# ops-warden routing catalog — POINTER LAYER # # This file is a machine-readable index of NetKingdom credential needs. It tells a # worker WHICH subsystem owns a need and WHERE the authoritative doc is. It is NOT # a second copy of any subsystem's procedure. # # No-double-source rule (binding — see workplans/WARDEN-WP-0010-access-routing-charter.md): # - For any subsystem ops-warden does not own, an entry carries identifiers + # pointers ONLY: owner_repo, subsystem, wiki_ref, canon_ref, need_keywords. # - Authored procedure (a `steps:` block and `cert_command:`) is allowed ONLY on # entries with `warden_executes: true` — i.e. the SSH certificate lane, the one # lane ops-warden owns. # - A CI/test (WARDEN-WP-0011 T5) FAILS any non-SSH entry that carries a `steps` # block, and checks that every `wiki_ref` anchor resolves to a real section. # - No secret material in this file, ever. # # Field reference: # id kebab-case stable identifier (lookup key) # title human-readable need # need_keywords tokens for `warden route find` keyword matching # owner_repo repo/subsystem that owns the procedure # subsystem platform component a worker acts on # warden_executes true only for the SSH lane; false everywhere else # wiki_ref anchor into an in-repo wiki section (authoritative restatement) # canon_ref upstream net-kingdom doc the wiki section tracks # reviewed date this pointer was last checked against canon (YYYY-MM-DD) # status active (surfaced by default) | draft (hidden unless --all) # steps ONLY when warden_executes: true # cert_command ONLY when warden_executes: true version: 1 entries: - id: ssh-cert-host-access title: Short-lived SSH certificate for host / ops reachability need_keywords: [ssh, certificate, cert, host, access, sign, adm, agt, atm, reachability, ops] owner_repo: ops-warden subsystem: ops-warden warden_executes: true wiki_ref: wiki/AccessRouting.md#issue-vs-route canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path reviewed: "2026-06-18" status: active cert_command: "warden sign --pubkey " steps: - "Confirm the actor is in inventory (`warden inventory list`); add with `warden inventory add` if not — see wiki/ActorInventoryPatterns.md." - "Confirm the backend is configured (`warden status`) — local CA for labs, vault for production." - "Sign: `warden sign --pubkey ` — cert is written to stdout (the cert_command contract)." - "TTL is enforced per actor type: adm 48h / agt 24h / atm 8h. No long-lived keys." - id: ops-warden-warden-sign-token title: Scoped OpenBao token for ops-warden SSH signing (warden-sign) need_keywords: [vault_token, vault, token, warden-sign, warden, ops-warden, signing, sign, smoke, flex-auth, credential, broker, lease, openbao, ssh, production] owner_repo: railiance-platform subsystem: OpenBao credential broker warden_executes: false wiki_ref: wiki/playbooks/ops-warden-warden-sign-token.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-07-01" status: active # Concrete broker lane — RAILIANCE-WP-0005 pilot (live 2026-07-01): # credential exec injects VAULT_TOKEN only into the child process; ops-warden # issues SSH certs and never mints or holds OpenBao tokens. auth_method: "railiance-platform credential broker (issuer via OPENBAO_TOKEN_FILE for apply; child tokens via grant)" path_template: "credential-grants/catalog.yaml grant ops-warden/warden-sign" fetch_command: "scripts/credential.py request --grant ops-warden/warden-sign --purpose ops-warden-sign --ttl 15m" policy_ref: "flex-auth optional preflight per grant catalog" exec_owner: railiance-platform exec_command: "scripts/credential.py exec --grant ops-warden/warden-sign --ttl 15m -- " pointer_command: "make credential-exec-ops-warden-smoke" rotation: method: rotate owner: railiance-platform automatable: true steps: - "This lane vends a short-lived (15m) child VAULT_TOKEN — routine renewal is just re-running `credential.py exec`; the token auto-expires, nothing to revoke." - "To rotate the underlying grant/issuer: railiance-platform edits `credential-grants/catalog.yaml` for `ops-warden/warden-sign` (scope/policy) and re-mints the issuer token behind OPENBAO_TOKEN_FILE." - "Verify capabilities-safe: `make credential-exec-ops-warden-smoke` and a `bao token capabilities` check on ssh/sign/{adm,agt,atm}-role (never read a value)." - id: openbao-api-key title: API key, DB credential, or dynamic lease need_keywords: [api, key, secret, database, db, password, token, lease, openbao, vault, kv, dynamic, credential, npm, npm_auth_token, registry] owner_repo: railiance-platform subsystem: OpenBao warden_executes: false wiki_ref: