coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
Operations credential management
289 commits 2 branches 2 tags 3.2 MiB
Find a file
tegwick f815bb35ca Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 
The security layer model moved v0.1 -> v0.4 (accepted) after ops-warden's
assent. Both §5 asks from ADR-0010 were adopted: §5.2 now sanctions the conduit
shape on the supplied-authority property, and §5.3 is the declared engine gap
amendment, carrying the four fields verbatim and crediting ops-warden's
delegation machinery as prior art.

Which creates an obligation. §5.3 requires those fields MACHINE-READABLY, and
§11 makes "every direct Tooling client maps to a declared §5.1/§5.2/§5.3 entry"
a mechanical check. ops-warden's declaration was prose in INTENT.md — the repo
that proposed the shape was not implementing it.

layer.yaml is the map: 5 contacts (2 declared gaps, 1 read-only observation,
2 conduits) plus the non-Tooling clients recorded explicitly so the check is
total rather than silently selective.

scripts/check_layer_conformance.py enforces it and found three undeclared
modules on its first run — all false positives (help text, a docstring, and the
doubles library that SIMULATES bao rather than calling it), which is why the
scan now matches invocation shapes instead of the word: an httpx call built
against the configured OpenBao address, or an argv whose first element is the
bao binary.

tests/test_layer_conformance.py adds the §5.2 test the standard says SHOULD
exist: _caller_env() returns the caller's environment unchanged, and proxy.py
is asserted not to reference X-Vault-Token, approle login, or token create — a
conduit that presents its own token is not a conduit.

No assertion on review dates, deliberately: a date-triggered failure breaks the
build on a calendar day with no code change, the same reasoning WP-0033-T05
recorded for blocker staleness.

398 tests pass, ruff clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c
2026-08-29 02:45:29 +02:00
.claude/rules Assent to the NetKingdom security layer model (WARDEN-IN-0001) 2026-08-28 21:47:44 +02:00
.forgejo/workflows Add Forgejo CI smoke workflow (enablement template) 2026-07-08 12:35:30 +02:00
.repo-manager Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
deploy/kubernetes WARDEN-WP-0031 T04: prove ops-warden's caller identity against the live pin 2026-08-19 19:06:04 +02:00
docs Assent to the NetKingdom security layer model (WARDEN-IN-0001) 2026-08-28 21:47:44 +02:00
examples feat: adopt security zones and explicit workload refs 2026-08-22 15:36:37 +02:00
history Assent to the NetKingdom security layer model (WARDEN-IN-0001) 2026-08-28 21:47:44 +02:00
intakes repo.work.create_intake WARDEN-IN-0002 2026-08-28 22:40:24 +02:00
interfaces/reviews docs: project remaining WP0027 owner gates 2026-08-22 23:50:46 +02:00
registry Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
scripts Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
src/warden fix: contain attended OpenBao login output 2026-08-23 01:31:05 +02:00
systemd feat(WARDEN-WP-0021): T1+T2 — scheduled worker tick enabled (systemd --user timer) 2026-06-30 15:19:23 +02:00
tests Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
wiki Add NetKingdom SSO credential routing lanes 2026-08-23 21:43:12 +02:00
workplans WARDEN-WP-0027-T02: the owner gate closed five days ago 2026-08-28 22:01:47 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-28 22:02:58 +02:00
.gitignore feat(WP-0011): warden route lookup CLI over the pointer catalog 2026-06-18 21:07:13 +02:00
.repo-classification.yaml Mark .repo-classification.yaml human-reviewed (CUST-WP-0050 T02) 2026-06-22 11:40:44 +02:00
AGENTS.md docs(agents): repoint remote State Hub URL to the in-cluster address 2026-08-25 00:21:31 +02:00
CLAUDE.md Adopt risk-nexus finding routing; record the ADR gap policy-nexus exposes 2026-08-18 13:04:50 +02:00
INTENT.md Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
layer.yaml Implement §5.3 machine-readably — layer.yaml, checker, conformance tests 2026-08-29 02:45:29 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:42:48 +02:00
Makefile Add Makefile targets to install and verify phase-memory with warden. 2026-07-03 00:54:21 +02:00
pyproject.toml Release v0.1.2. 2026-07-07 16:59:22 +02:00
README.md Release v0.1.2. 2026-07-07 16:59:22 +02:00
SCOPE.md Assent to the NetKingdom security layer model (WARDEN-IN-0001) 2026-08-28 21:47:44 +02:00
tenancy.yaml feat: adopt security zones and explicit workload refs 2026-08-22 15:36:37 +02:00
uv.lock Release v0.1.2. 2026-07-07 16:59:22 +02:00
WORK-RECORDS.md Refresh work-record index 2026-08-28 22:43:06 +02:00

README.md

ops-warden

SSH Certificate Authority and certificate lifecycle manager for the ops fleet. Signs short-lived certs for adm / agt / atm actors and exposes the cert_command interface consumed by ops-bridge and other tooling.

