coulomb/ops-warden
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(WARDEN-WP-0014): T2 — warden access advisory front door

Browse Source 
Adds `warden access <need> [--domain X] [--json]`: resolves a credential
need against the routing catalog and renders the structured handoff
(owner, auth method, path template, command skeleton, policy gate
status, proxy hint). SSH lane points at `warden sign`; routed lanes end
"warden advises, the owner vends". New pure warden/access.py module
(expand_handoff, policy_gate_status) reused by the T3 proxy lane. JSON
output is stable and secret-free. tests/test_access.py added.

157 passed, lint clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-06-27 16:13:51 +02:00
parent 02a33d5f92
commit 2c513864bc
4 changed files with 293 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
workplans/WARDEN-WP-0014-operator-access-assist.md
View File

@@ -109,17 +109,21 @@ state_hub_task_id: "abb0e722-6524-4224-8638-6ee1573ed3e0"
```task
id: WARDEN-WP-0014-T02
status: todo
status: done
priority: high
state_hub_task_id: "c1497263-7124-459f-b63a-d0c0c7005c86"
```
- [ ] `warden access <need> [--domain X] [--json]` — resolves via the same matcher as
`warden route find`, but renders the **structured handoff**: owner, auth method,
path template, command skeleton, policy ref + gate status, and any "unconfirmed
path → provision request" note.
- [ ] Advisory is the **default** behavior (no value fetched).
- [ ] `--json` output for agentic operators (stable shape, documented).
- [x] `warden access <need> [--domain X] [--json]` — resolves via the same matcher as
`warden route find` and renders the **structured handoff**: owner, auth method,
path template, command skeleton, policy ref + gate status, proxy hint, and the
`<…>` owner-confirmed-name note. (`warden/access.py` pure module + `access`
command in `cli.py`.)
- [x] Advisory is the **default** behavior (no value fetched); SSH lane points at
`warden sign`; routed lanes end with "warden advises, the owner vends".
- [x] `--json` output for agentic operators — stable, secret-free shape
(`handoff` block + `next_action`); `--domain` substitutes `<domain>` only.
- [x] Tests: `tests/test_access.py` (expansion, gate status, advisory/SSH/JSON/no-match).
### T3 — OpenBao proxy lane (`--fetch` / `--exec`)