tegwick e62763cba9 WARDEN-WP-0045: agt-custodian issuance profile (CUST-WP-0073-T02) ... Per-actor issuance profile in the inventory contract: optional `extensions` allow-list (LocalCA -O clear + -O <ext>; Vault explicit extensions map) and `max_ttl_hours` ceiling enforced against --ttl overrides. Actors without these fields keep backend defaults. agt-custodian: principal agt-custodian, 12h TTL/ceiling, permit-pty only (no agent/port/X11 forwarding, no user-rc), no source-address (unstable workstation egress). Ceremony routing lane agt-custodian-ssh-cert: supervisor issues from the operator account; the agent cannot self-issue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61		2026-10-20 13:46:28 +02:00
..
inventory.seed.yaml	WARDEN-WP-0045: agt-custodian issuance profile (CUST-WP-0073-T02)	2026-10-20 13:46:28 +02:00
posture-conformance.example.yaml	feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles	2026-06-27 19:30:30 +02:00
rapp-qonto-posture-conformance.yaml	Route rapp-qonto workload identity	2026-07-27 20:37:09 +02:00
warden.production.example.yaml	WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075)	2026-10-03 09:18:54 +02:00
worker.env.example	feat(WARDEN-WP-0021): T1+T2 — scheduled worker tick enabled (systemd --user timer)	2026-06-30 15:19:23 +02:00