# SCOPE

> This file helps you quickly understand what this repository is about,
> when it is relevant, and when it is not.
> Aspirational direction lives in `INTENT.md`.

---

## One-liner

Operational access steward and **front door** for the NetKingdom security model — issues
short-lived SSH certificates for `adm`/`agt`/`atm` actors, and for every other credential
need is the operator front door (`warden access`): routes to the owning subsystem and, for
`exec_capable` lanes (OpenBao reads, key-cape login), **proxies the fetch as the caller**
without taking custody. Also stewards workload security posture conformance and keeps ops
access guidance aligned with NetKingdom canon.

---

## Where we are (2026-08-22)

ops-warden **issues short-lived SSH certificates and routes every other credential
need to the subsystem that owns it.** SSH signing is **production-verified** on
Railiance OpenBao (`warden sign` against `https://bao.coulomb.social`, host CA trust
deployed).

**Access routing** is shipped: `wiki/AccessRouting.md`, credential routing wiki,
NetKingdom security map, machine-readable pointer catalog
(`registry/routing/catalog.yaml`, WP-0010), and `warden route` lookup CLI
(`list`/`show`/`find`, `--json`, WP-0011).

**Operator access assist** is shipped (WP-0014): `warden access` gives advisory
handoffs for every catalog need and can proxy `exec_capable` lanes as the caller,
without taking custody of values.

**Owner-native exec lanes** are documented in the catalog (WP-0017–0019 plus
cross-repo stewardship): provisioned secret-exec routes to **secrets-engine**
(`whynot-design-npm-publish`, production-exercised); scoped OpenBao tokens for
ops-warden signing route to the **railiance-platform credential broker**
(`ops-warden-warden-sign-token`, RAILIANCE-WP-0005 T08, live 2026-07-01). ops-warden
points at the owner's front door — it does not mint OpenBao tokens or run
`credential.py` itself.

**Workload security posture** is shipped (WP-0015, all tasks done): dev/test/prod
environment posture, M0-M3 workload maturity, the secret-flow lattice, and blocker
triage language (T1); machine-readable descriptors + `warden policy list|show` (T2);
the read-only conformance checker `scripts/check_secret_posture_conformance.py` (T3);
and the dev-tier contract-double library `warden.doubles` (T4). Canon landing in
net-kingdom / info-tech-canon is owner-driven (tracked via coordination messages, T5).

**The policy gate is zone-aware.** The caller-identity path is production proven
and the flex-auth pin enforces caller authentication. WP-0032 adopted
`security-zones_v0.1`: the repo-wide `policy.enabled` and `policy.fail_closed`
settings are retired, target workload membership compiles into flex-auth resource
attributes, and ops-warden selects dependency failure behavior from the target
zone. Unknown membership is explicit and uses the versioned build profile.
Ops-warden itself declares `z1-operational` in `tenancy.yaml`.

**ops-bridge cert_command pilot** is shipped to pilot-ready (WP-0016): a read-only
readiness gate (`scripts/check_tunnel_cert_readiness.py`) plus an opt-in offline
contract smoke (`--sign-smoke`); the playbook leads with the gate and the pilot
(`agt-state-hub-bridge`) is handed to ops-bridge. The live tunnel cutover is
ops-bridge's to execute.

**Credential hygiene and the policy front door** shipped through July 2026:
disclosure hygiene and rotation guidance (WP-0026 — `warden taint`,
`warden rotate-guide`, agent read-boundary on high-risk lanes), the tenant secret
custody pattern (WP-0028, first lane binky company email IMAP), experiential memory
across worker/agent sessions (WP-0024), the Forgejo admin PAT lane (WP-0025), and the
posture-aware policy front door (WP-0029 — `warden plan`, `warden desk`, declared
`organization_posture: build` as a third axis). WP-0027 (tamper-resistant governance,
mass rotation/lockdown) is drafted and sits in `backlog`.

