tegwick
70d8b503f0
gate-house asked ops-warden to assent to three boundary items ratified in GH-DEC-2026-001. All three are assented in ADR-0010. Staff: accepted. Grepping section 5 as it invites turned up a real non-conformance — src/warden/vault.py is a direct OpenBao client performing a write, and so is `warden desk`'s `bao kv put`. Section 5's only escape hatch is read-only diagnostics, which does not cover a signing write, so both are declared in INTENT.md as an engine gap with intended owner secrets-engine and the blocker "no engine exposes an SSH-CA surface" — ADR-0003 turned inward rather than an exemption argued for. taint.py is metadata-only and declared under the read-only allowance; `warden access` proxies run under the caller's identity and supply no authority of their own. Doctrine versus runbook: accepted. NetKingdom Security Literacy becomes a lane routing runbook that references gate-house doctrine instead of restating it. It had also become a prose second source for registry/routing/catalog.yaml, which ADR-0001 already rules against. Lane versus rule: assented unconditionally, and the access-engine veto is not exercised. One request on sequencing only — a window where both names resolve. gate-house added to the routing tables in INTENT.md and SCOPE.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014535@bnt-lap001 Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c
109 lines
5.1 KiB
Markdown
109 lines
5.1 KiB
Markdown
---
|
|
id: ops-warden-adr-0010
|
|
type: adr
|
|
title: "ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: accepted
|
|
version: "1.0"
|
|
revision: "1"
|
|
owner: ops-warden
|
|
binds: "ops-warden"
|
|
created: "2026-08-28"
|
|
updated: "2026-08-28"
|
|
last_reviewed: "2026-08-28"
|
|
review_interval: 3m
|
|
enforced_by: "INTENT.md layer declaration; docs/adr/ADR-0002; docs/adr/ADR-0003; docs/adr/ADR-0005; registry/routing/catalog.yaml delegation fields"
|
|
supersedes: ""
|
|
successor: ""
|
|
---
|
|
|
|
# ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap
|
|
|
|
## Status
|
|
|
|
Accepted 2026-08-28, answering intake `WARDEN-IN-0001` from gate-house, which
|
|
carries decision `GH-DEC-2026-001`. The standard being adopted —
|
|
`net-kingdom/canon/standards/security-layer-model_v0.1.md` — is `proposed`, and was
|
|
proposed pending assent from flex-auth, kings-guard, and ops-warden. This ADR is
|
|
ops-warden's half of that assent.
|
|
|
|
## Context
|
|
|
|
The estate acquired overlapping claims to the same responsibility, most visibly two
|
|
repositories describing themselves as the authorization control plane. The layer
|
|
model resolves the overlap by layering repositories on determinism — Taxonomy,
|
|
Tooling, Engines, Staff — and by two rules: Staff never touches Tooling directly
|
|
(§5), and `access-engine` is the only policy decision point (§6).
|
|
|
|
ops-warden is assigned Staff. Two demarcations follow that touch this repository:
|
|
the security curriculum it had been carrying belongs to gate-house, and the words
|
|
*access lane* and *access rule* are bound to different owners.
|
|
|
|
Full reasoning: `history/2026-08-28-security-layer-model-assent.md`.
|
|
|
|
## Decision
|
|
|
|
**1. ops-warden is Staff and declares it.** `INTENT.md` carries the layer label and
|
|
the §5 invariant. ops-warden holds no state another layer depends on at runtime and
|
|
renders no authorization decision — it consumes them.
|
|
|
|
**2. Lanes, not rules.** ops-warden owns *how* a worker reaches a host: SSH
|
|
certificate issuance, the routing catalog, `warden access`, `warden plan`,
|
|
`cert_command`. It never owns *whether* a worker may — that is `access-engine`
|
|
(today `flex-auth`), and ops-warden neither renders nor caches that decision. This
|
|
restates what `ADR-0002` and `ADR-0005` already bind; it is recorded here because
|
|
the demarcation is now normative estate-wide and other repositories rely on
|
|
ops-warden holding to it. The ruled rename `flex-auth` → `access-engine` is assented
|
|
to; ops-warden asks only for a window in which both names resolve.
|
|
|
|
**3. Doctrine goes to gate-house; runbooks stay here.** ops-warden does not restate
|
|
security doctrine, the authority model, or the curriculum. It references
|
|
gate-house's. It keeps everything operational about the lanes it stewards: which
|
|
subsystem owns which need, how to obtain a credential lane by lane, and conformance
|
|
evidence for its own lanes. `.claude/rules/credential-routing.md` is runbook, not
|
|
curriculum, and stays inlined in this and every other repository.
|
|
|
|
**4. One declared engine gap, not an exemption.** `src/warden/vault.py` (`VaultCA`)
|
|
is a direct OpenBao client performing a write from a Staff repository. It is a §5
|
|
non-conformance. ops-warden declares it rather than arguing it away:
|
|
|
|
- **intended owner:** `secrets-engine` (credential abstraction, custody, lifecycle)
|
|
- **blocked on:** no engine exposes an SSH certificate signing surface
|
|
- **review:** with this ADR, every 3 months
|
|
|
|
Until that surface exists, ops-warden continues to sign — refusing to would remove
|
|
production host access to close a documentation gap — and reports the position as
|
|
open. `warden desk`'s `bao kv put` is declared on the same terms. `taint.py` is
|
|
metadata-only observation, declared under §5's read-only allowance. `proxy.py`
|
|
supplies no authority of its own: it runs the owner's tool under the caller's
|
|
identity and is governed by `ADR-0002`.
|
|
|
|
This is `ADR-0003` turned inward. ops-warden has required an intended owner and a
|
|
blocker on 27 catalog lanes it holds for other repositories; it holds itself to the
|
|
same record.
|
|
|
|
## Consequences
|
|
|
|
ops-warden's conformance under §10 is *declared non-conformant with a tracked
|
|
closure path*, not clean. That is the accurate state and it is the state that gets
|
|
fixed, because it names an owner who can fix it.
|
|
|
|
An amendment to §5 has been offered to gate-house — a second sanctioned shape
|
|
alongside read-only diagnostics: a declared engine gap carrying intended owner,
|
|
blocker, and review date, machine-readable so §10 can tell a tracked gap from an
|
|
undeclared violation. It is offered, not assumed; §5 stays gate-house's to write. If
|
|
gate-house declines it, ops-warden's position is a plain non-conformance and is
|
|
reported as one.
|
|
|
|
The `NetKingdom Security Literacy` section stops being a prose second source for
|
|
`registry/routing/catalog.yaml`, which `ADR-0001` had already ruled against for
|
|
catalog procedure.
|
|
|
|
## Related
|
|
|
|
- `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed, gate-house)
|
|
- `gate-house/decisions/decisions.md` — `GH-DEC-2026-001`
|
|
- `history/2026-08-28-security-layer-model-assent.md`
|
|
- `ADR-0001`, `ADR-0002`, `ADR-0003`, `ADR-0005`, `ADR-0009`
|
|
- `WARDEN-IN-0001`
|