tegwick
d470f2e5a7
WARDEN-WP-0043-T01: pointer lane and playbook for platform/suppliers/<supplier>/<account>. railiance-platform owns the write; warden_executes false. WARDEN-WP-0044-T01: review of net-kingdom's oidc-browser-relying-party 1.0 follow_through section. Requires a per-step lane, a narrow warden_executes, and value_handling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# Supplier account credentials (`platform/suppliers/`)
|
|
|
|
Catalog: `platform-supplier-credentials` (status `active`, pointer only)
|
|
Owner: `railiance-platform`, which owns the KV write and the `credential-change.py` allowlist
|
|
Routing record: `WARDEN-WP-0043`
|
|
|
|
Founder decision, 2026-10-08: credentials we hold with a supplier live at
|
|
`platform/suppliers/<supplier>/<account>` on the existing `platform` mount.
|
|
Tenant commercial secrets stay on `tenants/`. ops-warden routes this shape. It
|
|
does not store values and does not apply OpenBao.
|
|
|
|
## Worker checklist
|
|
|
|
1. Pick the path `platform/suppliers/<supplier>/<account>` (two levels, lowercase).
|
|
2. To create or change the path, open a delegated credential change with
|
|
railiance-platform. The `credential-change.py` allowlist does not yet
|
|
accept `platform/suppliers/` (WARDEN-WP-0043-T02).
|
|
3. The founder provisions values on a trusted terminal from a mode-0600
|
|
file. Never put a value in git, State Hub, a workplan, a log, or chat.
|
|
4. Verify with metadata and capabilities only:
|
|
`bao kv metadata get <path>`, `bao token capabilities <path>`.
|
|
|
|
## Existing accounts (not moved yet)
|
|
|
|
A path with a live reader stays where it is until that reader is retargeted.
|
|
|
|
| Account | Path today | Future home |
|
|
| --- | --- | --- |
|
|
| OpenRouter, llm-connect | `platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets` | `platform/suppliers/openrouter/llm-connect` |
|
|
| OpenRouter, rein-openweights | `reins/rein-openweights/openrouter` | `platform/suppliers/openrouter/rein-openweights` |
|
|
| Scaleway bootstrap | `platform/workloads/railiance/scaleway/bootstrap` | `platform/suppliers/scaleway/bootstrap` |
|
|
| Scaleway backup space | `platform/workloads/railiance/backup/object-storage` | `platform/suppliers/scaleway/backup` |
|
|
| IONOS transactional mailbox | `platform/workloads/email-connect/transactional` | `platform/suppliers/ionos/email-connect-smtp` |
|
|
| IONOS library mailbox | `platform/workloads/inbound-library/imap` | `platform/suppliers/ionos/library-imap` |
|
|
|
|
llm-connect already tries the supplier path first and falls back to the
|
|
workload path.
|