - ops-warden/SCOPE.md
  - ops-warden/wiki/CertCommandInterface.md
  - ops-warden/wiki/OpsWardenConfig.md
  - ops-warden/wiki/AccessRouting.md
availability:
  current_level: A3
  target_level: A5
  current_artifacts:
  - SCOPE.md
  - README.md
  target_artifacts:
  - packaged ops-warden release with documented OpenBao role bootstrap
  - '`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)'
  consumption_modes:
  - library
  - CLI
relations:
  depends_on: []
  supports: []
  related_to:
  - capability.security.credential-lifecycle
  - capability.authorization.policy-evaluate
  - capability.ops.tunnel-bridge
  - capability.security.structure-construction
consumer_guidance:
  recommended_for:
  - Operator or automation obtains a bounded SSH certificate and maintains private
    connectivity
  not_recommended_for:
  - Direct Tooling contact is a declared gap; certificate reachability is not target
    authorization
  known_limitations:
  - Direct Tooling contact is a declared gap; certificate reachability is not target
    authorization
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
evidence:
  documentation:
  - SCOPE.md
  - README.md
---

# Decision-bound SSH certificates

warden sign with local and OpenBao backends and adm/agt/atm actors.

## Reuse boundary

Direct Tooling contact is a declared gap; certificate reachability is not target authorization.

## Supported use cases

- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

## Evidence and integration

- [SCOPE.md](../../SCOPE.md)
- [README.md](../../README.md)

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.