coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close warden-sign token lane

Browse source
This commit is contained in:
tegwick 2026-06-30 01:01:55 +02:00
parent 52e850f26b
commit e0ab1b8420
3 changed files with 64 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/warden-sign-auth-capability.md
View file

@ -198,3 +198,14 @@ BAO_ADDR=https://bao.coulomb.social \
secrets-engine revoke warden-sign \
--bootstrap-token-file ~/.secrets-engine/bootstrap/prod-warden-sign.token
```
## Closeout status
On 2026-06-29 ops-warden reported the joint production smoke as passed against
the flex-auth runtime and production OpenBao. Non-secret evidence only:
`warden sign agt-state-hub-bridge` returned policy decision
`decision:032b096c433ad80c`, `--ttl 999` was denied with
`ttl_out_of_bounds` before OpenBao signing, and the vault-backed allow path used
the scoped `warden-sign` lane. `policy.enabled` remains off until the ecosystem
moves from build-stage/pre-testing into the maturity posture where live
enforcement is appropriate.