## Status

Accepted. Stated as INTENT §9, made structural by WARDEN-WP-0030 (delegation register).

## Context

ops-warden owns exactly one lane: SSH certificate issuance. It nonetheless fronts around eleven credential lanes as a caller-identity proxy, because no other component fronts them yet and a worker blocked on a credential is a worker blocked.

Covering a gap is legitimate and this repo intends to keep doing it. The failure is subtler: a cover that is never recorded as a cover becomes ownership by default. Nobody decides to permanently own another component's lane. It happens because the interim arrangement worked, nobody wrote down that it was interim, and the intended owner never learned they were expected to build a front door.

By August 2026 the primitive to hand a lane back existed and was proven — `exec_owner` / `exec_command`, used by secrets-engine for npm publish and by the railiance-platform credential broker for warden-sign — and was used by 2 of 24 lanes. The other twenty-two had no record of who should own them.

## Decision

Every catalog entry carries a `delegation:` block, with a `mode:` of:

`mode` | Meaning
--- | ---
`permanent` | Ours forever. SSH certificate issuance, and nothing else
`native` | The owner has a front door; we route to it and execute nothing
`interim` | We are covering a gap. Requires `intended_owner:` and `blocked_on:`

`interim` without an `intended_owner` is not permitted. If we cannot name who should own it, we have not understood the lane well enough to be fronting it.

`blocked_on:` must name a specific condition, not a mood. "No front door yet" is not a blocker; "secrets-engine has not confirmed whether `exec --catalog` generalizes over arbitrary OpenBao lanes (asked 2026-08-11, msg 7d55d332)" is. A blocker with a question and a date can be chased. A blocker without one is an excuse with a timestamp.

The interim set is queryable: `warden route gaps` lists it with review dates and staleness. A cover that nobody can enumerate is a cover nobody will retire.

A blocker is a claim about the world at a date, and expires. `reviewed:` is bumped only on a real re-check, never inherited. This was learned the hard way: `RISK-F-0001` invalidated one of our blockers within a day and nothing would have re-checked it.

## Consequences

Retiring a cover is a normal, expected event rather than a renegotiation. When an owner ships their front door the lane flips `interim` → `native`. This has happened twice and both were routine.

Other repos can see what we are holding for them. The register is why key-cape and user-engine were able to confirm or decline lanes in August 2026 — the question was answerable because it had been written down. One of those answers was "not ours", which is a legitimate and useful outcome.

We accept looking worse than we are. `warden route gaps` publishes a list of things this repo is doing that it would rather not be doing. That is the intent: the alternative is a repo that looks clean because nobody counted.

This register is not a risk register. Interim lanes are tracked work with an owner and a date, not defects. They do not get bulk-filed into `risk-nexus`, which needs to stay small enough to read. Defects go there; gaps stay here.

## Related

- `INTENT.md` §9 — the principle this formalizes
- `history/2026-08-11-delegation-surface-assessment.md` — the assessment that forced it
- `.claude/rules/finding-routing.md` — the register-versus-findings boundary