wiki/CredentialRouting.md#routing-table canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-06-27" status: active # Structured handoff (WP-0014) — reference example. Templates only, no values. # ops-warden does not own this secret; it advises and (exec_capable) proxies the # fetch *as the caller* via `warden access`, never holding or persisting the value. auth_method: "key-cape OIDC → bao login -method=oidc role=" path_template: "platform/workloads///" fetch_command: "bao kv get -field= " policy_ref: "flex-auth check secret.read:" exec_capable: true rotation: method: rotate owner: railiance-platform automatable: false steps: - "Generic template lane — rotate per the concrete workload's own catalog entry when one exists." - "Provider re-mint (or OpenBao dynamic-secret rotation): mint a fresh value at the source, then `bao kv put =@file` (value from a mode-0600 file, never on argv)." - "For dynamic-lease secrets, revoke the old lease (`bao lease revoke`) instead of a KV put." - "Verify capabilities-safe (`bao token capabilities` on the data path); notify consumers to re-fetch." - id: whynot-design-npm-publish title: whynot-design npm publish token (@whynot/design → coulomb Gitea registry) need_keywords: [whynot-design, whynot, npm, publish, npm_auth_token, gitea, registry, coulomb, package] owner_repo: railiance-platform subsystem: OpenBao warden_executes: false wiki_ref: wiki/playbooks/whynot-design-npm-publish.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-06-29" status: active # Concrete, owner-confirmed lane — railiance-platform CCR-2026-0001 (commit 8f617fc): # status=active, access_frontdoor.readiness=ready, resolvable=true; positive fetch # passed and negative (non-whynot) login denied. Zero-placeholder fetch: an automated # caller can `warden access whynot-design-npm-publish --exec -- npm publish` directly. # The path was corrected to the `coulomb` tenant — the whynot-design/whynot-design/… # form is superseded; do not reintroduce it. auth_method: "bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read" path_template: "platform/workloads/coulomb/whynot-design/npm-publish" fetch_command: "bao kv get -field=NPM_AUTH_TOKEN platform/workloads/coulomb/whynot-design/npm-publish" policy_ref: "flex-auth check secret.read:whynot-design" exec_capable: true lane: secret # Owner-native exec front door (WP-0019, secrets-engine SECRETS-WP-0003, decision # e6381a56): route-primary, proxy-fallback. The secrets-engine exec is the primary # path; warden access --fetch/--exec remains a transparent fallback. exec_owner: secrets-engine exec_command: "secrets-engine exec --catalog whynot-design-npm-publish -- " pointer_command: "secrets-engine route whynot-design-npm-publish --json" rotation: method: rotate owner: railiance-platform automatable: false steps: - "In the coulomb Gitea/Forgejo registry, revoke the current @whynot/design publish token and generate a new one (scope: package read/write) for the whynot-design publish identity." - "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish NPM_AUTH_TOKEN=@file` (value from a mode-0600 file)." - "Verify capabilities-safe, then confirm publish works via `secrets-engine exec --catalog whynot-design-npm-publish -- npm whoami` (value used, not printed)." - id: flex-auth-policy-check title: Authorization decision — may this actor perform this action need_keywords: [authorization, policy, permission, allow, deny, may, flex-auth, topaz, pdp, decision] owner_repo: flex-auth subsystem: flex-auth warden_executes: false wiki_ref: wiki/CredentialRouting.md#quick-decision-tree canon_ref: net-kingdom/docs/responsibility-map.md reviewed: "2026-06-18" status: active - id: key-cape-oidc-login title: Interactive login, OIDC token, or MFA need_keywords: [login, oidc, identity, mfa, token, jwt, sso, keycloak, key-cape, iam, claims, authenticate, signin] owner_repo: key-cape subsystem: key-cape / Keycloak warden_executes: false wiki_ref: wiki/CredentialRouting.md#quick-decision-tree canon_ref: net-kingdom/docs/canon/standards/iam-profile_v0.2.md reviewed: "2026-06-27" status: active # Login lane (WP-0014 T4) — interactive auth bootstrap, not a secret read. No # secret-read gate (you have no identity yet) and no caller-auth precheck (the # point is to obtain one). warden runs it interactively as the caller and never # captures the resulting token — the owner tool writes it to the caller's store. lane: login auth_method: "browser OIDC via key-cape / Keycloak" fetch_command: "bao login -method=oidc role=" exec_capable: true - id: ops-bridge-tunnel title: SSH tunnel or port forward need_keywords: [tunnel, port, forward, bridge, ops-bridge, reverse, transport, ssh-tunnel, cert_command] owner_repo: ops-bridge subsystem: ops-bridge warden_executes: false wiki_ref: wiki/playbooks/ops-bridge-tunnel-cert.md#migration-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path reviewed: "2026-06-24" status: active - id: railiance-infra-principals title: Host SSH principal file or force-command deployment need_keywords: [principal, auth_principals, force-command, host, sshd, hardening, railiance-infra, ansible] owner_repo: railiance-infra subsystem: railiance-infra warden_executes: false wiki_ref: wiki/CredentialRouting.md#routing-table canon_ref: net-kingdom/docs/responsibility-map.md reviewed: "2026-06-18" status: active - id: inter-hub-bootstrap-ssh title: Inter-Hub bootstrap SSH envelope need_keywords: [inter-hub, interhub, bootstrap, ops-hub, agt-interhub-bootstrap, envelope, force-command, CUST-WP-0049] owner_repo: ops-warden subsystem: ops-warden + railiance-infra warden_executes: false wiki_ref: wiki/InterHubBootstrapAccessLane.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md#operational-ssh-path reviewed: "2026-06-24" status: active - id: activity-core-issue-sink title: activity-core IssueSink → issue-core REST emission need_keywords: [activity-core, issue-sink, issue-core, emission, issue_core_url, issue_core_api_key, tasks, ingest, rest, issuesink] owner_repo: activity-core subsystem: activity-core + issue-core warden_executes: false wiki_ref: wiki/playbooks/activity-core-issue-sink.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-06-18" status: active - id: issue-core-ingestion-api-key title: issue-core ingestion API key (OpenBao KV + ESO) need_keywords: [issue-core, ingestion, api, key, openbao, issue_core_api_key, eso, external-secrets] owner_repo: railiance-platform subsystem: OpenBao + issue-core + activity-core warden_executes: false wiki_ref: wiki/playbooks/issue-core-ingestion-api-key.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-07-02" status: active # Concrete, owner-confirmed lane — railiance-platform CCR-2026-0002 / RAILIANCE-WP-0009 # (promoted 2026-07-02): policy workload-kv-read-issue-core-runtime and k8s auth role # external-secrets-issue-core applied; ExternalSecret issue-core/issue-core-runtime # SecretSynced; positive + negative access verified with OpenBao audit evidence. # Production consumer is ESO; warden access proxies reads as the caller (caller's own # OpenBao authority) and never holds the value. auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-issue-core-runtime)" path_template: "platform/workloads/issue-core/issue-core/issue-core-runtime" fetch_command: "bao kv get -field=ISSUE_CORE_API_KEY platform/workloads/issue-core/issue-core/issue-core-runtime" policy_ref: "flex-auth check secret.read:issue-core" exec_capable: true lane: secret rotation: method: rotate owner: railiance-platform automatable: false steps: - "Mint a new issue-core ingestion API key at the issue-core admin surface; keep the old one until consumers cut over." - "`bao kv put platform/workloads/issue-core/issue-core/issue-core-runtime ISSUE_CORE_API_KEY=@file` (value from a mode-0600 file)." - "ESO re-syncs ExternalSecret issue-core/issue-core-runtime; roll consumers, then revoke the old key at the source." - "Verify capabilities-safe on the data path (`bao token capabilities`); never read the value to confirm." - id: reuse-surface-hub-write-token title: reuse-surface federation hub write bearer token need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, reuse.coulomb.social] owner_repo: railiance-platform subsystem: OpenBao + reuse-surface warden_executes: false wiki_ref: wiki/playbooks/reuse-surface-hub-write-token.md#worker-checklist canon_ref: reuse-surface/specs/FederationHubAPI.md reviewed: "2026-07-07" status: active # Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011 # (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret # reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01; # positive + negative access verified. Production consumer is ESO; warden access # proxies reads as the caller and never holds the value. auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)" path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets" fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets" policy_ref: "flex-auth check secret.read:reuse" exec_capable: true resolvable: true lane: secret rotation: method: rotate owner: railiance-platform automatable: false steps: - "Generate a new reuse-surface federation hub write bearer token at reuse.coulomb.social; if the Forgejo webhook secret rotates