tegwick
d6088e4e16
Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
22 lines
No EOL
795 B
Python
22 lines
No EOL
795 B
Python
"""Operator hints for vault-backed signing without manual token paste."""
|
|
|
|
from __future__ import annotations
|
|
|
|
BROKER_CATALOG_ID = "ops-warden-warden-sign-token"
|
|
|
|
BROKER_EXEC_TEMPLATE = (
|
|
"cd ~/railiance-platform && scripts/credential.py exec "
|
|
"--grant ops-warden/warden-sign --ttl 15m -- "
|
|
"warden sign <actor> --pubkey <path>"
|
|
)
|
|
|
|
|
|
def missing_vault_token_message(token_env: str) -> str:
|
|
"""Structured hint when vault backend lacks a scoped token."""
|
|
return (
|
|
f"Vault token not found. Set {token_env!r} for the current shell only, "
|
|
f"or use the railiance-platform credential broker (preferred):\n"
|
|
f" warden route show {BROKER_CATALOG_ID}\n"
|
|
f" {BROKER_EXEC_TEMPLATE}\n"
|
|
f"See wiki/playbooks/ops-warden-warden-sign-token.md"
|
|
) |