- warden/mask.py: fingerprint()/mask_value() — presence, length, 8-char sha256 prefix; never the value. - proxy.proxy_fetch_fingerprint + `warden access --fingerprint`: masked status view (presence/length/hash) that emits no value, so it bypasses the T02 stdout guard. Lets two parties compare sha256 prefixes to confirm a shared value without seeing it (e.g. rotation landed). - documented as defense-in-depth (raw bao bypasses it) in OperatorAccessAssist.md and the module docstring. - tests: tests/test_mask.py + CLI fingerprint test. 299 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| playbooks | ||
| AccessManagementDirective.md | ||
| AccessRouting.md | ||
| ActorInventoryPatterns.md | ||
| AuditTrail.md | ||
| CertCommandInterface.md | ||
| CredentialRouting.md | ||
| InterHubBootstrapAccessLane.md | ||
| NetKingdomSecurityMap.md | ||
| OpenBaoSshEngineChecklist.md | ||
| OperatorAccessAssist.md | ||
| OpsWardenConfig.md | ||
| OpsWardenMemory.md | ||
| PolicyGatedSigning.md | ||
| WorkloadSecurityPosture.md | ||