132 lines
6.4 KiB
Diff
132 lines
6.4 KiB
Diff
diff --git a/src/warden/routing/catalog.py b/src/warden/routing/catalog.py
|
|
index 54af6db..a8a0236 100644
|
|
--- a/src/warden/routing/catalog.py
|
|
+++ b/src/warden/routing/catalog.py
|
|
@@ -206,6 +206,14 @@ def _openbao_configuration_need(query: str) -> bool:
|
|
first; reads and surveys continue through ordinary catalog ranking.
|
|
"""
|
|
text = query.lower().replace("-", " ")
|
|
+ # The attended administration front door is itself explicit intent. Its
|
|
+ # reviewed operation may concern signer custody or KV metadata rather than
|
|
+ # one of the control nouns below; keyword ranking must not turn that into a
|
|
+ # metadata-survey approval. This selects identity, never grants authority.
|
|
+ if (re.search(r"\battended\b", text)
|
|
+ and re.search(r"\bplatform\s+administration\b", text)
|
|
+ and re.search(r"\bopenbao\b", text)):
|
|
+ return True
|
|
control = re.search(r"\b(?:polic(?:y|ies)|auth\s+roles?|token\s+roles?|"
|
|
r"database\s*(?:/| )\s*config|secrets?\s+engine)\b", text)
|
|
change = re.search(r"\b(?:configure|configuring|create|apply|install|update|"
|
|
diff --git a/tests/test_openbao_configuration_routing.py b/tests/test_openbao_configuration_routing.py
|
|
index d85efee..4e831f2 100644
|
|
--- a/tests/test_openbao_configuration_routing.py
|
|
+++ b/tests/test_openbao_configuration_routing.py
|
|
@@ -1,4 +1,5 @@
|
|
"""Configuration intent must never inherit a metadata survey's founder act."""
|
|
+from dataclasses import replace
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
@@ -9,6 +10,8 @@ from warden.routing.catalog import Catalog, load_catalog
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
NEED = ('attended OpenBao platform administration to configure read policies and auth roles '
|
|
'for Coulomb and email backup delivery')
|
|
+SIGNER_NEED = ('attended OpenBao platform administration for reviewed flex-auth '
|
|
+ 'signer custody CAS0 and fixed KV metadata')
|
|
|
|
|
|
@pytest.fixture
|
|
@@ -18,18 +21,24 @@ def catalog(monkeypatch):
|
|
|
|
|
|
@pytest.mark.parametrize('need', [NEED,
|
|
+ SIGNER_NEED,
|
|
+ 'Attended OpenBao platform administration login',
|
|
'configure OpenBao policies and Kubernetes auth roles for backup delivery',
|
|
'apply OpenBao read policy for an explicitly reviewed service account'])
|
|
def test_configuration_requires_attended_admin_identity(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
assert plan.lane_id == 'openbao-platform-admin-login'
|
|
assert plan.verdict == 'founder_required' and plan.founder_act.kind == 'oidc_login'
|
|
+ assert plan.commands == [
|
|
+ 'warden access openbao-platform-admin-login --exec -- <reviewed-command>',
|
|
+ '# owner login is contained by warden; do not invoke it separately']
|
|
assert all('--fetch' not in command and '--out' not in command for command in plan.commands)
|
|
|
|
|
|
@pytest.mark.parametrize('need', [
|
|
'survey existing OpenBao policies and roles for backup delivery',
|
|
'OpenBao read-only metadata survey policy approle consumer backup',
|
|
+ 'survey OpenBao signer custody CAS0 and fixed KV metadata',
|
|
'inspect OpenBao structure metadata policy approle'])
|
|
def test_survey_remains_metadata_only(catalog, need):
|
|
plan = build_plan(need, catalog=catalog)
|
|
@@ -37,11 +46,23 @@ def test_survey_remains_metadata_only(catalog, need):
