coulomb/ops-warden
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active

Browse Source 
RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003):
both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and
positive/negative access verification is audit-logged. Catalog entries gain
concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables
and playbook gates updated; routing tests repointed to still-draft lanes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-07-02 20:48:39 +02:00
parent 833c36e20a
commit 364eb7dfe1
6 changed files with 86 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
wiki/playbooks/issue-core-ingestion-api-key.md
View File

@@ -1,8 +1,8 @@
# issue-core Ingestion API Key — OpenBao Custody
Date: 2026-06-24
Workplan: WARDEN-WP-0012 T1
Catalog: `issue-core-ingestion-api-key` (draft until path ships)
Date: 2026-06-24 (promoted active 2026-07-02)
Workplan: WARDEN-WP-0012 T1 · RAILIANCE-WP-0009 / CCR-2026-0002
Catalog: `issue-core-ingestion-api-key` (**active** — path live, ESO delivering)
Pointer playbook for agents and operators wiring the **shared ingestion key**
between `activity-core` IssueSink emission and `issue-core` REST ingestion.
@@ -54,8 +54,14 @@ GITEA_BACKEND_TOKEN
The ExternalSecret manifest belongs in `issue-core` workload manifests (tenant
repo owns runtime deployment). Platform owns mount policy and path provisioning.
**Promotion gate:** catalog entry stays `status: draft` until this path exists
in the live OpenBao cluster and an owner-repo ExternalSecret is merged.
**Promotion gate (met 2026-07-02):** the path exists in the live OpenBao
cluster and `ExternalSecret issue-core/issue-core-runtime` is merged and
`SecretSynced` (read policy `workload-kv-read-issue-core-runtime`, k8s auth
role `external-secrets-issue-core`, auth subject
`external-secrets/external-secrets`). Positive + negative access verified with
OpenBao audit evidence (RAILIANCE-WP-0009 T05). Lifecycle
(deactivate/rotate/compromise):
`railiance-platform/docs/credential-lane-lifecycle-runbook.md`.
---
@@ -110,8 +116,7 @@ scoped tokens only, never root token for routine workload secret inspection.
| `issue-core` | Merge ExternalSecret + Deployment env from synced Secret |
| `activity-core` | Mirror `ISSUE_CORE_API_KEY` injection for REST sink mode |
When the path ships, ops-warden promotes `issue-core-ingestion-api-key` to
`status: active` with this `wiki_ref`.
Promoted to `status: active` on 2026-07-02 (RAILIANCE-WP-0009 T06).
---