**Delegation register** is the open question (WP-0030, proposed). ops-warden fronts
11 catalog lanes as a caller-identity proxy with no record of which component *should*
own that front door. The primitive to delegate exists and is proven
(`exec_owner`/`exec_command` — secrets-engine for npm publish, the credential broker
for warden-sign) but is used by 2 of 24 lanes. See
`history/2026-08-11-delegation-surface-assessment.md`.

**INTENT alignment:** SSH issuance mission met in production. All ops-warden workplans
through WP-0029 are finished except WP-0027 (`backlog`) and WP-0030 (`proposed`).
Remaining distance is in other repos' lanes: ops-bridge running the cert_command pilot
cutover, flex-auth publishing the zone-aware pre-sign stance package,
the owner-driven WP-0015 canon landing, and — newly named — the missing owner front
doors that keep ops-warden holding interim lanes (secrets-engine, tenant-engine).

### Issue vs route

ops-warden executes exactly one lane with its own authority and routes/assists the rest.

| Need | Subsystem | ops-warden role |
| --- | --- | --- |
| SSH cert for host/ops access (`adm`/`agt`/`atm`) | **ops-warden** | **Issue** (`warden sign`) |
| Scoped `VAULT_TOKEN` for warden-sign / policy-gate smoke | railiance-platform credential broker | Route — owner-native `credential exec`; ops-warden does not mint |
| API key / DB cred / dynamic lease | OpenBao | Assist — route; proxy as caller only for `exec_capable` lanes |
| Provisioned secret-exec (e.g. npm publish) | secrets-engine (+ OpenBao custody) | Route — primary `secrets-engine exec`; `warden access` as fallback |
| "May I perform action X?" | flex-auth | Route — point at policy; consume decisions where configured |
| Login / OIDC / MFA | key-cape / Keycloak | Assist — route; proxy `login` lane when `exec_capable` |
| SSH tunnel / port forward | ops-bridge | Route — supply `cert_command` |
| Host principal deployment | railiance-infra | Route — point at Ansible |

Full role and boundary: `wiki/AccessRouting.md`. The catalog is a **pointer layer** —
it never restates an owner's procedure (authored `steps` exist only for the SSH lane).

**Interim by default.** SSH issuance is the only lane ops-warden owns permanently.
Where it proxies or assists, it is covering a need no component fronts yet — a
legitimate service, but a *tracked gap*, retired to the owner once their front door
exists (INTENT §9). Recording that intent per lane is WP-0030; today only
`whynot-design-npm-publish` and `ops-warden-warden-sign-token` carry it.

Gap analysis: `history/2026-07-01-intent-scope-gap-analysis.md` (current);
`history/2026-06-24-intent-scope-gap-analysis.md` (prior);
`history/2026-06-18-post-wp0008-intent-scope-reassessment.md` (SSH lane);
`history/2026-06-18-access-routing-intent-shift-assessment.md` (routing charter).

---

## INTENT gap snapshot

| INTENT success criterion | Status |
| --- | --- |
| Worker knows which subsystem for each credential type | Met |
| SSH short-lived, inventoried, audited | Met (production) |
| ops-bridge integrates via stable `cert_command` | **Pilot-ready** — contract + readiness gate (`check_tunnel_cert_readiness.py`, WP-0016) shipped; live cutover handed to ops-bridge |
| NetKingdom evolution reflected in docs | Met |
| Non-SSH secrets stay out of ops-warden | Met |
| Workload posture / maturity model for secret-flow blockers | Met — two-axis standard + descriptors + conformance checker + dev doubles (WP-0015) |
| Every execution position explicitly permanent or interim with a named owner | **Met** — every catalog entry carries `delegation:`; `warden route gaps` lists the interim set (WP-0030) |

