tegwick
4c7ae86f68
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
113 lines
4.4 KiB
Markdown
113 lines
4.4 KiB
Markdown
---
|
|
id: WARDEN-WP-0043
|
|
type: workplan
|
|
title: "Route supplier credentials under platform/suppliers"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: finished
|
|
flavor: implementation
|
|
owner: grok
|
|
topic_slug: platform-suppliers
|
|
created: "2026-10-08"
|
|
updated: "2026-10-09"
|
|
depends_on: []
|
|
related:
|
|
- repo:railiance-platform
|
|
- repo:llm-connect
|
|
state_hub_workstream_id: "16aac061-977a-536b-a074-aba059f2475f"
|
|
---
|
|
|
|
# WARDEN-WP-0043 — Supplier credentials under platform/suppliers
|
|
|
|
Founder decision 2026-10-08: account credentials we hold with a supplier
|
|
live at `platform/suppliers/<supplier>/<account>` on the existing `platform`
|
|
KV mount. ops-warden routes that shape. It does not store the values and it
|
|
does not apply OpenBao. The KV write and the credential-change allowlist
|
|
belong to railiance-platform. Tenant commercial secrets stay on `tenants/`.
|
|
|
|
Workload and rein paths that already have a reader stay where they are
|
|
until that reader is retargeted:
|
|
|
|
| Account | Path today |
|
|
| --- | --- |
|
|
| OpenRouter, llm-connect | `platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets` |
|
|
| OpenRouter, rein-openweights | `reins/rein-openweights/openrouter` |
|
|
| Scaleway bootstrap | `platform/workloads/railiance/scaleway/bootstrap` |
|
|
| Scaleway backup space | `platform/workloads/railiance/backup/object-storage` |
|
|
| IONOS transactional mailbox | `platform/workloads/email-connect/transactional` |
|
|
| IONOS library mailbox | `platform/workloads/inbound-library/imap` |
|
|
|
|
The future homes are `platform/suppliers/openrouter/llm-connect`,
|
|
`platform/suppliers/openrouter/rein-openweights`,
|
|
`platform/suppliers/scaleway/bootstrap`, `platform/suppliers/scaleway/backup`,
|
|
`platform/suppliers/ionos/email-connect-smtp`, and
|
|
`platform/suppliers/ionos/library-imap`. Further suppliers use the same
|
|
two-level shape. llm-connect already tries the llm-connect supplier path
|
|
and then the live workload path before `OPENROUTER_API_KEY`.
|
|
|
|
## Catalog pointer
|
|
|
|
```task
|
|
id: WARDEN-WP-0043-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "7a86d91a-fcbd-5dc8-b3cf-4c28ad963474"
|
|
```
|
|
|
|
Add a pointer catalog entry and a short playbook for
|
|
`platform/suppliers/<supplier>/<account>`. `warden_executes: false`. The
|
|
owner of the KV write is railiance-platform. No secret values, no fetch
|
|
of a live field, and no new `warden` verb.
|
|
|
|
Done 2026-10-08: catalog `platform-supplier-credentials` plus
|
|
`wiki/playbooks/platform-supplier-credentials.md`.
|
|
|
|
## Allow the path in credential changes
|
|
|
|
```task
|
|
id: WARDEN-WP-0043-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c384b228-e710-580d-a3de-a3046a86e666"
|
|
```
|
|
|
|
`railiance-platform/scripts/credential-change.py` accepts `platform/workloads/`
|
|
and `tenants/` for a delegated change. `platform/suppliers/` needs that
|
|
allowlist widened before a CCR can create these paths. ops-warden does not
|
|
apply the change.
|
|
|
|
Done 2026-10-09: railiance-platform `b77cb41` maps mount `platform` to
|
|
`platform/workloads/` and `platform/suppliers/`. Under `suppliers/` it requires
|
|
exactly two non-empty segments, and tests cover `platform/suppliers/ionos/main`.
|
|
The IONOS CCR can now be drafted against this shape.
|
|
|
|
## Provision supplier accounts
|
|
|
|
```task
|
|
id: WARDEN-WP-0043-T03
|
|
status: done
|
|
priority: medium
|
|
needs_human: true
|
|
state_hub_task_id: "87996bc7-2f7a-578d-9f7c-8bd876605a47"
|
|
```
|
|
|
|
New supplier material is written from a mode-0600 file on a trusted
|
|
terminal, into `platform/suppliers/<supplier>/<account>`. IONOS is the
|
|
first account that still needs that home. Existing workload and rein
|
|
readers keep their current paths until each one is retargeted. Values do
|
|
not go into git, State Hub, workplans, logs, or chat.
|
|
|
|
2026-10-09: the IONOS stub exists. The founder ran the write through the
|
|
contained `openbao-platform-admin-login` envelope:
|
|
`bao kv put -cas=0 platform/suppliers/ionos/main` as version 1, with keys
|
|
`CUSTOMER_NUMBER`, `LOGIN`, `PASSWORD`, `API_KEY_PREFIX` and `API_KEY_SECRET`,
|
|
each set to the placeholder `FILL_ME`. A metadata-only check through the same
|
|
envelope exited 0. The founder fills the real values as version 2 in the
|
|
OpenBao UI. This task closes once that is done. No reader policy exists for the
|
|
path; a reader is requested through a railiance-platform CCR when a workload
|
|
needs it.
|
|
|
|
2026-10-09: done. The founder filled in the real values as version 2 through
|
|
the OpenBao UI. ops-warden did not read or verify any value. Further supplier
|
|
accounts follow the same playbook; existing workload and rein readers move only
|
|
when each reader is retargeted.
|