ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md

id	name	summary	owner	status	domain	tags	maturity	external_evidence	discovery	availability	relations	consumer_guidance	evidence
capability.security.ssh-certificate-issuance	Decision-bound SSH certificates	warden sign with local and OpenBao backends and adm/agt/atm actors.	ops-warden	draft	helix_forge	ssh certificate ca ops-warden openbao security netkingdom framework-reuse	discovery availability current target confidence rationale D4 D5 medium SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command contract are documented; production OpenBao integration is documented but engine deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable. current target confidence rationale A3 A5 medium Source interface assessed 2026-10-14: warden sign with local and OpenBao backends and adm/agt/atm actors. Availability describes the delivery form, not production acceptance. Direct Tooling contact is a declared gap; certificate reachability is not target authorization.	completeness reliability level name confidence basis satisfied_expectations broken_expectations out_of_scope_expectations C3 Functional Core medium scope_vs_intent_and_consumer_expectations local and OpenBao/Vault-compatible signing backends TTL policy enforcement per actor type principals inventory and cert-side scorecard signatures audit log and stale-cert cleanup cert_command stdout contract for ops-bridge host-side principal deployment not owned here OpenBao SSH engine mount not deployed from this repo long-lived API key custody tunnel lifecycle management Vault/OpenBao cluster operations level name confidence basis known_reliability_risks R2 Tolerable medium consumer_quality_signals production signing depends on OpenBao availability and token policy local backend requires protected CA key handling by operators	intent includes excludes assumptions use_cases research_memos warden sign with local and OpenBao backends and adm/agt/atm actors warden sign with local and OpenBao backends and adm/agt/atm actors Direct Tooling contact is a declared gap; certificate reachability is not target authorization callers supply actor public keys; humans self-issue admin keys production platform uses OpenBao with Vault-compatible SSH engine API ops-bridge tunnel cert_command Inter-Hub bootstrap short-lived agent access U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity ops-warden/SCOPE.md ops-warden/wiki/CertCommandInterface.md ops-warden/wiki/OpsWardenConfig.md ops-warden/wiki/AccessRouting.md	current_level target_level current_artifacts target_artifacts consumption_modes A3 A5 SCOPE.md README.md packaged ops-warden release with documented OpenBao role bootstrap `warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011) library CLI	depends_on supports related_to capability.security.credential-lifecycle capability.authorization.policy-evaluate capability.ops.tunnel-bridge capability.security.structure-construction	recommended_for not_recommended_for known_limitations Operator or automation obtains a bounded SSH certificate and maintains private connectivity Direct Tooling contact is a declared gap; certificate reachability is not target authorization Direct Tooling contact is a declared gap; certificate reachability is not target authorization 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.	documentation SCOPE.md README.md

Decision-bound SSH certificates

warden sign with local and OpenBao backends and adm/agt/atm actors.

Reuse boundary

Direct Tooling contact is a declared gap; certificate reachability is not target authorization.

Supported use cases

• U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

Evidence and integration

• SCOPE.md
• README.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.