**Maturity vector:** `D5 / A5 / C5 / R4` (Discovery / Availability / Completeness / Reliability)

| Dimension | Level | Meaning today |
| --- | --- | --- |
| D5 | Discovery | Routing wiki + security map + pointer catalog + NK canon cross-links |
| A5 | Availability | CLI + `warden route` + `warden access` advisory & proxy front door + `warden policy` + opt-in policy gate + agent `--json` |
| C5 | Completeness | All ops-warden lanes shipped — SSH (prod), routing, access assist, posture conformance, cert_command pilot gate, disclosure hygiene, tenant custody, policy front door, delegation register (WP-0030) |
| R4 | Reliability | Live OpenBao sign + credential-broker policy-gate smoke evidence on Railiance (2026-07-01) |

---

## Governing rules (ours)

The decisions that bind this repo are ADRs in `docs/adr/`, each `owner: ops-warden` —
meaning we follow them *and* we are the ones who may change them. Changing one is a
superseding ADR, never an in-place edit.

| ADR | Rule |
| --- | --- |
| `ADR-0001` | The routing catalog is a pointer layer, never a second copy of an owner's procedure (CI-enforced) |
| `ADR-0002` | ops-warden is a transparent conduit, never a secret broker |
| `ADR-0003` | Cover gaps, but never silently own them |
| `ADR-0004` | High-risk lanes refuse raw value streaming to agent sessions |
| `ADR-0005` | Implement one lane narrowly, route everything else |
| `ADR-0006` | Superseded: enforcement is zone-scoped, never a global flag |
| `ADR-0007` | Build-stage permissiveness stops at credential disclosure; every lane carries an explicit `risk` grade |
| `ADR-0008` | A lane's risk grade covers every field its path discloses, not just the field it is named after |
| `ADR-0009` | Adopt security-zones v0.1 and compile explicit workload membership; PEP failure mode is per zone |
| `ADR-0010` | ops-warden is Staff — it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap, not an exemption |

Rules we follow but do not own — NetKingdom canon, the IAM profile, the
credential-management standard, the-custodian's ADR-001 workplan convention — are
cited, never copied here. Publishable through `policy-nexus`, which carries `owner`
into the published page and index.

---

## Core Idea

**Today:** implements the SSH certificate lane from `wiki/AccessManagementDirective.md`
§§1–5 — CA signing, actor inventory, TTL policy, cert-side scorecard, optional
flex-auth pre-sign gate, and the `cert_command` interface for ops-bridge. Production
path uses OpenBao SSH engine (`backend: vault`).

**Direction (INTENT):** issue short-lived SSH certificates and route dev workers to
key-cape, flex-auth, OpenBao, ops-bridge, and railiance components for everything
else — implementing only the SSH certificate lane directly, pointing at the owner
for the rest.

