ops-warden/history/2026-08-28-security-layer-model-assent.md

Security layer model — ops-warden's assent (WARDEN-IN-0001)

Date: 2026-08-28 Intake: WARDEN-IN-0001 Requested by: gate-house, ratified as GH-DEC-2026-001 Standard: net-kingdom/canon/standards/security-layer-model_v0.1.md (proposed) Outcome: assent to all three items; one declared non-conformance and one proposed amendment to the standard.

---

What was asked

gate-house asked ops-warden to assent to three boundary items:

1. ops-warden is Staff, bound by §5 — Staff acts only through Engine APIs and never holds a direct Tooling client.
2. Doctrine versus runbook — the security curriculum moves to gate-house; the NetKingdom Security Literacy section in INTENT.md becomes lane-specific runbooks that reference gate-house doctrine rather than restating it.
3. The access lane / access rule demarcation (§8) — ops-warden and ops-mason own lanes (how a worker reaches a host); access-engine owns rules (whether they may). This is the condition attached to renaming flex-auth to access-engine, so ops-warden effectively holds a veto on that name.

Plus: add gate-house to the literacy and routing tables, and say so if moving the curriculum out leaves ops-warden unable to instruct its own workers.

---

Item 1 — Staff, and the §5 problem it exposes

Assent to the layer. Staff is the right assignment and not a demotion. ops-warden's artifacts are exactly what §3.4 describes: routing decisions, workplans, runbooks, an audit trail. Its one production lane is non-deterministic in the sense that matters — it is an operator front door, not a contract.

But §5 is violated today, and by the one lane ops-warden permanently owns. The rule is deliberately greppable, so grepping is the honest response:

Path	Tooling contact	Kind	Whose credential
src/warden/vault.py (VaultCA.sign)	POST <bao>/v1/<mount>/sign/<role>	write	broker-issued token held by ops-warden's process
src/warden/desk.py	bao kv put (paste-once provisioning)	write	founder's, at the desk
src/warden/taint.py	bao kv metadata get	read (metadata only, never data)	caller's
src/warden/proxy.py (warden access --fetch/--exec/--wrap)	catalog fetch_command	read	the caller's own

Two of these are not really ops-warden's clients. proxy.py runs the owner's tool under the caller's identity and supplies no authority of its own — that is ADR-0002, conduit not broker, and it is arguably outside §5's target. taint.py reads metadata only, and fits §5's read-only-observation allowance once declared.

VaultCA does not have that defence. It is a direct OpenBao client, in a Staff repository, performing a write, presenting a token from its own environment. It is production-verified and it is the SSH lane — the single thing ops-warden owns permanently. Under §5 as written, adopting this standard puts ops-warden's core lane in violation on the day it is adopted.

The escape hatch §5 offers does not fit: it covers read-only observation for diagnostics, and signing is a write. The route §5 prescribes does fit —

A Staff repository needing a capability no engine exposes MUST raise that as an engine gap, not solve it locally.

— and no engine exposes SSH certificate signing. secrets-engine owns credential abstraction, custody and lifecycle, which is the layer this belongs in, but it fronts no SSH-CA API today.

So ops-warden assents and declares the non-conformance rather than negotiating an exemption. VaultCA is recorded in INTENT.md as a declared §5 exception with a named intended owner (secrets-engine), a blocker (no SSH-CA engine surface), and a review date. That is ADR-0003 — cover gaps, never silently own them — applied to ops-warden itself instead of to someone else's lane.

Proposed amendment to the standard

§5 has exactly one shape for a Staff repository that legitimately touches Tooling: read-only diagnostics. That shape is too narrow to describe the estate as it exists, and a rule with no lane for a real, sanctioned case gets satisfied by relabelling rather than by closing the gap.

Recommend §5 gain a second shape: a declared engine gap — a Staff repository MAY hold a Tooling client for a capability no engine exposes, provided it is declared in INTENT.md with an intended owner, the blocker, and a review date, and provided the declaration is machine-readable so the conformance check in §10 can distinguish a tracked gap from an undeclared violation.

ops-warden already runs this machinery for other repositories' lanes: 27 catalog entries carry delegation: with intended_owner and blocked_on, and warden route gaps lists them (WP-0030). It is offered, not imposed — the standard is gate-house's.

---

Item 2 — Doctrine versus runbook

Assent. The NetKingdom Security Literacy section is what gate-house says it is: evidence that the curriculum had no owner, so it accreted in whatever INTENT.md was open. That is the same failure risk-nexus names for findings and the same one ADR-0001 prevents for catalog procedure. ops-warden has argued this rule twice against other repositories; it applies here.

The boundary, drawn precisely:

Moves to gate-house	Stays with ops-warden
Why the planes are separated; the authority model	Which subsystem owns which credential need
What "posture", "zone", "authority ceiling" mean	How to obtain a cert, a lease, a login — per lane
The security curriculum a worker is taught	The runbook a worker executes
Doctrine a lane must conform to	Evidence of conformance for ops-warden's lanes

gate-house's test question, answered: no, it does not leave ops-warden unable to instruct its workers — and the reason is worth recording. What actually instructs an ops-warden worker is not the prose in INTENT.md. It is warden plan "<need>", warden route find, and .claude/rules/credential-routing.md, which is inlined into every repository's agent instructions precisely because credential routing is high-frequency and high-risk. That surface is executable, lane-specific, and unambiguously runbook. It does not depend on the literacy table, and moving doctrine out does not weaken it.

If anything the move improves it: the literacy table has been a second, prose copy of what registry/routing/catalog.yaml states machine-readably, which is the double-source failure ADR-0001 exists to stop.

One thing must not move with it. .claude/rules/credential-routing.md stays inline in this repository and in every other. It is not doctrine and not a curriculum; it is the anti-pattern list an agent needs before it acts, and a reference to a document in another repository would not be read in time.

---

Item 3 — Access lane versus access rule

Assent, unconditionally, and the veto on access-engine is not exercised.

ops-warden is already built this way. ADR-0005 implements one lane narrowly and routes everything else; ADR-0002 makes it a conduit that never decides; ADR-0009 has ops-warden compile membership attributes and apply a zone's failure mode while flex-auth owns the stance. ops-warden consumes decisions; it has never rendered one. The demarcation costs nothing because it describes what is already true.

access-engine is also the better name. ops-warden's own routing table has had to say "authorization" for the decision and "access" for the route for a year, and the collision is visible in every playbook.

One operational condition, on execution rather than on the ruling. The rename is 598 references across 82 files in this repository alone — catalog owner: fields, registry/flex-auth/, src/warden/policy.py, the production registry snapshot builder, playbooks, and the .claude/rules/ files that other repositories inline. Ops-warden asks for a deprecation window in which both names resolve, rather than a flag day; ops-warden will do its own migration inside that window. This is a request about sequencing, not a reservation about the name.

---

Item 4 — gate-house is missing from every table

Correct, and fixed in this pass. gate-house is added to the literacy/routing table in INTENT.md as the owner of doctrine, invariants, authority context, and conformance review — with the routing rule stated explicitly: doctrine and authority-model questions go to gate-house; policy decisions continue to go to access-engine. Those are different questions and the distinction is the whole point of §6.

---

Recorded as

• ADR-0010 — ops-warden is Staff; lanes not rules; the declared §5 exception
• INTENT.md — layer declaration, reworked routing table, gate-house row
• WARDEN-IN-0001 — closed, outcome assented