coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/.claude/rules/credential-routing.md
tegwick 5149946a4c
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
WARDEN-WP-0029: implement plan front door, org posture, desk, freshness 
Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.
2026-07-18 16:59:37 +02:00

4.5 KiB
Raw Permalink Blame History

Credential and access routing

Audience: Codex, Claude Code, Grok, and custodian agents that call llm-connect for inference. Run this check before requesting secrets, API keys, SSH access, login tokens, or database passwords — in any repo, not only ops-warden.

ops-warden issues SSH certificates only (warden sign, cert_command). Every other credential need belongs to another subsystem. Do not message ops-warden on State Hub expecting a secret value; the reply is a pointer, not a key.

Lookup (do this first)

Always plan before drafting any founder credential step (WARDEN-WP-0029):

warden plan "<describe your need>" --json
# verdict: autonomous | founder_required | unroutable

warden route find "<describe your need>" --json
warden route show <catalog-id> --json

Requires the warden CLI from ~/ops-warden (uv tool install . or uv run warden). If a known lane is missing, reinstall from checkout (stale bundled catalog).

Agent runtime How to orient
Codex / Grok (shell, HTTP State Hub) warden plan first; inbox to_agent=ops-warden is for coordination, not secret vending
Claude Code (MCP when available) get_domain_summary("custodian") for workplans; still use warden plan / warden route for credential ownership
llm-connect (inference service) Never put secret retrieval in prompts; route custody via warden plan

Quick routing table

I need… Owner ops-warden executes?
SSH cert (adm/agt/atm) ops-warden Yes — warden sign
API key, DB password, provider token OpenBao (railiance-platform) No — route only
Login / OIDC / MFA key-cape / Keycloak No — route only
Authorization decision flex-auth No — route only
activity-core → issue-core emission activity-core + issue-core No — warden route show activity-core-issue-sink
SSH tunnel ops-bridge (+ cert_command from warden) No — route only

Anti-patterns (do not do these)

  • Drafting founder steps ("paste PAT to /tmp", "click admin UI") without warden plan
  • POST /messages/ to ops-warden asking for ISSUE_CORE_API_KEY, OPENROUTER_API_KEY, etc.
  • Inventing warden secret, warden login, warden bao, warden tunnel — they do not exist
  • Pasting secrets into Git, State Hub, workplans, logs, or chat
  • Steady-state file drops of credentials under /tmp (use warden desk paste-once or warden access --out/--exec/--wrap)
  • Reading a secret value onto a captured stdout. bao kv get <path> (full table) or bao kv get -field=X piped/redirected/run in an agent session dumps the value into a logged context — the 2026-07-16 disclosure. To verify a lane use bao token capabilities (allow/deny), never a read (WP-0026 T01).

Safe fetch transports (WP-0026 T02)

When a value must actually move, use a sanctioned transport that keeps it off stdout. warden access <need> --fetch refuses to stream a value to a non-terminal stdout unless you pass --unsafe-stdout (interactive human sessions only):

Transport Command Result
File warden access <need> --out FILE value written to a mode-0600 file, never shown
Env (exec) warden access <need> --exec -- <cmd> value injected into the child process env only
Wrapping token warden access <need> --wrap a single-use, short-TTL OpenBao wrapping token to bao unwrap in your own context

Agent read-boundary on high-risk lanes (WP-0026 T04)

When WARDEN_AGENT_ID is set and the catalog lane is risk: high, raw value streaming is refused (exit 7). Use --out / --exec / --wrap / --fingerprint only. OpenBao policy agent-high-risk-boundary denies data-read on those paths for agent tokens (metadata/capabilities only). See wiki/playbooks/agent-read-boundary.md.

EXPOSED taint (WP-0026 T05)

warden taint <catalog-id> reports KV v2 custom_metadata (exposed_at, exposed_version, …) without reading secret data. Convention: wiki/playbooks/exposed-taint.md.

Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through reuse-surface federation (reuse-surface registry / capability.* indexes). Credential routing is inlined in every repo's agent instructions because it is high-frequency, high-risk, and easy to get wrong.

Canon: ~/ops-warden/wiki/CredentialRouting.md · catalog ~/ops-warden/registry/routing/catalog.yaml