---

## In Scope

### Implemented (SSH lane)

- Local CA backend (`ssh-keygen -s`)
- OpenBao / Vault-compatible SSH engine backend (**production-verified**)
- Actor identity registry (`inventory.yaml`)
- `cert_command`: `warden sign <actor> --pubkey <path>` → cert on stdout
- TTL enforcement per `ActorType` (`adm` 48 h, `agt` 24 h, `atm` 8 h)
- `warden status`, cleanup, scorecard, signatures log
- Zone-aware flex-auth policy gate (`policy_decision_id`, zone, failure mode, and
  outcome in the signing audit; no repo-wide enable switch)
- Production flex-auth registry builder (`scripts/build_flex_auth_registry.py`,
  `registry/flex-auth/production_registry_snapshot.json`)
- Policy gate smoke runner (`scripts/policy_gate_production_smoke.sh`)
- `warden route` lookup CLI (`list`/`show`/`find`, `--json`) over the pointer catalog
- `warden access` operator front door (WP-0014): advisory handoff for any need, and a
  transparent, policy-gated, audited **proxy** (`--fetch`/`--exec`) for `exec_capable`
  lanes (OpenBao secret reads, key-cape login) — caller identity, value never held
- `warden issue` and `ops-ssh-wrapper` (local backend; vault uses sign-only)
- ops-bridge cert_command readiness gate (`scripts/check_tunnel_cert_readiness.py`,
  WP-0016) — read-only preflight + opt-in offline contract smoke
- Coordination worker (`warden worker`, WP-0020) — autonomous triage of ops-warden's
  State Hub inbox via llm-connect. **Conservative by default** (triage + drafted replies,
  sends nothing); `--full-auto` opt-in. Four guardrails (fixed charter, action allowlist,
  no-secret invariant, dry-run/audit) enforced regardless of the brain. **Scheduled**
  (WP-0021) via a `systemd --user` timer (`scripts/install-worker-timer.sh`); review loop
  `warden worker drafts | approve <id>` + `worker status`; one-command kill switch
  (`wiki/playbooks/scheduled-worker.md`)
- Runbooks for OpenBao config and Inter-Hub bootstrap SSH envelope
- **warden-sign token routing** (RAILIANCE-WP-0005 T08): catalog id
  `ops-warden-warden-sign-token` and playbook
  `wiki/playbooks/ops-warden-warden-sign-token.md` — routes `VAULT_TOKEN` needs to
  `railiance-platform/scripts/credential.py exec --grant ops-warden/warden-sign`
  (preferred over manual `export VAULT_TOKEN`); `warden sign` emits broker hint when
  token env is unset (WP-0023)
- **Unified audit trail** (WP-0022): append-only `audit.jsonl`, secret-material guard,
  instrumentation on sign/access/worker paths, `warden activity` CLI merging legacy
  logs + optional State Hub notes (`wiki/AuditTrail.md`)
- **Experiential memory** (WP-0024, `src/warden/memory.py`) — recorded outcomes feed
  routing and coordination; no secret values, guardrail allowlist unchanged
- **Disclosure hygiene** (WP-0026): `warden taint <catalog-id>` (KV `custom_metadata`,
  no data read), `warden rotate-guide`, safe fetch transports (`--out` / `--exec` /
  `--wrap`) with refusal to stream to non-terminal stdout, and the agent read-boundary
  on `risk: high` lanes (exit 7 when `WARDEN_AGENT_ID` is set)
- **Tenant secret custody** (WP-0028): tenant vs `platform/workloads/...` path
  convention, policy/CCR/catalog ownership, first lane `binky-company-email-imap`
- **Policy front door** (WP-0029): `warden plan "<need>" [--json]` returning
  `autonomous` / `founder_required` (typed act) / `unroutable` (CCR stub);
  `warden desk` loopback founder surface (approve, OIDC login, paste-once provision
  straight into OpenBao); `organization_posture: build` as posture axis C; catalog
  freshness reporting on `warden route list` and in plan JSON

### Stewardship (documentation and alignment)

- NetKingdom security routing guidance — which subsystem owns which credential type
- Wiki and config references aligned with OpenBao-first platform standard
- Capability registry entry for SSH certificate issuance
- Routing pointer catalog (`registry/routing/catalog.yaml`)
- Keeping ops access patterns consistent with `net-kingdom` platform architecture
- Workload Security Posture standard (`wiki/WorkloadSecurityPosture.md`),
  machine-readable posture descriptors (`registry/policy/security-posture.yaml`),
  the read-only conformance checker, and the dev-tier contract-double library

### Shipped workplans (archived)

| WP | Focus |
| --- | --- |
| WP-0001–0005 | Initial CLI, quality, hygiene, OpenBao docs, hub sync |
| WP-0006 | Credential routing, security map, inventory patterns, OpenBao checklist |
| WP-0007 | Original opt-in flex-auth policy gate (global switch retired by WP-0032) |
| WP-0008 | Production sign verification, stewardship closeout, archive hygiene |
| WP-0009 | flex-auth registry + policy smoke; pickup brief for FLEX-WP-0007 |
| WP-0010 | Access routing charter + pointer catalog |
| WP-0011 | `warden route` lookup CLI |
| WP-0012 | Routing scenario playbooks (catalog + wiki expansion) |
| WP-0013 | Production integration closeout — cert_command playbook, token hygiene, principals drift |
| WP-0014 | Operator access assist — `warden access` advisory + proxy front door |
| WP-0015 | Workload security posture — two-axis standard, descriptors, conformance checker, dev doubles |
| WP-0016 | ops-bridge cert_command pilot — readiness gate (`check_tunnel_cert_readiness.py`) + handoff |

