coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/registry
History
tegwick 6e66a56653 fix(routing): state-hub lane uses Kubernetes auth, not an AppRole 
The construction plan proposed an AppRole from a survey written with no
OpenBao session. The phase-4 live survey found kubernetes/ auth already
enabled on this cluster with four external-secrets-* roles using it, and
the founder ruled for it on 2026-08-27.

The pod authenticates with its own projected ServiceAccount token, so the
lane has no role_id/secret_id to deliver, store, or rotate. Bound to
state-hub/state-hub and deliberately not to default, which would grant
the lane to every pod in the namespace.

Policy and role are built and capability-verified. Entry stays draft: the
KV path holds no token until paste_once_provision delivers one, and the
ServiceAccount does not exist yet (STATE-WP-0084-T02).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
2026-08-27 22:49:03 +02:00
..
capabilities docs(WP-0010): sharpen mission to "issue SSH, route the rest" + pointer catalog 2026-06-18 20:44:53 +02:00
flex-auth feat: adopt security zones and explicit workload refs 2026-08-22 15:36:37 +02:00
generated chore(registry): regenerate high-risk data paths 2026-08-26 21:56:55 +02:00
indexes WARDEN-WP-0006: NetKingdom stewardship docs and alignment 2026-06-17 08:22:45 +02:00
policy WARDEN-WP-0029: implement plan front door, org posture, desk, freshness 2026-07-18 16:59:37 +02:00
routing fix(routing): state-hub lane uses Kubernetes auth, not an AppRole 2026-08-27 22:49:03 +02:00
README.md Add capability registry scaffold (REUSE-WP-0014-T06 B04) 2026-06-16 01:56:08 +02:00

README.md

Capability Registry

Markdown-first capability index for federation and reuse planning.

Authoring

  1. Copy a capability entry template (see reuse-surface templates/capability-entry.template.md).
  2. Add the row to indexes/capabilities.yaml.
  3. Run reuse-surface validate from a checkout with the CLI installed.
  4. Merge to main and verify publish with reuse-surface establish --publish-check.

Federation contract: reuse-surface docs/RegistryFederation.md.