See INTENT.md for direction, SCOPE.md for current implementation, and wiki/AccessManagementDirective.md for SSH policy. ops-warden issues SSH certs and routes every other credential need to its owner — see wiki/AccessRouting.md. Latest gap analysis: history/2026-06-17-post-wp0007-reassessment.md.

Get the source (Forgejo)

Canonical repo: https://forgejo.coulomb.social/coulomb/ops-warden
Releases: https://forgejo.coulomb.social/coulomb/ops-warden/releases

HTTPS clone:

git clone https://forgejo.coulomb.social/coulomb/ops-warden.git ~/ops-warden
cd ~/ops-warden

SSH clone (recommended for push/pull; add to ~/.ssh/config if missing):

Host forgejo-remote
    HostName 92.205.62.239
    Port 30022
    User git
    IdentityFile ~/.ssh/id_gitea
    StrictHostKeyChecking accept-new

git clone forgejo-remote:coulomb/ops-warden.git ~/ops-warden
cd ~/ops-warden

Legacy Gitea remotes (gitea-remote, gitea.coulomb.social) still work during migration; new checkouts should use Forgejo.

Install

From a Forgejo checkout:

Recommended (warden + experiential memory for route/worker/agent sessions):

make install-all
make verify-memory

SSH-only install (no phase-memory):

make install

Manual equivalent:

uv sync
uv tool install . --with-editable ../phase-memory --force

Or run without installing:

uv run warden --help

phase-memory must be a sibling checkout at ../phase-memory by default, or set PHASE_MEMORY_REPO when running make. Opt out of memory at runtime with WARDEN_MEMORY=0.

Upgrade after a release

When a new tag is published on Forgejo (e.g. v0.1.2):

cd ~/ops-warden
git fetch --tags origin
git pull --ff-only
make install-all
warden route list   # sanity check the installed CLI

If warden still behaves like an older build (same version string but missing recent subcommands or fixes), clear the cached wheel and reinstall:

uv cache clean ops-warden
uv tool install . --with-editable ../phase-memory --reinstall --force

Check out a specific release:

git fetch --tags origin
git checkout v0.1.2
make install-all

Quick start (local backend)

# One-time: generate a CA key (keep mode 600, never commit)
ssh-keygen -t ed25519 -f ~/.ssh/ops-ca-user -C "Ops SSH User CA" -N ""

# Configure warden (~/.config/warden/warden.yaml) — see wiki/OpsWardenConfig.md
warden inventory add agt-example --type agt --principal agt-example
warden sign agt-example --pubkey ~/.ssh/id_ed25519.pub
warden status agt-example
warden scorecard

Production uses the vault backend against OpenBao or HashiCorp Vault (Vault-compatible SSH secrets engine API). Template: examples/warden.production.example.yaml. See wiki/OpsWardenConfig.md and wiki/OpenBaoSshEngineChecklist.md.

Routing lookup (warden route)

ops-warden issues SSH certs and routes every other credential need to its owner. The route command group is a read-only lookup over the pointer catalog (registry/routing/catalog.yaml) — it never calls another subsystem or returns secrets.

warden route list [--all] [--json]                    # scenarios (active-only unless --all)
warden route list --stale [--stale-days 90] [--all]   # past review cadence
warden route show <id> [--json]                       # owner + wiki/canon pointers; SSH adds steps
warden route find "issue an api key"                  # rank scenarios by keyword overlap

Full role and examples: wiki/AccessRouting.md.

Development

make install-all
make test
make lint
uv run pytest -m integration   # requires ssh-keygen in PATH

Key paths

Path Purpose
~/.config/warden/warden.yaml Backend and CA/Vault settings
~/.config/warden/inventory.yaml Actor → principals registry
~/.local/state/warden/ Signed certs, keys, signatures.log

Documentation

  • INTENT.md — operational access steward mission (NetKingdom-aligned)
  • wiki/CredentialRouting.md — which subsystem for each credential type
  • wiki/NetKingdomSecurityMap.md — platform security component map
  • wiki/ActorInventoryPatterns.md — standard adm/agt/atm actor patterns
  • wiki/OpsWardenConfig.md — configuration reference
  • wiki/CertCommandInterface.md — cert_command contract for callers
  • wiki/InterHubBootstrapAccessLane.md — short-lived cert envelope for bootstrap tasks

Workplans

Active and proposed work lives in workplans/. Finished plans are archived under workplans/archived/.