- routing model: RotationGuide (method rotate|re-establish, steps, owner, automatable), RouteEntry.rotation + has_rotation + vends_secret. - catalog parser: validate rotation block; secret-material screen gains a prose-safe mode (high-entropy detector only) so authored steps aren't tripped by substrings like "s."/"exists.". - CLI: `warden rotate-guide <id>` (human + --json); route show --json now carries has_rotation + rotation. - scorecard: catalog_rotation_coverage — every active secret-vending lane must carry a rotation block (SSH/login/pointer lanes exempt). Promotion checklist criterion 9. - data: rotation blocks for all 7 active vending lanes + the draft railiance-backup lane (re-establish: age keypair regen + re-encrypt). - fix pre-existing collision: bare `npm` keyword on forgejo-admin -> forgejo-npm so "npm token" routes to the generic lane (restores test_access expectations). - tests: rotation parse/coverage/prose-screen/CLI in tests/test_routing.py; scorecard count 6 -> 7. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| playbooks | ||
| AccessManagementDirective.md | ||
| AccessRouting.md | ||
| ActorInventoryPatterns.md | ||
| AuditTrail.md | ||
| CertCommandInterface.md | ||
| CredentialRouting.md | ||
| InterHubBootstrapAccessLane.md | ||
| NetKingdomSecurityMap.md | ||
| OpenBaoSshEngineChecklist.md | ||
| OperatorAccessAssist.md | ||
| OpsWardenConfig.md | ||
| OpsWardenMemory.md | ||
| PolicyGatedSigning.md | ||
| WorkloadSecurityPosture.md | ||