tegwick
e62763cba9
Per-actor issuance profile in the inventory contract: optional `extensions` allow-list (LocalCA -O clear + -O <ext>; Vault explicit extensions map) and `max_ttl_hours` ceiling enforced against --ttl overrides. Actors without these fields keep backend defaults. agt-custodian: principal agt-custodian, 12h TTL/ceiling, permit-pty only (no agent/port/X11 forwarding, no user-rc), no source-address (unstable workstation egress). Ceremony routing lane agt-custodian-ssh-cert: supervisor issues from the operator account; the agent cannot self-issue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
71 lines
2 KiB
YAML
71 lines
2 KiB
YAML
# Non-secret inventory template — copy to ~/.config/warden/inventory.yaml
|
|
# and adjust for your environment. Do not commit real operator paths or keys.
|
|
#
|
|
# See wiki/ActorInventoryPatterns.md and wiki/OpsWardenConfig.md
|
|
|
|
actors:
|
|
agt-state-hub-bridge:
|
|
type: agt
|
|
principals:
|
|
- agt-task-bridge
|
|
ttl_hours: 24
|
|
description: "ops-bridge tunnel agent for state-hub"
|
|
zone_subject:
|
|
applicability: applicable
|
|
workload_id: ops-bridge-tunnel
|
|
|
|
agt-codex-interhub-bootstrap:
|
|
type: agt
|
|
principals:
|
|
- agt-interhub-bootstrap
|
|
ttl_hours: 2
|
|
description: "Short-lived agent access for attended Inter-Hub bootstrap"
|
|
zone_subject:
|
|
applicability: applicable
|
|
workload_id: codex-interhub-bootstrap
|
|
|
|
# CUST-WP-0073-T02 / WARDEN-WP-0045: supervised interactive agent account
|
|
# (Codex, Claude Code, Grok Build) on host account custodian-agt @ Railiance01.
|
|
# Issued only by the supervisor from the operator account; the agent distro
|
|
# (custodian-agents) holds no warden config, CA key or Vault token.
|
|
# No source-address: workstation egress IP is not stable (see wiki).
|
|
agt-custodian:
|
|
type: agt
|
|
principals:
|
|
- agt-custodian
|
|
ttl_hours: 12
|
|
max_ttl_hours: 12
|
|
extensions:
|
|
- permit-pty
|
|
description: "Supervised interactive custodian agent (custodian-agt on Railiance01)"
|
|
zone_subject:
|
|
applicability: applicable
|
|
workload_id: custodian-agents
|
|
|
|
adm-example:
|
|
type: adm
|
|
principals:
|
|
- adm-full
|
|
ttl_hours: 48
|
|
description: "Example human operator — replace with per-person adm-* actors"
|
|
zone_subject:
|
|
applicability: not-applicable
|
|
reason: human operator retains native actor identity
|
|
|
|
atm-backup-daily:
|
|
type: atm
|
|
principals:
|
|
- atm-backup-daily
|
|
ttl_hours: 8
|
|
description: "Example nightly automation actor"
|
|
zone_subject:
|
|
applicability: applicable
|
|
workload_id: backup-daily
|
|
|
|
hosts:
|
|
example-host:
|
|
allowed_principals:
|
|
agt:
|
|
- agt-task-bridge
|
|
atm:
|
|
- atm-backup-daily
|