tegwick 5149946a4c

CI Smoke / host-smoke (push) Successful in 1s

Details

CI Smoke / container-smoke (push) Successful in 2s

Details

WARDEN-WP-0029: implement plan front door, org posture, desk, freshness

Ship posture-aware access planning: organization_posture=build (axis C),
catalog freshness warnings, warden plan verdicts, localhost founder desk,
and playbook/agent guidance that retire /tmp file-drop patterns.

Compose route catalog + handoff rather than a second routing layer.

2026-07-18 16:59:37 +02:00

5.9 KiB

Raw Blame History

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
WARDEN-WP-0029	workplan	Policy front door: posture-aware access planning + founder interaction surface	infotech	ops-warden	finished	codex	custodian	high	29	2026-07-18	2026-07-18	6e396e7e-99c5-43aa-98a0-27f157de12a3

WARDEN-WP-0029 — Policy front door + founder interaction surface

Origin

Founder directive 2026-07-18 (binky-control cutover prep): agents proposed raw credential mechanics to the founder ("attach the deploy key in the forgejo UI", "save the PAT to /tmp/...") although a catalogued lane (forgejo-admin-api-token, WARDEN-WP-0025) already covered the need — the installed CLI's catalog was stale, and nothing forced the ask-warden-first step. Directive: ops-warden is the service to ask what can and needs to be done per NetKingdom policy; the founder is bothered only when policy makes it absolutely necessary, and then preferably via a purpose-built interaction surface, not CLI/file handoffs. The organization is in build phase and ops-warden must know that posture. INTENT.md principles 7 and 8 (added with this workplan) capture the direction.

Goal

warden plan "<need>" — a policy decision front door: given a need, answer autonomous / founder-act-required / unroutable, with the exact commands or the exact founder act, posture-stated.
Declared organization posture (build) as a third axis beside env posture (dev/test/prod) and workload maturity (M0–M3).
A founder interaction surface: local web page for the rare founder acts (approve, OIDC-login prompt, paste-once secret capture straight into OpenBao) — no values through CLI history or files.
Catalog freshness + agent guidance so ask-warden-first is the enforced default.

Design constraints (optimized 2026-07-18)

Compose, do not fork: warden plan must call the routing catalog + expand_handoff / resolvable; it must not re-implement keyword matching or invent a second catalog.
Org posture is a third axis: do not overload env posture or maturity.
Desk MVP is build-phase only: localhost, OS-session trust, stdlib HTTP server (pattern: net-kingdom security-bootstrap-console). No core-hub / whynot dependency for v1.
Reuse map (reuse.coulomb.social): flex-auth (policy-evaluate), key-cape (OIDC act), net-kingdom bootstrap console (localhost desk shape), railiance-platform (OpenBao custody). Do not rebuild those owners.

Delivery sequence

T02 (org posture)  ─┐
T05 (catalog freshness) ─┼─→ T01 (warden plan composes both)
T04 (playbook sweep) ───┘   (parallel once plan shape known)
T03 (desk)  ← after T01 can emit founder_required with a typed act

T05 is high priority: catalog staleness was the incident root cause.

Tasks

T02 — Declared organization posture (build phase)

id: WARDEN-WP-0029-T02
status: done
priority: high
state_hub_task_id: "73ae528c-384d-43dd-a62a-455a32ec1ea5"

Added organization_posture: build as axis C in registry/policy/security-posture.yaml (relaxations + graduation triggers). Surfaced in warden policy list/show, scorecard, and warden plan output.

T05 — Catalog freshness + agent guidance

id: WARDEN-WP-0029-T05
status: done
priority: high
state_hub_task_id: "2121d102-806a-424a-8b62-bd25d7a9324e"

Catalog.freshness() reports source (repo/bundled/override), content hash, mtime, package version, stale entry count, and warnings for bundled fallback. Human warden route list prints catalog line; plan JSON embeds catalog. Scorecard check catalog_freshness. AGENTS.md + credential-routing rules require warden plan before founder credential steps.

T01 — `warden plan` decision front door

id: WARDEN-WP-0029-T01
status: done
priority: high
state_hub_task_id: "32e4a755-fb74-4979-920f-32d44888df9d"

warden plan "<need>" [--actor] [--domain] [--json] composes catalog find + handoff + org posture + policy gate. Verdicts: autonomous / founder_required (oidc_login | approve | paste_once_provision) / unroutable (CCR stub). Metadata-only audit. Module: src/warden/plan.py.

T04 — Retire file-drop patterns from playbooks

id: WARDEN-WP-0029-T04
status: done
priority: medium
state_hub_task_id: "61d25118-14ec-4846-8d53-3e09d437cac3"

wiki/playbooks/forgejo-admin-api-token.md rewritten: plan-first, sanctioned transports (--exec/--out/--wrap), desk paste-once for provision; /tmp file drops marked retired. Consumer follow-ups noted for railiance-platform and binky-control docs.

T03 — Founder interaction surface (local web approval page)

id: WARDEN-WP-0029-T03
status: done
priority: medium
state_hub_task_id: "2ea768b7-d756-4c45-ac65-1670e069fafb"

warden desk — loopback ThreadingHTTPServer, short-lived token URL, acts approve / oidc_login / paste_once_provision (bao kv put via stdin, dry-run supported). Metadata-only audit open/close. Module: src/warden/desk.py.

Acceptance

warden plan "forgejo deploy key for binky-control" → autonomous / agent-harness-forgejo-deploy with access commands
Provision-style needs → founder_required with typed founder act
Posture build in plan + policy + scorecard
Desk approve flow (unit) with zero secrets in audit
No in-repo playbook instructs founder file drop as steady state
Catalog freshness on warden route list / plan JSON

5.9 KiB Raw Blame History Unescape Escape