coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md
tegwick 9770d6ad66
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
docs: close Warden credential workplans 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
2026-09-01 00:51:52 +02:00

1.3 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated
WARDEN-WP-0035 workplan Register the Policy Nexus Forgejo source-read route infotech ops-warden finished codex policy-nexus-forgejo-source-read 2026-09-01 2026-09-01

Register the exact high-risk lane

id: WARDEN-WP-0035-T01
status: done
priority: high

Add the exact OpenBao path, field, OIDC role, owner pointer, and rotation boundary from railiance-platform CCR-2026-0014. The entry must be concrete and resolvable while remaining subject to Warden's high-risk agent read boundary.

Verify routing and governed use

id: WARDEN-WP-0035-T02
status: done
priority: high

Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove the installed route resolves and can hand the value only to a sanctioned child transport without printing or persisting it.

Completed 2026-09-01. All 406 selected tests passed, including the generated high-risk data-path boundary. The no-cache installed CLI resolves the exact lane, and warden plan returns only sanctioned --exec, --out, and --wrap transports for an agent caller. Policy Nexus Actions run 32 separately proved the installed credential against the complete private-source fetch and release path without exposing the value.