6 Commits

Author	SHA1	Message	Date
tegwick	a6a943fc3e	chore(WP-0008): finish and archive production SSH path closeout ... Mark WP-0008 finished and move to archived/. Spin flex-auth production gate to WARDEN-WP-0009. Update SCOPE and reassessment history for R3 reliability.	2026-06-18 01:28:49 +02:00
tegwick	fdc8ecfc8b	docs(WP-0008): T2 production sign verification passed (2026-06-18) ... Record live OpenBao SSH engine apply, host CA bootstrap, and warden sign smoke.	2026-06-18 01:18:57 +02:00
tegwick	2d0f47324d	docs(WP-0008): record NET-WP-0020 T5 artifacts and operator apply steps ... T2 remains wait until railiance-platform configure-ssh and railiance-infra bootstrap-ssh-ca run against the live cluster.	2026-06-18 01:06:43 +02:00
tegwick	457d49b677	docs: cross-link net-kingdom bootstrap assessment from openbao verify history	2026-06-18 01:01:50 +02:00
tegwick	506963ca7e	docs: record OpenBao SSH engine missing as WP-0008 T2 blocker ... Operator confirmed legacy SSH predates OpenBao; ssh/ mount not enabled. Document migration paths and update workplan wait condition.	2026-06-18 00:27:25 +02:00
tegwick	8e9383a33a	feat: opt-in flex-auth policy gate and OpenBao verify (WP-0007) ... Add policy.py client that calls flex-auth /v1/check before sign/issue when policy.enabled is true. Record policy_decision_id in signatures.log. Default off preserves existing inventory-only behavior. Document production OpenBao health probe and update config/wiki references.	2026-06-17 08:37:14 +02:00