tegwick
3596e079b1
ops-warden will route the path shape. The allowlist change and the value writes stay with railiance-platform and the founder. Assistant: grok Assistant-Session: 01a11ab6-1534-7d63-8606-662b92a80ed6
3 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | depends_on | related | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WARDEN-WP-0043 | workplan | Route supplier credentials under platform/suppliers | infotech | ops-warden | ready | implementation | grok | platform-suppliers | 2026-10-08 | 2026-10-08 |
|
WARDEN-WP-0043 — Supplier credentials under platform/suppliers
Founder decision 2026-10-08: account credentials we hold with a supplier
live at platform/suppliers/<supplier>/<account> on the existing platform
KV mount. ops-warden routes that shape. It does not store the values and it
does not apply OpenBao. The KV write and the credential-change allowlist
belong to railiance-platform. Tenant commercial secrets stay on tenants/.
Workload and rein paths that already have a reader stay where they are until that reader is retargeted:
| Account | Path today |
|---|---|
| OpenRouter, llm-connect | platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets |
| OpenRouter, rein-openweights | reins/rein-openweights/openrouter |
| Scaleway bootstrap | platform/workloads/railiance/scaleway/bootstrap |
| Scaleway backup space | platform/workloads/railiance/backup/object-storage |
| IONOS transactional mailbox | platform/workloads/email-connect/transactional |
| IONOS library mailbox | platform/workloads/inbound-library/imap |
The future homes are platform/suppliers/openrouter/llm-connect,
platform/suppliers/openrouter/rein-openweights,
platform/suppliers/scaleway/bootstrap, platform/suppliers/scaleway/backup,
platform/suppliers/ionos/email-connect-smtp, and
platform/suppliers/ionos/library-imap. Further suppliers use the same
two-level shape. llm-connect already tries the llm-connect supplier path
and then the live workload path before OPENROUTER_API_KEY.
Catalog pointer
id: WARDEN-WP-0043-T01
status: todo
priority: high
Add a pointer catalog entry and a short playbook for
platform/suppliers/<supplier>/<account>. warden_executes: false. The
owner of the KV write is railiance-platform. No secret values, no fetch
of a live field, and no new warden verb.
Allow the path in credential changes
id: WARDEN-WP-0043-T02
status: wait
priority: high
blocked_on: message-from:railiance-platform
railiance-platform/scripts/credential-change.py accepts platform/workloads/
and tenants/ for a delegated change. platform/suppliers/ needs that
allowlist widened before a CCR can create these paths. ops-warden does not
apply the change.
Provision supplier accounts
id: WARDEN-WP-0043-T03
status: wait
priority: medium
needs_human: true
New supplier material is written from a mode-0600 file on a trusted
terminal, into platform/suppliers/<supplier>/<account>. IONOS is the
first account that still needs that home. Existing workload and rein
readers keep their current paths until each one is retargeted. Values do
not go into git, State Hub, workplans, logs, or chat.