529feeac49
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
1.5 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| WARDEN-WP-0035 | workplan | Register the Policy Nexus Forgejo source-read route | infotech | ops-warden | finished | codex | policy-nexus-forgejo-source-read | 2026-09-01 | 2026-09-01 | 45aec8d3-94b3-586e-b019-a47e656efafa |
Register the exact high-risk lane
id: WARDEN-WP-0035-T01
status: done
priority: high
state_hub_task_id: "dd84f2be-0143-540c-9c16-74f0fd129260"
Add the exact OpenBao path, field, OIDC role, owner pointer, and rotation boundary from railiance-platform CCR-2026-0014. The entry must be concrete and resolvable while remaining subject to Warden's high-risk agent read boundary.
Verify routing and governed use
id: WARDEN-WP-0035-T02
status: done
priority: high
state_hub_task_id: "1fa8f778-3e46-5f44-86c4-cab8628b7e60"
Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove the installed route resolves and can hand the value only to a sanctioned child transport without printing or persisting it.
Completed 2026-09-01. All 406 selected tests passed, including the generated
high-risk data-path boundary. The no-cache installed CLI resolves the exact
lane, and warden plan returns only sanctioned --exec, --out, and --wrap
transports for an agent caller. Policy Nexus Actions run 32 separately proved
the installed credential against the complete private-source fetch and release
path without exposing the value.