generated from coulomb/repo-seed
WARDEN-WP-0006: NetKingdom stewardship docs and alignment
Add credential routing, actor patterns, security map, OpenBao SSH checklist, and policy-gated signing design. Update registry and SCOPE; record INTENT↔SCOPE reassessment (C3 completeness).
This commit is contained in:
@@ -4,7 +4,7 @@ type: workplan
|
||||
title: "NetKingdom Alignment and Operational Access Stewardship"
|
||||
domain: custodian
|
||||
repo: ops-warden
|
||||
status: ready
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
@@ -24,13 +24,6 @@ to optional CLI ergonomics.
|
||||
**Out of scope:** flex-auth integration implementation, OpenBao cluster deploy,
|
||||
universal credential broker, net-kingdom INTENT.md rewrite.
|
||||
|
||||
**References:**
|
||||
|
||||
- `INTENT.md`, `SCOPE.md`, `history/2026-06-17-intent-scope-assessment.md`
|
||||
- `net-kingdom/docs/platform-identity-security-architecture.md`
|
||||
- `net-kingdom/docs/responsibility-map.md`
|
||||
- `NK-WP-0009` (SSH tutorial, net-kingdom)
|
||||
|
||||
---
|
||||
|
||||
## Goal
|
||||
@@ -51,147 +44,95 @@ After this workplan, a development worker or agent can:
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T01
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "ffc6a0c2-4312-4584-be7a-c8411cb01899"
|
||||
```
|
||||
|
||||
Create `wiki/CredentialRouting.md`:
|
||||
|
||||
- Decision tree: SSH vs runtime secret vs identity vs authorization vs tunnel
|
||||
- Per-subsystem links (OpenBao, flex-auth, key-cape, ops-bridge, railiance-infra)
|
||||
- Explicit “do not ask ops-warden for API keys” examples
|
||||
- Link from `SCOPE.md`, `INTENT.md`, `README.md`
|
||||
|
||||
**Done when:** A worker with no prior context can route a credential request in
|
||||
under two minutes using this page alone.
|
||||
- [x] `wiki/CredentialRouting.md` with decision tree and anti-examples
|
||||
- [x] Linked from SCOPE, INTENT, README
|
||||
|
||||
### T2 — Actor inventory patterns
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3816463d-7dfd-469d-9324-fd7880b50608"
|
||||
```
|
||||
|
||||
Create `wiki/ActorInventoryPatterns.md` with standard patterns:
|
||||
|
||||
- Tunnel agents (`agt-*-bridge`)
|
||||
- Kaizen / codex agents (`agt-codex-*`)
|
||||
- CI automations (`atm-*`)
|
||||
- Human admins (`adm-*`)
|
||||
- TTL and principal narrowing guidance
|
||||
|
||||
Optional: `examples/inventory.seed.yaml` (non-secret, Git-safe template).
|
||||
|
||||
**Done when:** Adding a new dev worker actor does not require inventing naming
|
||||
from scratch.
|
||||
- [x] `wiki/ActorInventoryPatterns.md`
|
||||
- [x] `examples/inventory.seed.yaml`
|
||||
|
||||
### T3 — NetKingdom cross-links (ops-warden side)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T03
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "f158366a-5746-48b8-acce-472dce8f925e"
|
||||
```
|
||||
|
||||
- Add `wiki/NetKingdomSecurityMap.md` — condensed literacy table from INTENT
|
||||
- Update `registry/capabilities/capability.security.ssh-certificate-issuance.md`
|
||||
summary to mention stewardship/routing
|
||||
- Update `.claude/rules/repo-boundary.md` with NetKingdom routing table
|
||||
|
||||
**Done when:** ops-warden docs stand alone for NetKingdom operational access
|
||||
orientation without reading net-kingdom first (but link to canon).
|
||||
- [x] `wiki/NetKingdomSecurityMap.md`
|
||||
- [x] Registry capability stewardship summary
|
||||
- [x] `.claude/rules/repo-boundary.md` routing table
|
||||
|
||||
### T4 — NetKingdom canon patch (coordination)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T04
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "e40e4395-8f01-4f79-a539-d0de8e427321"
|
||||
```
|
||||
|
||||
Coordinate updates in `net-kingdom` (separate commit/PR there):
|
||||
|
||||
- `docs/responsibility-map.md` — move ops-warden from pure out-of-scope to
|
||||
**operational SSH credential dependency**
|
||||
- `docs/platform-identity-security-architecture.md` — add Operational SSH Path
|
||||
(ops-warden → ops-bridge → hosts)
|
||||
|
||||
**Done when:** NetKingdom canon names ops-warden’s lane; ops-warden wiki links
|
||||
back to the updated sections.
