coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/agent-harness-secrets.md
tegwick 5149946a4c
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
WARDEN-WP-0029: implement plan front door, org posture, desk, freshness 
Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.
2026-07-18 16:59:37 +02:00

1.9 KiB
Raw Blame History

agent-harness secret lanes

Canon: binky-control/integrations/executor-worker-secrets.md. OpenBao paths / policies: railiance-platform/docs/workload-kv-access-lanes.md.

Never paste secret values into chat, Git, hub events, or this wiki.

Lane 1 — LLM provider (reuse)

Catalog: openrouter-llm-connect. No new secret. Harness reuses the activity-core llm-connect provider key path.

Lane 2 forgejo deploy key

Catalog: agent-harness-forgejo-deploy

Item Value
Host path (private key) ~/.local/agent-harness/ssh/forgejo-deploy on railiance01
OpenBao path platform/workloads/agent-harness/forgejo-deploy-key
Fields SSH_PRIVATE_KEY, SSH_PUBLIC_KEY
Policy workload-kv-read-agent-harness-forgejo
SSH alias forgejo-agent-harness (port 30022)
Repos (write deploy key) coulomb/executor-sandbox first; add binky-control at cutover

Worker checklist

  1. Confirm private key mode 600 under ~/.local/agent-harness/ssh/.
  2. ssh -p 30022 -i ~/.local/agent-harness/ssh/forgejo-deploy -T git@forgejo.coulomb.social
    expects deploy-key success message (no shell).
  3. Push only to granted repos (sandbox until cutover).

Lane 3 mail approle

Catalog: agent-harness-binky-mail-approle

Item Value
AppRole agent-harness-binky-mail
Token policy workload-kv-read-binky-company-email-imap (existing; no widen)
Host dir ~/.local/agent-harness/approle-binky-mail/ (role_id, secret_id, mode 600)
Env EXECUTOR_APPROLE_DIR (see ~/.local/agent-harness/env)
Secret path tenants/binky/company-email/imap

Worker checklist

  1. source ~/.local/agent-harness/env
  2. Login with role_id/secret_id → short-lived token (ttl 15m).
  3. bao kv get -field=IMAP_USERNAME|IMAP_PASSWORD … — use only in process env; never print.
  4. Negative: same token must not read unrelated KV (e.g. forgejo-admin).