coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/.claude/rules/credential-routing.md
tegwick 6d2f1be969
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Route lanes inside the SEC-DSM preference hierarchy. 
SSH certificates stay the ephemeral credential this repo issues. Static secrets stay with their owner.

Assistant: grok
Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4
2026-10-11 23:41:31 +02:00

4.9 KiB
Raw Blame History

Credential and access routing

Audience: Codex, Claude Code, Grok, and custodian agents that call llm-connect for inference. Run this check before requesting secrets, API keys, SSH access, login tokens, or database passwords — in any repo, not only ops-warden.

ops-warden issues SSH certificates only (warden sign, cert_command). Every other credential need belongs to another subsystem. Do not message ops-warden on State Hub expecting a secret value; the reply is a pointer, not a key.

Secrets practice follows SecurityCanon SEC-DSM 1.0.0 (../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md). Use its preference hierarchy (§5) and decision procedure (§37) before proposing a new lane. SSH certificates are the ephemeral credential this repo issues. Static secrets stay with their owner. This repo routes to that owner.

Lookup (do this first)

Always plan before drafting any founder credential step (WARDEN-WP-0029):

warden plan "<describe your need>" --json
# verdict: autonomous | founder_required | unroutable

warden route find "<describe your need>" --json
warden route show <catalog-id> --json

Requires the warden CLI from ~/ops-warden (uv tool install . or uv run warden). If a known lane is missing, reinstall from checkout (stale bundled catalog).

Agent runtime How to orient
Codex / Grok (shell, HTTP State Hub) warden plan first; inbox to_agent=ops-warden is for coordination, not secret vending
Claude Code (MCP when available) get_domain_summary("custodian") for workplans; still use warden plan / warden route for credential ownership
llm-connect (inference service) Never put secret retrieval in prompts; route custody via warden plan

Quick routing table

I need… Owner ops-warden executes?
SSH cert (adm/agt/atm) ops-warden Yes — warden sign
API key, DB password, provider token OpenBao (railiance-platform) No — route only
Login / OIDC / MFA key-cape / Keycloak No — route only
Authorization decision flex-auth No — route only
activity-core → issue-core emission activity-core + issue-core No — warden route show activity-core-issue-sink
SSH tunnel ops-bridge (+ cert_command from warden) No — route only

Anti-patterns (do not do these)

  • Drafting founder steps ("paste PAT to /tmp", "click admin UI") without warden plan
  • POST /messages/ to ops-warden asking for ISSUE_CORE_API_KEY, OPENROUTER_API_KEY, etc.
  • Inventing warden secret, warden login, warden bao, warden tunnel — they do not exist
  • Pasting secrets into Git, State Hub, workplans, logs, or chat
  • Steady-state file drops of credentials under /tmp (use warden desk paste-once or warden access --out/--exec/--wrap)
  • Reading a secret value onto a captured stdout. bao kv get <path> (full table) or bao kv get -field=X piped/redirected/run in an agent session dumps the value into a logged context — the 2026-07-16 disclosure. To verify a lane use bao token capabilities (allow/deny), never a read (WP-0026 T01).

Safe fetch transports (WP-0026 T02)

When a value must actually move, use a sanctioned transport that keeps it off stdout. warden access <need> --fetch refuses to stream a value to a non-terminal stdout unless you pass --unsafe-stdout (interactive human sessions only):

Transport Command Result
File warden access <need> --out FILE value written to a mode-0600 file, never shown
Env (exec) warden access <need> --exec -- <cmd> value injected into the child process env only
Wrapping token warden access <need> --wrap a single-use, short-TTL OpenBao wrapping token to bao unwrap in your own context

Agent read-boundary on high-risk lanes (WP-0026 T04)

When WARDEN_AGENT_ID is set and the catalog lane is risk: high, raw value streaming is refused (exit 7). Use --out / --exec / --wrap / --fingerprint only. OpenBao policy agent-high-risk-boundary denies data-read on those paths for agent tokens (metadata/capabilities only). See wiki/playbooks/agent-read-boundary.md.

EXPOSED taint (WP-0026 T05)

warden taint <catalog-id> reports KV v2 custom_metadata (exposed_at, exposed_version, …) without reading secret data. Convention: wiki/playbooks/exposed-taint.md.

Other capabilities (reuse-surface)

Non-credential capabilities are usually discovered through reuse-surface federation (reuse-surface registry / capability.* indexes). Credential routing is inlined in every repo's agent instructions because it is high-frequency, high-risk, and easy to get wrong.

Canon: ~/ops-warden/wiki/CredentialRouting.md · catalog ~/ops-warden/registry/routing/catalog.yaml