|
|
assert plan.founder_act.kind == 'approve'
|
|
|
|
|
|
-def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog):
|
|
+@pytest.mark.parametrize('need', [NEED, SIGNER_NEED])
|
|
+def test_explicit_lane_id_still_wins_and_missing_admin_fails_closed(catalog, need):
|
|
assert catalog.find('openbao-structure-survey')[0].id == 'openbao-structure-survey'
|
|
unavailable = Catalog(catalog.path, [entry for entry in catalog.entries
|
|
if entry.id != 'openbao-platform-admin-login'])
|
|
- plan = build_plan(NEED, catalog=unavailable)
|
|
+ plan = build_plan(need, catalog=unavailable)
|
|
+ assert plan.verdict == 'unroutable' and plan.lane_id is None
|
|
+ assert not plan.commands
|
|
+
|
|
+
|
|
+@pytest.mark.parametrize('changes', [{'status': 'draft'}, {'lane': 'secret'}])
|
|
+def test_attended_admin_cannot_use_inactive_or_secret_lane(catalog, changes):
|
|
+ admin = catalog.get('openbao-platform-admin-login')
|
|
+ unavailable = Catalog(catalog.path, [
|
|
+ replace(entry, **changes) if entry.id == admin.id else entry
|
|
+ for entry in catalog.entries])
|
|
+ plan = build_plan(SIGNER_NEED, catalog=unavailable, include_draft=True)
|
|
assert plan.verdict == 'unroutable' and plan.lane_id is None
|
|
assert not plan.commands
|
|
|
|
diff --git a/workplans/WARDEN-WP-0038-plan-mutation-intent.md b/workplans/WARDEN-WP-0038-plan-mutation-intent.md
|
|
index 047148c..8c9c5b6 100644
|
|
--- a/workplans/WARDEN-WP-0038-plan-mutation-intent.md
|
|
+++ b/workplans/WARDEN-WP-0038-plan-mutation-intent.md
|
|
@@ -11,7 +11,7 @@ planning_priority: P1
|
|
depends_on_workplans:
|
|
- WARDEN-WP-0029
|
|
created: "2026-09-08"
|
|
-updated: "2026-09-09"
|
|
+updated: "2026-10-16"
|
|
state_hub_workstream_id: "751ad530-e44b-52c4-b70e-cb47568a0179"
|
|
---
|
|
|
|
@@ -119,6 +119,29 @@ anything undeclared — is not built. It is a catalog schema change that would f
|
|
closed on the majority of lanes, which say nothing today, and it needs its own
|
|
argument rather than arriving as a side effect of this fix.
|
|
|
|
+## Recognize explicit attended OpenBao platform administration
|
|
+
|
|
+```task
|
|
+id: WARDEN-WP-0038-T01
|
|
+status: done
|
|
+priority: high
|
|
+```
|
|
+
|
|
+2026-10-16 source follow-up: the exact request "attended OpenBao platform
|
|
+administration for reviewed flex-auth signer custody CAS0 and fixed KV metadata"
|
|
+fell through to keyword ranking and selected `openbao-structure-survey` /
|
|
+`approve`. The configuration override required policy/auth-role nouns even
|
|
+though the caller explicitly named attended platform administration. Recognize
|
|
+that explicit intent before keyword ranking. The plan now selects
|
|
+`openbao-platform-admin-login` / `founder_required` / `oidc_login`; the governed
|
|
+reviewed-command transport and identity gate are unchanged. Survey requests
|
|
+remain metadata-only, and a missing administration lane stays unroutable.
|
|
+
|
|
+Prepared and tested in an isolated checkout for independent review. This task
|
|
+records source repair only; it neither authorizes nor claims installation,
|
|
+attended login, signer provisioning or full16TSA native acceptance. Integration
|
|
+and the existing platform custody work retain those next actions.
|
|
+
|
|
### Not claimed
|
|
|
|
This narrows what `warden plan` will assert; it does not make the tool an
|