too, regenerate REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET alongside it." - "`bao kv put platform/workloads/reuse/reuse-surface/runtime-secrets REUSE_SURFACE_TOKEN=@file` (and the webhook field if changed)." - "ESO re-syncs reuse/reuse-surface-runtime → reuse-surface-env on Railiance01; roll the consumer; update the Forgejo webhook config if the secret changed; revoke the old token." - "Verify capabilities-safe on the data path (`bao token capabilities`)." - id: openrouter-llm-connect title: OpenRouter API key for llm-connect in activity-core need_keywords: [openrouter, llm, llm-connect, api, key, activity-core, gemini, provider, openrouter_api_key] owner_repo: railiance-platform subsystem: OpenBao + activity-core warden_executes: false wiki_ref: wiki/playbooks/openrouter-llm-connect.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-07-02" status: active # High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04). risk: high # Concrete, owner-confirmed lane — railiance-platform CCR-2026-0003 / RAILIANCE-WP-0010 # (promoted 2026-07-02): policy workload-kv-read-llm-connect-provider-secrets and k8s # auth role external-secrets-activity-core applied; ExternalSecret # activity-core/llm-connect-provider-secrets SecretSynced and llm-connect rolled out on # the OpenBao-delivered value; positive + negative access verified with audit evidence. # Production consumer is ESO; warden access proxies reads as the caller and never holds # the provider key. auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-llm-connect-provider-secrets)" path_template: "platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets" fetch_command: "bao kv get -field=OPENROUTER_API_KEY platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets" policy_ref: "flex-auth check secret.read:llm-connect" exec_capable: true lane: secret rotation: method: rotate owner: railiance-platform automatable: false steps: - "Create a new key in the OpenRouter dashboard for the llm-connect identity; keep the old key active until rollout completes." - "`bao kv put platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets OPENROUTER_API_KEY=@file` (value from a mode-0600 file)." - "ESO re-syncs activity-core/llm-connect-provider-secrets; roll out llm-connect on the new value; then delete the old OpenRouter key." - "Verify capabilities-safe on the data path (`bao token capabilities`)." - id: railiance-backup-offsite-lane title: Railiance offsite backup Nextcloud WebDAV credentials need_keywords: [railiance, backup, nextcloud, webdav, offsite, age, forgejo-backup, NC_WEBDAV_TOKEN, file drop] owner_repo: railiance-platform subsystem: OpenBao + Nextcloud warden_executes: false wiki_ref: wiki/playbooks/railiance-backup-offsite-lane.md#worker-checklist canon_ref: railiance-platform/docs/workload-kv-access-lanes.md reviewed: "2026-07-16" status: active # High-risk: WebDAV upload token + AGE recovery escrow (WP-0026 T04). risk: high # CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07. # Capabilities-safe re-verify 2026-07-16 (WP-0026 T07): lane-policy token # capabilities=read on data path; default-policy and agent-high-risk-boundary = deny; # field keys present (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY) via metadata # lengths only — no value read. Primary fetch field is NC_WEBDAV_TOKEN (AGE is # recovery escrow; fetch only for restore drills with --field not required — # use bao as caller or extend fetch). EXPOSED taint set on version 2 (T05). auth_method: "caller's own OpenBao token (OIDC netkingdom role railiance-backup-workload-kv-read)" path_template: "platform/workloads/railiance/backup/offsite-lane" fetch_command: "bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane" exec_capable: true lane: secret # Mixed lane: NC_WEBDAV_TOKEN rotates (provider re-mint); AGE_PRIVATE_KEY # re-establishes (new keypair + re-encrypt existing artifacts). Method reflects # the more involved re-establish path. Marked exposed 2026-07-16 (see # history/2026-07-16-credential-disclosure-lessons.md); rotation is the operator's # optional call (buildup), not a blocker for promotion. rotation: method: re-establish owner: railiance-platform automatable: false steps: - "Rotate NC_WEBDAV_TOKEN: regenerate the Nextcloud WebDAV app password/token; `bao kv put platform/workloads/railiance/backup/offsite-lane NC_WEBDAV_TOKEN=@file`. NC_WEBDAV_URL changes only if the host/share moves." - "Re-establish AGE_PRIVATE_KEY: generate a new keypair (`age-keygen`), decrypt existing offsite artifacts with the old key and re-encrypt to the new recipient, then `bao kv put ... AGE_PRIVATE_KEY=@file` (mode-0600 file, shred after)." - "Because AGE_PRIVATE_KEY is recovery escrow, retain the old key offline until re-encryption of all retained backups is confirmed." - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact." - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)." - id: forgejo-admin-api-token title: Forgejo operator/admin API token (PAT) need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, forgejo-npm] owner_repo: railiance-platform subsystem: OpenBao + Forgejo warden_executes: false wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist canon_ref: railiance-platform/docs/workload-kv-access-lanes.md reviewed: "2026-07-13" status: active # High-risk: site-admin PAT (WP-0026 T04). risk: high # CCR-2026-0006: approved by platform-operator 2026-07-12; policy # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at # platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented # fetch_command returns non-empty, PAT valid against forgejo.coulomb.social # (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial # recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is # workstation/worker OIDC fetch only, no cluster ExternalSecret. auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)" path_template: "platform/workloads/forgejo/forgejo-admin" fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin" exec_capable: true lane: secret rotation: method: rotate owner: railiance-platform automatable: false steps: - "As Forgejo user tegwick (site admin): Settings → Applications → generate a new token with the current scopes (read/write:package, read/write:repository, plus admin scopes for operator-bootstrap); keep the old token until cutover." - "Store via the provisioning helper: `~/railiance-platform/scripts/forgejo-admin-pat-provision.sh ` writes field API_TOKEN to platform/workloads/forgejo/forgejo-admin; shred the input file." - "Confirm the new PAT works (fetch --field API_TOKEN into env, call /api/v1/user — never print it), then delete the old token in Forgejo." - "Verify capabilities-safe on the data path (`bao token capabilities`); notify consumers (package-prune, operator-bootstrap, npm-smoke, reuse-webhook) to re-fetch." # --- tenant commercial secrets (mount tenants/; WARDEN-WP-0028) --- - id: binky-company-email-imap title: Binky company email IMAP credentials need_keywords: [binky, company, email, imap, mailbox, binky-hedgehog, mail, company-email] owner_repo: railiance-platform subsystem: OpenBao + email-connect warden_executes: false wiki_ref: wiki/playbooks/binky-company-email-imap.md#worker-checklist canon_ref: railiance-platform/docs/workload-kv-access-lanes.md reviewed: "2026-07-17" status: active risk: high # CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned # values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17: # lane-policy read; default deny. Host: imap.ionos.de:993 (binky-control config). auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-company-email-imap-workload-kv-read)" path_template: "tenants/binky/company-email/imap" fetch_command: "bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap" exec_capable: true lane: secret rotation: method: rotate owner: binky-control automatable: false steps: - "At the mail provider, revoke the old app password / mailbox password and mint a new one (do not paste it into chat or Git)." - "`bao kv put tenants/binky/company-email/imap IMAP_PASSWORD=@file` (and IMAP_USERNAME=@file if the login changed); shred the mode-0600 input file(s)." - "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/." - "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation." # --- draft: owner path not yet shipped; hidden from default lookup --- - id: object-storage-sts title: Object-storage STS / temporary S3 credentials need_keywords: [s3, sts, object-storage, minio, artifact-store, temporary, credentials, bucket, vending] owner_repo: net-kingdom subsystem: flex-auth + OpenBao + artifact-store warden_executes: false wiki_ref: wiki/playbooks/object-storage-sts.md#worker-checklist canon_ref: net-kingdom/docs/object-storage-sts-credential-vending.md reviewed: "2026-06-24" status: draft - id: database-dynamic-credentials title: Database dynamic credentials (OpenBao secrets engine) need_keywords: [database, db, postgres, cnpg, dynamic, credentials, password, lease, openbao] owner_repo: railiance-platform subsystem: OpenBao warden_executes: false wiki_ref: wiki/playbooks/database-dynamic-credentials.md#worker-checklist canon_ref: net-kingdom/docs/platform-identity-security-architecture.md reviewed: "2026-06-24" status: draft