coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document scope alignment and warden-sign readiness

Browse source
This commit is contained in:
tegwick 2026-06-30 00:52:05 +02:00
parent d8aadaffe3
commit ae685f3a0a
10 changed files with 736 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

29
workplans/SECRETS-WP-0004-warden-sign-token-lane.md
View file

@ -123,6 +123,23 @@ waiting on an approved SECRETS-WP-0004 decision/workplan gate plus a mode-0600
production bootstrap token outside any repo. The pending token path/revocation
row is recorded in `docs/hardening-backlog.md` H0.
2026-06-29: Attended ops-warden follow-up message
`92de2614-061f-4241-aa13-a3ce72ad41d5`. Production OpenBao is unsealed and the
dry-run apply plan is valid for exact `update` grants on `ssh/sign/agt-role`,
`ssh/sign/adm-role`, and `ssh/sign/atm-role`. Live apply remains blocked because
`secrets-engine route warden-sign --json` reports `decision_status: missing`
for `SECRETS-WP-0004`, and the documented lane bootstrap token file
`~/.secrets-engine/bootstrap/prod-warden-sign.token` is absent. A broader
platform-admin token file exists with mode `600`; it was not used to bypass the
missing lane decision or the documented bootstrap handoff.
2026-06-30: Approval mirror `.decisions/SECRETS-WP-0004.yaml` is now present
and `secrets-engine route warden-sign --json` reports `decision_status:
resolved` for canonical decision `4589dcb7-c0df-4073-9a0b-4f80a0fcdb93`.
Readiness remains false because the OpenBao `warden-sign` policy/AppRole has
not been applied (`metadata_applied: false`), and the documented lane bootstrap
token file is still absent. Live apply and handoff were not executed.
Apply the policy + AppRole on `https://bao.coulomb.social` using a mode-0600
bootstrap token stored outside any repo. Idempotent re-apply.
@ -157,6 +174,18 @@ and attaching only policy `warden-sign`. Replied to ops-warden in State Hub
message `0bce1e08-58c2-4db4-b06c-f86cf8142273`; no token value, role_id,
secret_id, or token accessor was included.
2026-06-29: ops-warden follow-up message
`92de2614-061f-4241-aa13-a3ce72ad41d5` requested the AppRole handoff as the
preferred end-state. Handoff was not executed because live apply is still gated
by the missing approved decision and missing lane bootstrap token. Once those
blockers clear, the intended handoff remains single-use AppRole material written
to mode-0600 files outside any Git worktree and delivered to Bernd out-of-band.
2026-06-30: The decision gate is now resolved by the offline approval mirror,
so handoff is waiting on live OpenBao apply plus an attended, out-of-band
bootstrap path. No `role_id`, `secret_id`, token value, token accessor, or
smoke output was written to Git or State Hub.
Define and execute the handoff: mint a fresh `secret_id`, deliver it (with the
`role_id`) to the operator out-of-band; warden does `approle login` to obtain a
`VAULT_TOKEN`. Post the non-secret pointers on the ops-warden thread (policy name,