tegwick
19bb75c614
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
70 lines
3 KiB
Markdown
70 lines
3 KiB
Markdown
---
|
|
id: WARDEN-WP-0039
|
|
type: workplan
|
|
title: "Preserve explicit policy caller refusals before credential and CA effects"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: active
|
|
owner: codex
|
|
topic_slug: custodian
|
|
created: "2026-09-08"
|
|
updated: "2026-09-08"
|
|
origin: residual
|
|
origin_ref: HFACT-WP-0001
|
|
---
|
|
|
|
The factory critical-path review reproduced a live HTTP 403 from the reachable
|
|
PDP for the configured ops-warden caller and a railiance-platform secret read.
|
|
`check_fetch_policy` treated it as evaluator unavailability and used unknown-zone
|
|
fail-open. Caller-auth rejection is an explicit refusal, not a transport outage.
|
|
|
|
## Preserve explicit authentication and binding refusals
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T01
|
|
status: done
|
|
priority: high
|
|
assignee: the-custodian
|
|
```
|
|
|
|
HTTP 401 and 403 stop signing and credential fetch irrespective of the outage
|
|
profile. Do not expose response bodies or alter system identity to bypass the
|
|
refusal. Preserve configured behavior for genuine evaluator failures. Prove
|
|
both permissive and closed outage profiles and refusal before child execution.
|
|
|
|
## Verify and publish the correction
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T02
|
|
status: progress
|
|
priority: high
|
|
assignee: the-custodian
|
|
```
|
|
|
|
Run the policy and proxy suites, retain a value-free live refusal receipt,
|
|
publish the reviewed source, and verify the installed CLI refuses before any
|
|
credential transport. A refusal is not a successful credential-read admission.
|
|
|
|
The owner installer initially reused a cached wheel despite `--force`, leaving
|
|
the pre-fix policy code installed. Both Makefile installation targets now use
|
|
`--reinstall-package ops-warden` to refresh this package from the reviewed source.
|
|
Verify the installed module as well as the checkout before the live refusal test.
|
|
|
|
## Resolve the credential proxy's admitted policy binding
|
|
|
|
```task
|
|
id: WARDEN-WP-0039-T03
|
|
status: wait
|
|
priority: high
|
|
assignee: the-custodian
|
|
blocking_reason: "The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership."
|
|
```
|
|
|
|
Consume the existing native-lane handoff (WARDEN-WP-0033 / SECRETS-WP-0006)
|
|
and flex-auth caller contract. Establish whether this interim transport needs an
|
|
admitted dedicated policy route or must finish its native handoff. Retain the
|
|
refusal until that contract yields positive and wrong-caller/owner/tenant
|
|
negative evidence. No credential read, secret generation, or policy grant is
|
|
authorized by this workplan alone. HFACT-WP-0001-T03 consumes this return.
|
|
|
|
Validation: 429 tests passed (4 integration tests deselected by the repository default); Ruff passed for changed Python files. Full tests used the declared phase-memory source and an isolated temporary memory store. The focused policy/proxy suite passed 69 tests. The existing authenticated SSH policy probe still returns HTTP 200/ALLOW, decision:f3f7c88f9585582a; the credential-owner request returns 403. No CA issue or credential read was performed by these probes.
|