coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md
tegwick 90829d5505
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
SCOPE/docs: WARDEN-WP-0045 per-actor limits; OpenBao via bridge tunnel; editable install 
Record the per-actor extension allow-list and max_ttl_hours ceiling with the
agt-custodian profile. Point production examples at the ops-bridge OpenBao
tunnel (127.0.0.1:18200) now that bao.coulomb.social is no longer public, and
document the editable install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
2026-10-21 00:02:15 +02:00

4.7 KiB
Raw Blame History

id name summary owner status domain tags maturity external_evidence discovery availability relations consumer_guidance evidence
capability.security.ssh-certificate-issuance Decision-bound SSH certificates warden sign with local and OpenBao backends and adm/agt/atm actors. ops-warden draft helix_forge
ssh
certificate
ca
ops-warden
openbao
security
netkingdom
framework-reuse
discovery availability
current target confidence rationale
D4 D5 medium SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command contract are documented; production OpenBao integration is documented but engine deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable.
current target confidence rationale
A3 A5 medium Source interface assessed 2026-10-14: warden sign with local and OpenBao backends and adm/agt/atm actors. Availability describes the delivery form, not production acceptance. Direct Tooling contact is a declared gap; certificate reachability is not target authorization.
completeness reliability
level name confidence basis satisfied_expectations broken_expectations out_of_scope_expectations
C3 Functional Core medium scope_vs_intent_and_consumer_expectations
local and OpenBao/Vault-compatible signing backends
TTL policy enforcement per actor type
principals inventory and cert-side scorecard
signatures audit log and stale-cert cleanup
cert_command stdout contract for ops-bridge
per-actor extension allow-list and max_ttl_hours ceiling (WARDEN-WP-0045)
host-side principal deployment not owned here
OpenBao SSH engine mount not deployed from this repo
long-lived API key custody
tunnel lifecycle management
Vault/OpenBao cluster operations
level name confidence basis known_reliability_risks
R2 Tolerable medium consumer_quality_signals
production signing depends on OpenBao availability and token policy
local backend requires protected CA key handling by operators
intent includes excludes assumptions use_cases research_memos
warden sign with local and OpenBao backends and adm/agt/atm actors
warden sign with local and OpenBao backends and adm/agt/atm actors
Direct Tooling contact is a declared gap; certificate reachability is not target authorization
callers supply actor public keys; humans self-issue admin keys
production platform uses OpenBao with Vault-compatible SSH engine API
ops-bridge tunnel cert_command
Inter-Hub bootstrap short-lived agent access
U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
ops-warden/SCOPE.md
ops-warden/wiki/CertCommandInterface.md
ops-warden/wiki/OpsWardenConfig.md
ops-warden/wiki/AccessRouting.md
current_level target_level current_artifacts target_artifacts consumption_modes
A3 A5
SCOPE.md
README.md
packaged ops-warden release with documented OpenBao role bootstrap
`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)
library
CLI
depends_on supports related_to
capability.security.credential-lifecycle
capability.authorization.policy-evaluate
capability.ops.tunnel-bridge
capability.security.structure-construction
recommended_for not_recommended_for known_limitations
Operator or automation obtains a bounded SSH certificate and maintains private connectivity
Direct Tooling contact is a declared gap; certificate reachability is not target authorization
Direct Tooling contact is a declared gap; certificate reachability is not target authorization
2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.
documentation
SCOPE.md
README.md

Decision-bound SSH certificates

warden sign with local and OpenBao backends and adm/agt/atm actors.

Reuse boundary

Direct Tooling contact is a declared gap; certificate reachability is not target authorization.

Supported use cases

  • U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

Evidence and integration

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.