tegwick
bd335ec724
secrets-engine (SECRETS-WP-0003) shipped a native secret-exec front door (`secrets-engine route/exec`, decision e6381a56) and asked ops-warden to route to it. Bernd's call: route-primary, proxy-fallback — surface the secrets-engine exec as the primary path for owned lanes, keep `warden access --exec` as a transparent fallback. T1 — RouteEntry gains exec_owner/exec_command/pointer_command (+ has_native_exec), screened for secret material like the other handoff fields. whynot-design-npm-publish points its native exec at secrets-engine. `warden access` renders Primary (secrets-engine exec) + Fallback (warden proxy); route/access JSON gain the fields and a native-exec-aware next_action. Tests added; 217 pass, lint clean. T2 — credential-routing.md adds secrets-engine as the secret-exec owner (route primary, proxy fallback); SCOPE adds secrets-engine to Related Repos and records the npm lane as production-exercised (@whynot/design@0.4.0); playbook leads with secrets-engine exec and fixes the fallback one-liner (--field NPM_AUTH_TOKEN, --no-policy) per whynot-design. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_access.py | ||
| test_ca.py | ||
| test_cli.py | ||
| test_config.py | ||
| test_doubles.py | ||
| test_flex_auth_registry.py | ||
| test_integration.py | ||
| test_inventory.py | ||
| test_models.py | ||
| test_policy.py | ||
| test_posture.py | ||
| test_posture_conformance.py | ||
| test_principals_drift.py | ||
| test_proxy.py | ||
| test_routing.py | ||
| test_scorecard.py | ||
| test_tunnel_cert_readiness.py | ||
| test_vault.py | ||