### Recently shipped (July 2026)

| WP | Focus |
| --- | --- |
| WP-0017 | Access front-door discoverability |
| WP-0018 | `whynot-design-npm-publish` — first concrete secret lane (production-exercised) |
| WP-0019 | Route provisioned secret-exec lanes to secrets-engine (`exec_owner` pattern) |
| WP-0020 | Coordination worker (`warden worker`) |
| WP-0021 | Scheduled worker tick (systemd --user timer, kill switch) |
| WP-0022 | Unified audit trail + `warden activity` |
| WP-0023 | INTENT–SCOPE alignment closeout |
| WP-0024 | Experiential memory across worker/agent sessions (`src/warden/memory.py`) |
| WP-0025 | Forgejo admin PAT OpenBao lane (CCR-2026-0006) |
| WP-0026 | Credential disclosure hygiene — `warden taint`, `warden rotate-guide`, agent read-boundary, safe fetch transports |
| WP-0028 | Tenant secret custody pattern — tenant vs platform paths; first lane binky company email IMAP |
| WP-0029 | Policy front door — `warden plan`, `warden desk`, `organization_posture: build` third axis |

### Open ops-warden work

| WP | Status | Focus |
| --- | --- | --- |
| WP-0027 | `active` | Break-glass design/rehearsal activated narrowly on T02; mass rotation and policy-manifest reconcile remain deferred |
| WP-0032 | `finished` | Security zones adopted — global switch retired, explicit workload references compiled, and owner policy live |
| WP-0030 | `proposed` | Delegation register — record intended owner + blocker on every interim lane, `warden route gaps`, promotion gate |

Remaining production distance is also in other repos' lanes (see Known gaps).

### Known gaps (not ops-warden workplans)

| Gap | Owner | Notes |
| --- | --- | --- |
| ops-bridge `cert_command` on live tunnels | ops-bridge | Playbook + readiness gate shipped (WP-0016); pilot cutover handed off, awaiting ops-bridge |
| Principals sync warden ↔ railiance-infra | ops-warden + infra | `scripts/check_principals_drift.py` — operator runs periodically |
| NK-WP-0009 joint SSH tutorial | net-kingdom | Parallel coordination track |
| WP-0015 canon landing (generic `WorkloadMaturityLevel` + M0-M3 requirements) | net-kingdom + info-tech-canon | ops-warden drafted + offered (coordination msgs); owner-driven landing |
| Owner front doors for workload secret lanes | secrets-engine | 6 lanes proxied by ops-warden that `secrets-engine exec` could front, as WP-0019 did for npm publish |
| Owner front door for tenant secret lanes | tenant-engine | WP-0028 defined the custody pattern; 3 tenant lanes still fronted by ops-warden proxy |

---

## Out of Scope

- **Issuing or custodying** non-SSH secrets (API keys, DB creds, OpenBao tokens,
  S3 STS, Inter-Hub keys) → OpenBao / railiance-platform credential broker /
  secrets-engine with flex-auth policy where required; ops-warden documents paths,
  routes to owner-native exec front doors, and may proxy caller-authenticated
  `exec_capable` lanes only
- Identity / OIDC / MFA → key-cape, Keycloak
- Authorization policy decisions → flex-auth
- flex-auth runtime deployment and secret-flow lattice enforcement → flex-auth
  (`FLEX-WP-0007` and follow-ups)
- Tunnel lifecycle → `ops-bridge`
- Host principal deployment → `railiance-infra`
- OpenBao / Vault cluster deployment → `railiance-platform`
- Human admin SSH key generation (self-service `ssh-keygen`)
- Session recording, SIEM, SSO / Teleport at scale
- **Permanently owning another component's lane.** Covering an unfilled gap is in
  scope and expected; keeping it once secrets-engine / tenant-engine / user-engine
  can front it — or holding it without recording that it is interim — is not (INTENT §9)

