coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/platform-supplier-credentials.md
tegwick d470f2e5a7
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Add platform-supplier-credentials pointer and review the OIDC RP follow-through 
WARDEN-WP-0043-T01: pointer lane and playbook for
platform/suppliers/<supplier>/<account>. railiance-platform owns the write;
warden_executes false.

WARDEN-WP-0044-T01: review of net-kingdom's oidc-browser-relying-party 1.0
follow_through section. Requires a per-step lane, a narrow
warden_executes, and value_handling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327285@bnt-lap001
Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
2026-10-08 23:25:22 +02:00

2.1 KiB
Raw Blame History

Supplier account credentials (platform/suppliers/)

Catalog: platform-supplier-credentials (status active, pointer only) Owner: railiance-platform, which owns the KV write and the credential-change.py allowlist Routing record: WARDEN-WP-0043

Founder decision, 2026-10-08: credentials we hold with a supplier live at platform/suppliers/<supplier>/<account> on the existing platform mount. Tenant commercial secrets stay on tenants/. ops-warden routes this shape. It does not store values and does not apply OpenBao.

Worker checklist

  1. Pick the path platform/suppliers/<supplier>/<account> (two levels, lowercase).
  2. To create or change the path, open a delegated credential change with railiance-platform. The credential-change.py allowlist does not yet accept platform/suppliers/ (WARDEN-WP-0043-T02).
  3. The founder provisions values on a trusted terminal from a mode-0600 file. Never put a value in git, State Hub, a workplan, a log, or chat.
  4. Verify with metadata and capabilities only: bao kv metadata get <path>, bao token capabilities <path>.

Existing accounts (not moved yet)

A path with a live reader stays where it is until that reader is retargeted.

Account Path today Future home
OpenRouter, llm-connect platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets platform/suppliers/openrouter/llm-connect
OpenRouter, rein-openweights reins/rein-openweights/openrouter platform/suppliers/openrouter/rein-openweights
Scaleway bootstrap platform/workloads/railiance/scaleway/bootstrap platform/suppliers/scaleway/bootstrap
Scaleway backup space platform/workloads/railiance/backup/object-storage platform/suppliers/scaleway/backup
IONOS transactional mailbox platform/workloads/email-connect/transactional platform/suppliers/ionos/email-connect-smtp
IONOS library mailbox platform/workloads/inbound-library/imap platform/suppliers/ionos/library-imap

llm-connect already tries the supplier path first and falls back to the workload path.