tegwick
4c7ae86f68
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
4.4 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | depends_on | related | state_hub_workstream_id | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WARDEN-WP-0043 | workplan | Route supplier credentials under platform/suppliers | infotech | ops-warden | finished | implementation | grok | platform-suppliers | 2026-10-08 | 2026-10-09 |
|
16aac061-977a-536b-a074-aba059f2475f |
WARDEN-WP-0043 — Supplier credentials under platform/suppliers
Founder decision 2026-10-08: account credentials we hold with a supplier
live at platform/suppliers/<supplier>/<account> on the existing platform
KV mount. ops-warden routes that shape. It does not store the values and it
does not apply OpenBao. The KV write and the credential-change allowlist
belong to railiance-platform. Tenant commercial secrets stay on tenants/.
Workload and rein paths that already have a reader stay where they are until that reader is retargeted:
| Account | Path today |
|---|---|
| OpenRouter, llm-connect | platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets |
| OpenRouter, rein-openweights | reins/rein-openweights/openrouter |
| Scaleway bootstrap | platform/workloads/railiance/scaleway/bootstrap |
| Scaleway backup space | platform/workloads/railiance/backup/object-storage |
| IONOS transactional mailbox | platform/workloads/email-connect/transactional |
| IONOS library mailbox | platform/workloads/inbound-library/imap |
The future homes are platform/suppliers/openrouter/llm-connect,
platform/suppliers/openrouter/rein-openweights,
platform/suppliers/scaleway/bootstrap, platform/suppliers/scaleway/backup,
platform/suppliers/ionos/email-connect-smtp, and
platform/suppliers/ionos/library-imap. Further suppliers use the same
two-level shape. llm-connect already tries the llm-connect supplier path
and then the live workload path before OPENROUTER_API_KEY.
Catalog pointer
id: WARDEN-WP-0043-T01
status: done
priority: high
state_hub_task_id: "7a86d91a-fcbd-5dc8-b3cf-4c28ad963474"
Add a pointer catalog entry and a short playbook for
platform/suppliers/<supplier>/<account>. warden_executes: false. The
owner of the KV write is railiance-platform. No secret values, no fetch
of a live field, and no new warden verb.
Done 2026-10-08: catalog platform-supplier-credentials plus
wiki/playbooks/platform-supplier-credentials.md.
Allow the path in credential changes
id: WARDEN-WP-0043-T02
status: done
priority: high
state_hub_task_id: "c384b228-e710-580d-a3de-a3046a86e666"
railiance-platform/scripts/credential-change.py accepts platform/workloads/
and tenants/ for a delegated change. platform/suppliers/ needs that
allowlist widened before a CCR can create these paths. ops-warden does not
apply the change.
Done 2026-10-09: railiance-platform b77cb41 maps mount platform to
platform/workloads/ and platform/suppliers/. Under suppliers/ it requires
exactly two non-empty segments, and tests cover platform/suppliers/ionos/main.
The IONOS CCR can now be drafted against this shape.
Provision supplier accounts
id: WARDEN-WP-0043-T03
status: done
priority: medium
needs_human: true
state_hub_task_id: "87996bc7-2f7a-578d-9f7c-8bd876605a47"
New supplier material is written from a mode-0600 file on a trusted
terminal, into platform/suppliers/<supplier>/<account>. IONOS is the
first account that still needs that home. Existing workload and rein
readers keep their current paths until each one is retargeted. Values do
not go into git, State Hub, workplans, logs, or chat.
2026-10-09: the IONOS stub exists. The founder ran the write through the
contained openbao-platform-admin-login envelope:
bao kv put -cas=0 platform/suppliers/ionos/main as version 1, with keys
CUSTOMER_NUMBER, LOGIN, PASSWORD, API_KEY_PREFIX and API_KEY_SECRET,
each set to the placeholder FILL_ME. A metadata-only check through the same
envelope exited 0. The founder fills the real values as version 2 in the
OpenBao UI. This task closes once that is done. No reader policy exists for the
path; a reader is requested through a railiance-platform CCR when a workload
needs it.
2026-10-09: done. The founder filled in the real values as version 2 through the OpenBao UI. ops-warden did not read or verify any value. Further supplier accounts follow the same playbook; existing workload and rein readers move only when each reader is retargeted.