---

## Relevant When

- Issuing or refreshing an **SSH cert** for `adm`/`agt`/`atm`
- A worker needs a **scoped `VAULT_TOKEN`** for production `warden sign` or the
  flex-auth policy-gate smoke — route to `ops-warden-warden-sign-token`, then run
  `credential exec` in `railiance-platform` (no manual token paste)
- A dev worker needs to know **where to get credentials** in the NetKingdom stack
- An agent needs **`warden route find`** instead of re-deriving routing from wiki prose
- `ops-bridge` needs a `cert_command` for a tunnel
- Adding actors to the principals inventory (regenerate flex-auth registry snapshot)
- Inter-Hub or bootstrap tasks need a **short-lived agent SSH envelope**
- Checking cert-side compliance (scorecard)
- Enabling or testing the opt-in flex-auth policy gate
- Classifying whether a credential blocker is a dev/test double, owner-routed prod
  gate, or maturity/posture violation

---

## Not Relevant When

- Storing or vending **API keys, OpenBao tokens, or runtime secrets** (→ OpenBao /
  railiance-platform broker / secrets-engine)
- Policy decisions on resource access (→ flex-auth)
- Managing tunnels without SSH cert issuance (→ ops-bridge)
- Static-key-only legacy access (ops-bridge static key mode)

---

## Current State

- **SSH CLI:** v0.1.0 — local + OpenBao backends
- **Production sign:** verified 2026-06-18 (`history/2026-06-17-openbao-production-verify.md`)
- **Access routing:** WP-0010 + WP-0011 shipped (`warden route`, pointer catalog)
- **Policy gate:** caller shipped (WP-0007); registry + smoke complete (WP-0009 archived).
  WP-0031 shipped the calling identity and flex-auth's pin now runs
  `callerAuth.mode: enforce` (FLEX-WP-0016) — the gate is **ready and verified**
  (`decision:f3f7c88f9585582a`, anonymous `/v1/check` -> 401). WP-0032 and
  `ADR-0009` retired the global switch: the compiled target workload selects the
  zone, flex-auth owns stance, and ops-warden applies the zone's PEP failure mode.
  Re-check caller identity with `scripts/check_policy_caller_identity.py`.
- **Workload posture:** WP-0015 shipped (standard, descriptors, `warden policy`,
  conformance checker, dev doubles); canon landing owner-driven
- **ops-bridge cert_command:** WP-0016 shipped to pilot-ready (readiness gate +
  offline contract smoke + handoff); live cutover is ops-bridge's
- **Access front door:** WP-0017 discoverability + WP-0018 first concrete secret lane
  (`whynot-design-npm-publish`), **production-exercised** — whynot-design published
  `@whynot/design@0.4.0` through the conduit. WP-0019 routes provisioned secret-exec
  lanes to **secrets-engine** (`secrets-engine exec`), proxy as transparent fallback
- **warden-sign broker routing:** catalog `ops-warden-warden-sign-token` +
  `wiki/playbooks/ops-warden-warden-sign-token.md` (RAILIANCE-WP-0005 T08) — live
  `make credential-exec-ops-warden-smoke` proven 2026-07-01; manual `export VAULT_TOKEN`
  documented as fallback only
- **Audit + activity:** WP-0022 shipped — `warden activity`, `wiki/AuditTrail.md`
- **INTENT closeout:** WP-0023 shipped — INTENT refresh, production flip/cutover
  checklists, catalog promotion cadence, broker hint on missing `VAULT_TOKEN`
- **Disclosure hygiene:** WP-0026 shipped — `warden taint`, `warden rotate-guide`,
  safe fetch transports (`--out`/`--exec`/`--wrap`), agent read-boundary on `risk: high`
  lanes (`wiki/playbooks/agent-read-boundary.md`)
- **Tenant custody:** WP-0028 shipped — tenant vs platform path convention; first lane
  `binky-company-email-imap`. Front door is still an ops-warden proxy (tenant-engine gap)
- **Policy front door:** WP-0029 shipped — `warden plan "<need>"` (autonomous /
  founder_required / unroutable), `warden desk` founder interaction surface, declared
  `organization_posture: build` as a third posture axis, catalog freshness reporting
- **Delegation:** 27 catalog lanes carry `delegation:` (WP-0030). SSH is
  `permanent`; owner-fronted lanes are `native`; interim proxies name
  `intended_owner` + `blocked_on`. Query: `warden route gaps`.
- **Active work:** WP-0027 (`backlog`); remaining production distance is other
  repos' lanes (and retiring interim covers as those owners ship front doors)
- **Integration docs:** cert_command migration, token hygiene (broker-first), principals
  drift (`wiki/playbooks/`)
- **Latest assessment:** `history/2026-08-11-delegation-surface-assessment.md`
- **Latest workplans:** WP-0029 (policy front door) shipped July 2026; WP-0030
  (delegation register) shipped August 2026

