tegwick
5149946a4c
Ship posture-aware access planning: organization_posture=build (axis C), catalog freshness warnings, warden plan verdicts, localhost founder desk, and playbook/agent guidance that retire /tmp file-drop patterns. Compose route catalog + handoff rather than a second routing layer.
51 lines
1.9 KiB
Markdown
51 lines
1.9 KiB
Markdown
# agent-harness secret lanes
|
|
|
|
Canon: `binky-control/integrations/executor-worker-secrets.md`.
|
|
OpenBao paths / policies: `railiance-platform/docs/workload-kv-access-lanes.md`.
|
|
|
|
**Never paste secret values into chat, Git, hub events, or this wiki.**
|
|
|
|
## Lane 1 — LLM provider (reuse)
|
|
|
|
Catalog: `openrouter-llm-connect`. No new secret. Harness reuses the
|
|
activity-core llm-connect provider key path.
|
|
|
|
## Lane 2 forgejo deploy key
|
|
|
|
Catalog: `agent-harness-forgejo-deploy`
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| Host path (private key) | `~/.local/agent-harness/ssh/forgejo-deploy` on railiance01 |
|
|
| OpenBao path | `platform/workloads/agent-harness/forgejo-deploy-key` |
|
|
| Fields | `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY` |
|
|
| Policy | `workload-kv-read-agent-harness-forgejo` |
|
|
| SSH alias | `forgejo-agent-harness` (port 30022) |
|
|
| Repos (write deploy key) | `coulomb/executor-sandbox` first; add `binky-control` at cutover |
|
|
|
|
### Worker checklist
|
|
|
|
1. Confirm private key mode `600` under `~/.local/agent-harness/ssh/`.
|
|
2. `ssh -p 30022 -i ~/.local/agent-harness/ssh/forgejo-deploy -T git@forgejo.coulomb.social`
|
|
expects deploy-key success message (no shell).
|
|
3. Push only to granted repos (sandbox until cutover).
|
|
|
|
## Lane 3 mail approle
|
|
|
|
Catalog: `agent-harness-binky-mail-approle`
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| AppRole | `agent-harness-binky-mail` |
|
|
| Token policy | `workload-kv-read-binky-company-email-imap` (existing; no widen) |
|
|
| Host dir | `~/.local/agent-harness/approle-binky-mail/` (`role_id`, `secret_id`, mode 600) |
|
|
| Env | `EXECUTOR_APPROLE_DIR` (see `~/.local/agent-harness/env`) |
|
|
| Secret path | `tenants/binky/company-email/imap` |
|
|
|
|
### Worker checklist
|
|
|
|
1. `source ~/.local/agent-harness/env`
|
|
2. Login with role_id/secret_id → short-lived token (ttl 15m).
|
|
3. `bao kv get -field=IMAP_USERNAME|IMAP_PASSWORD …` — use only in process env;
|
|
never print.
|
|
4. Negative: same token must **not** read unrelated KV (e.g. forgejo-admin).
|