|
||||
|
||||
**Note:** Requires `net-kingdom` repo write access; may need `needs_human` if
|
||||
blocked on review.
|
||||
- [x] `net-kingdom/docs/responsibility-map.md` — Operational SSH dependency
|
||||
- [x] `net-kingdom/docs/platform-identity-security-architecture.md` — Operational SSH Path
|
||||
|
||||
### T5 — OpenBao SSH engine operational checklist
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T05
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "a94e20a2-970b-4a0c-bd23-8510b841b938"
|
||||
```
|
||||
|
||||
Create `wiki/OpenBaoSshEngineChecklist.md`:
|
||||
|
||||
- Prerequisites (OpenBao initialized/unsealed per railiance-platform)
|
||||
- Role creation commands (from OpsWardenConfig)
|
||||
- Token policy expectations (no root token in warden workflows)
|
||||
- Verification: `warden sign` against production endpoint
|
||||
- Failure modes and fallback boundaries
|
||||
|
||||
**Done when:** Operator can verify production SSH signing path without
|
||||
reconstructing steps from multiple repos.
|
||||
- [x] `wiki/OpenBaoSshEngineChecklist.md`
|
||||
|
||||
### T6 — Policy-gated signing design (design only)
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T06
|
||||
status: todo
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "b10a4b4d-bfa1-4f49-b6a5-f339f1e6a2e1"
|
||||
```
|
||||
|
||||
Create `wiki/PolicyGatedSigning.md`:
|
||||
|
||||
- flex-auth decision before `warden sign` — proposed flow
|
||||
- Claims needed from IAM Profile
|
||||
- What stays inventory-based in v1 vs policy-based in v2
|
||||
- Explicit non-implementation in this workplan
|
||||
|
||||
**Done when:** Reviewable design exists; no code dependency.
|
||||
- [x] `wiki/PolicyGatedSigning.md`
|
||||
|
||||
### T7 — Re-assess INTENT ↔ SCOPE
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0006-T07
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ef8b5c57-2343-4cfc-9fee-48db1e56f69a"
|
||||
```
|
||||
|
||||
After T1–T5 complete:
|
||||
|
||||
- Update `history/2026-06-17-intent-scope-assessment.md` or add
|
||||
`history/YYYYMMDD-intent-scope-reassessment.md`
|
||||
- Refresh SCOPE.md Current State and completeness notes
|
||||
- Run `make fix-consistency REPO=ops-warden`
|
||||
|
||||
**Done when:** Completeness target C3+ documented with evidence.
|
||||
- [x] `history/2026-06-17-intent-scope-reassessment.md`
|
||||
- [x] SCOPE.md Current State updated
|
||||
- [x] `make fix-consistency REPO=ops-warden`
|
||||
|
||||
---
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `wiki/CredentialRouting.md` exists and is linked from README/SCOPE
|
||||
- [ ] `wiki/ActorInventoryPatterns.md` exists
|
||||
- [ ] `wiki/NetKingdomSecurityMap.md` exists
|
||||
- [ ] NetKingdom responsibility-map recognizes ops-warden SSH lane (T4)
|
||||
- [ ] OpenBao SSH checklist documented (T5)
|
||||
- [ ] Policy-gated signing design drafted (T6)
|
||||
- [ ] INTENT ↔ SCOPE re-assessment recorded (T7)
|
||||
- [ ] `reuse-surface validate --root .` passes if registry entry changed
|
||||
- [x] `wiki/CredentialRouting.md` exists and is linked from README/SCOPE
|
||||
- [x] `wiki/ActorInventoryPatterns.md` exists
|
||||
- [x] `wiki/NetKingdomSecurityMap.md` exists
|
||||
- [x] NetKingdom responsibility-map recognizes ops-warden SSH lane (T4)
|
||||
- [x] OpenBao SSH checklist documented (T5)
|
||||
- [x] Policy-gated signing design drafted (T6)
|
||||
- [x] INTENT ↔ SCOPE re-assessment recorded (T7)
|
||||
- [x] `reuse-surface validate --root .` passes
|
||||
Reference in New Issue
Block a user