---

## How It Fits (NetKingdom)

```text
key-cape / Keycloak     identity claims
        → flex-auth     authorization decisions
        → OpenBao       runtime secrets & dynamic credentials
        → ops-warden    SSH certs + operational access guidance
        → ops-bridge    tunnel transport (cert_command consumer)
        → railiance-*   deployment and host enforcement
```

Upstream: OpenBao SSH engine (production) or local CA (labs). Actor inventory in
operator config or Git-tracked patterns. flex-auth registry snapshot derived from
inventory when policy gate is enabled.

Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operators.

---

## Terminology

- `ActorType`: `adm` | `agt` | `atm`
- `cert_command`: shell command returning a cert on stdout
- `inventory.yaml`: actor → principals + TTL registry
- `LocalCA` / `VaultCA`: signing backends (`backend: local` | `vault`)
- Pointer catalog: `registry/routing/catalog.yaml` — subsystem ownership lookup plus
  secret-free `warden access` handoff metadata
- Workload Security Posture: env posture (`dev/test/prod`) plus maturity (`M0-M3`)
  used to decide whether a secret may flow to a workload

---

## Related Repositories

| Repo | Relationship |
| --- | --- |
| `gate-house` | Owns security doctrine, invariants, authority context, and conformance review; ops-warden routes doctrine questions there and references rather than restates them (`ADR-0010`) |
| `net-kingdom` | Canonical security architecture; ops-warden aligns to it |
| `ops-bridge` | Primary cert_command consumer |
| `railiance-infra` | Host-side SSH principals and hardening |
| `railiance-platform` | OpenBao deployment and platform secrets |
| `flex-auth` | Authorization — ruled name `access-engine`; the only policy decision point. Policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
| `key-cape` | Identity / IAM Profile lightweight mode |
| `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) and holds 6 more as interim proxies pending its front doors |
| `tenant-engine` | Intended owner of tenant/client secret front doors; ops-warden holds 3 tenant lanes as interim proxies (WP-0028 pattern, WP-0030 register) |
| `user-engine` | End-user identity/account lifecycle; no ops-warden lane today — route rather than absorb |
| `zone-engine` | Owns the security zone model and exception lifecycle (`ADR-0006`); ops-warden is its first consumer |
| `state-hub` | Workplan registry |

