tegwick 5c6b71b83b

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 3s

Details

WARDEN-WP-0029: optimize workplan sequence, constraints, reuse map

Reorder for delivery (T02/T05 → T01 → T04 → T03), raise T05 priority for
catalog-staleness root cause, add compose/third-axis/desk non-goals, and
document reuse.coulomb.social building blocks.

2026-07-18 16:50:23 +02:00

7.2 KiB

Raw Blame History

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
WARDEN-WP-0029	workplan	Policy front door: posture-aware access planning + founder interaction surface	infotech	ops-warden	active	codex	custodian	high	29	2026-07-18	2026-07-18	6e396e7e-99c5-43aa-98a0-27f157de12a3

WARDEN-WP-0029 — Policy front door + founder interaction surface

Origin

Founder directive 2026-07-18 (binky-control cutover prep): agents proposed raw credential mechanics to the founder ("attach the deploy key in the forgejo UI", "save the PAT to /tmp/...") although a catalogued lane (forgejo-admin-api-token, WARDEN-WP-0025) already covered the need — the installed CLI's catalog was stale, and nothing forced the ask-warden-first step. Directive: ops-warden is the service to ask what can and needs to be done per NetKingdom policy; the founder is bothered only when policy makes it absolutely necessary, and then preferably via a purpose-built interaction surface, not CLI/file handoffs. The organization is in build phase and ops-warden must know that posture. INTENT.md principles 7 and 8 (added with this workplan) capture the direction.

Goal

warden plan "<need>" — a policy decision front door: given a need, answer autonomous / founder-act-required / unroutable, with the exact commands or the exact founder act, posture-stated.
Declared organization posture (build) as a third axis beside env posture (dev/test/prod) and workload maturity (M0–M3).
A founder interaction surface: local web page for the rare founder acts (approve, OIDC-login prompt, paste-once secret capture straight into OpenBao) — no values through CLI history or files.
Catalog freshness + agent guidance so ask-warden-first is the enforced default.

Design constraints (optimized 2026-07-18)

Compose, do not fork: warden plan must call the routing catalog + expand_handoff / resolvable; it must not re-implement keyword matching or invent a second catalog.
Org posture is a third axis: do not overload env posture or maturity.
Desk MVP is build-phase only: localhost, OS-session trust, stdlib HTTP server (pattern: net-kingdom security-bootstrap-console). No core-hub / whynot dependency for v1.
Reuse map (reuse.coulomb.social): flex-auth (policy-evaluate), key-cape (OIDC act), net-kingdom bootstrap console (localhost desk shape), railiance-platform (OpenBao custody). Do not rebuild those owners.

Delivery sequence

T02 (org posture)  ─┐
T05 (catalog freshness) ─┼─→ T01 (warden plan composes both)
T04 (playbook sweep) ───┘   (parallel once plan shape known)
T03 (desk)  ← after T01 can emit founder_required with a typed act

T05 is high priority: catalog staleness was the incident root cause.

Tasks

T02 — Declared organization posture (build phase)

id: WARDEN-WP-0029-T02
status: todo
priority: high
state_hub_task_id: "73ae528c-384d-43dd-a62a-455a32ec1ea5"

Add organization_posture: build as a third axis in registry policy configuration (alongside env posture dev/test/prod and workload maturity M0–M3 — do not overload those axes), with build-phase policy relaxations spelled out (workstation OIDC acceptable, per-repo deploy keys, advisory flex-auth) and the graduation triggers (first customer data, first non-founder operator, prod tier). warden plan, warden policy, and scorecard must state the posture in their output.

T05 — Catalog freshness + agent guidance

id: WARDEN-WP-0029-T05
status: todo
priority: high
state_hub_task_id: "2121d102-806a-424a-8b62-bd25d7a9324e"

The stale-CLI failure mode: warden resolved an old bundled catalog and hid an existing lane. Add a catalog version/freshness check (source path, content hash or mtime, package version, warn when using bundled fallback or when reviewed entries are stale; warden route list shows catalog date) and update AGENTS/CLAUDE guidance in ops-warden: agents must run warden plan before ever drafting a founder credential step. (Consuming-repo snippets are out of band — pointer only.)

T01 — `warden plan` decision front door

id: WARDEN-WP-0029-T01
status: todo
priority: high
state_hub_task_id: "32e4a755-fb74-4979-920f-32d44888df9d"

New command: warden plan "<need>" [--actor agt-...] [--domain ...]. Composes routing catalog (find / RouteEntry) + expand_handoff + resolvable + organization posture + policy gate status. Returns a typed verdict: autonomous (with the exec-capable command sequence), founder_required (with a typed founder act: oidc_login | approve | paste_once_provision), or unroutable (with a CCR proposal stub). JSON output for agents. Every plan call audited (metadata only). Does not duplicate keyword matching or hold secret values.

T04 — Retire file-drop patterns from playbooks

id: WARDEN-WP-0029-T04
status: todo
priority: medium
state_hub_task_id: "61d25118-14ec-4846-8d53-3e09d437cac3"

Sweep wiki/playbooks (starting with forgejo-admin-api-token.md /tmp/forgejo-tegwick-api-token steady-state remnants) and replace file drops with warden access --exec / --out / --wrap lanes or T03 paste-once capture. Document consumer follow-ups (railiance-platform forgejo_package_prune, binky-control cutover) as pointers — in-repo playbooks must not instruct founder file drops.

T03 — Founder interaction surface (local web approval page)

id: WARDEN-WP-0029-T03
status: todo
priority: medium
state_hub_task_id: "2ea768b7-d756-4c45-ac65-1670e069fafb"

warden desk: serves a localhost, short-lived page when a plan needs a founder act — renders the exact action in plain language (approve/deny, launch OIDC login, or paste-once secret capture that writes straight to the OpenBao path and never echoes). No values in terminal scrollback, shell history, or durable files. Metadata-only audit per interaction.

Build-phase non-goals: multi-user auth, remote bind, core-hub / whynot UI stack. Pattern: stdlib ThreadingHTTPServer on 127.0.0.1 only (see net-kingdom security-bootstrap-console). Hardening graduates with org posture.

Acceptance

warden plan "forgejo deploy key for binky-control" returns autonomous with the admin-lane command sequence; warden plan for a need that only matches a non-resolvable / provision-needed path returns founder_required with exactly one typed founder act.
Posture build visible in plan output and scorecard.
warden desk can complete one founder act (approve or paste-once) with zero secret values in CLI/files/audit payload.
No in-repo playbook instructs a founder file drop as steady state.
Catalog freshness is visible on warden route list / plan JSON.

7.2 KiB Raw Blame History Unescape Escape