coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/registry
History
tegwick 3447687bbc
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Answer flex-auth caller-auth question; refresh two delegation lanes 
Inbox triage (ADHOC-2026-08-17), three messages, all answered and marked read.

flex-auth (FLEX-WP-0015 T02) reported that /v1/check and /v1/batch_check
authenticate no caller — any workload with cluster reach can assert any subject
and get an authoritative allow. It lands here because ops-warden owns workload
identity in this estate and its pre-sign gate is a flex-auth PEP.

Recommendation recorded in wiki/NetKingdomSecurityMap.md: Kubernetes
ServiceAccount TokenReview with a projected, audience-scoped token. Rejected the
shared-secret header — it manufactures a risk: high lane with a rotation owner
per caller on the authorization path, the exact interim-proxy debt WP-0030
exists to stop growing. Deferred mTLS pending an owner for a workload X.509 CA.
Bind `system` to the authenticated SA at auth time, but keep the resource-type
allowlist in the policy package rather than the admission layer. Warn-only
rollout; policy.enabled must not flip while /v1/check answers unauthenticated
callers. Recorded as a pattern, not a catalog entry.

Catalog delegation refreshes:
- coulomb-social-runtime-env: USER_ENGINE_PROXY_SECRET ownership settled
  (decision 8fe22037, USER-WP-0021) — intended_owner stays railiance-apps,
  answered clause dropped from blocked_on, consumers: [user-engine] recorded.
- rapp-qonto-keycape-client: blocked_on no longer implies an in-flight
  KEY-WP-0008 dependency; the key-cape-native exchange command is unopened work.

uv run pytest -q → 338 passed, 4 deselected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 22:55:33 +02:00
..
capabilities docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog 2026-06-18 20:44:53 +02:00
flex-auth feat: close WP-0009/WP-0013 production integration stewardship strand 2026-06-24 12:44:32 +02:00
indexes WARDEN-WP-0006: NetKingdom stewardship docs and alignment 2026-06-17 08:22:45 +02:00
policy WARDEN-WP-0029: implement plan front door, org posture, desk, freshness 2026-07-18 16:59:37 +02:00
routing Answer flex-auth caller-auth question; refresh two delegation lanes 2026-08-17 22:55:33 +02:00
README.md Add capability registry scaffold (REUSE-WP-0014-T06 B04) 2026-06-16 01:56:08 +02:00

README.md

Capability Registry

Markdown-first capability index for federation and reuse planning.

Authoring

  1. Copy a capability entry template (see reuse-surface templates/capability-entry.template.md).
  2. Add the row to indexes/capabilities.yaml.
  3. Run reuse-surface validate from a checkout with the CLI installed.
  4. Merge to main and verify publish with reuse-surface establish --publish-check.

Federation contract: reuse-surface docs/RegistryFederation.md.