---

## Provided Capabilities

```capability
type: security
title: SSH certificate issuance
description: Issues short-lived CA-signed SSH certificates for adm/agt/atm actors via a
  pluggable cert_command interface; documents NetKingdom operational access routing;
  supports local CA and OpenBao/Vault-compatible SSH engine backends.
keywords: [ssh, certificate, ca, credential, warden, ops-warden, pki, openbao, vault, netkingdom]
```

```capability
type: security
title: Operator access front door (caller-identity fetch proxy)
description: warden access is the operator front door for any NetKingdom credential need.
  It renders the owner, auth method, path, and policy status, and for exec_capable lanes
  (OpenBao secret reads, key-cape OIDC login) proxies the fetch as the caller — running
  the owner's tool with the caller's identity and streaming the value to them. For
  owner-native lanes (secrets-engine exec, railiance-platform credential broker) it routes
  to the owner's front door instead of proxying. ops-warden takes no custody — transparent
  conduit, not a broker. Use this to discover how to obtain an API key, DB credential,
  npm token, warden-sign lease, or login — not a State Hub message.
keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, login, proxy, fetch, exec, warden-access, front-door, routing, warden-sign, vault_token, credential-broker]
```

---

## Getting Oriented

| Read first | Purpose |
| --- | --- |
| `INTENT.md` | Why ops-warden exists and where it is going |
| `SCOPE.md` | What is implemented today (this file) |
| `docs/adr/README.md` | **The rules ops-warden owns** — and how to tell ours from inherited canon |
| `wiki/AccessRouting.md` | What ops-warden issues vs routes vs assists (role and boundary) |
| `wiki/OperatorAccessAssist.md` | `warden access` front door + conduit-vs-broker boundary + guardrails |
| `wiki/CredentialRouting.md` | Which subsystem for each credential need |
| `wiki/WorkloadSecurityPosture.md` | Secret-store posture, workload maturity, and blocker triage |
| `registry/routing/catalog.yaml` | Machine-readable routing pointer catalog |
| `tenancy.yaml` | Declared tenancy posture (`I1 A1 E0 P n/a R n/a V0`) and why each axis sits where it does |
| `wiki/NetKingdomSecurityMap.md` | Platform security component map |
| `examples/warden.production.example.yaml` | Production warden.yaml template |
| `wiki/PolicyGatedSigning.md` | flex-auth opt-in gate + registry rollout |
| `wiki/AccessManagementDirective.md` | SSH actor model |
| `wiki/OpsWardenConfig.md` | warden.yaml and OpenBao |
| `wiki/playbooks/ops-warden-warden-sign-token.md` | Scoped `VAULT_TOKEN` via credential broker (preferred path) |
| `wiki/playbooks/operator-openbao-token-hygiene.md` | Manual token fallback and hygiene rules |
| `wiki/AuditTrail.md` | Unified metadata-only audit + `warden activity` |
| `wiki/playbooks/catalog-lane-promotion.md` | draft → active catalog promotion checklist |
| `wiki/CertCommandInterface.md` | cert_command contract |
| `history/2026-08-11-delegation-surface-assessment.md` | Current assessment — where ops-warden covers gaps and who should own them |
| `workplans/WARDEN-WP-0030-delegation-register.md` | Delegation register plan (proposed) |
| `history/2026-07-01-intent-scope-gap-analysis.md` | Prior INTENT↔SCOPE gap analysis |
| `workplans/WARDEN-WP-0023-intent-scope-alignment-closeout.md` | Alignment closeout plan |
| `history/2026-06-24-intent-scope-gap-analysis.md` | Prior gap analysis |
| `history/2026-06-27-workload-security-posture-charter.md` | WP-0015 posture/conformance charter |
| `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` | SSH lane gap analysis |
| `history/2026-06-18-access-routing-intent-shift-assessment.md` | Routing charter decision |
| `history/2026-06-23-flex-auth-policy-gate-production-smoke.md` | Policy gate smoke evidence |
| `net-kingdom/docs/platform-identity-security-architecture.md` | Platform security canon |