---
id: WARDEN-WP-0012
type: workplan
title: "Routing Scenario Playbooks"
domain: custodian
repo: ops-warden
status: backlog
owner: codex
topic_slug: custodian
planning_priority: medium
planning_order: 12
created: "2026-06-18"
updated: "2026-06-18"
---

# WARDEN-WP-0012 — Routing Scenario Playbooks

**Scope:** Grow the routing catalog and wiki playbooks for high-frequency NetKingdom
access scenarios. Each wiki playbook restates **what the worker does on the owning
system** and tracks an upstream canon doc; the catalog only points at it. ops-warden
authors procedure only for the SSH lane.

**Out of scope:** Implementing custody in ops-warden; creating OpenBao paths in
railiance-platform (coordinate only); authoring flex-auth policy; restating an
owner's procedure inside the catalog.

**Depends on:** WARDEN-WP-0010 (charter + catalog schema), WARDEN-WP-0011 (routing CLI).

**Status:** `backlog` — start after WP-0010 T3 and WP-0011 T2 ship.

---

## Anti-stale rule

A scenario is added to the catalog as `status: active` **only when its owning repo's
path actually exists** and a `wiki_ref` is written. Until then it stays `status:
draft` and is hidden from default `warden route find`/`list`. We do not seed
agent-visible entries for paths that owners have not shipped — a confident-looking
pointer to a non-existent path is worse than no entry.

---

## Scenario backlog

| Catalog id | Routing focus | Executing owner | Gate |
| --- | --- | --- | --- |
| `issue-core-ingestion-api-key` | OpenBao KV path, K8s injection, rotation | railiance-platform + issue-core | path exists |
| `activity-core-issue-sink` | `ISSUE_CORE_URL` + consumer key custody | activity-core + issue-core | path exists |
| `inter-hub-bootstrap-ssh` | SSH envelope + on-host wrapper reads OpenBao | ops-warden SSH + railiance-infra | ready (SSH lane) |
| `openrouter-llm-connect` | OpenBao → K8s Secret in activity-core | railiance-platform | path exists |
| `object-storage-sts` | NK-WP-0007 vending path | net-kingdom + flex-auth + OpenBao | canon exists |
| `ops-bridge-tunnel-cert` | cert_command vs static-key migration | ops-bridge | coordinate |
| `human-oidc-login` | key-cape / Keycloak IAM Profile | key-cape | canon exists |
| `flex-auth-resource-check` | Policy decision before sensitive action | flex-auth | canon exists |
| `host-principal-deploy` | auth_principals sync | railiance-infra | canon exists |

---

## Tasks

### T1 — issue-core ingestion key playbook

```task
id: WARDEN-WP-0012-T01
status: todo
priority: high
```

- [ ] Coordinate with railiance-platform to canonicalize the OpenBao path first.
- [ ] Then write `wiki/playbooks/issue-core-ingestion-api-key.md` (prerequisites,
      ESO pattern, rotation, privileged-read policy) and promote the catalog entry
      from `draft` to `active` with a `wiki_ref`.

### T2 — Inter-Hub and bootstrap lanes

```task
id: WARDEN-WP-0012-T02
status: todo
priority: medium
```

- [ ] Align `wiki/InterHubBootstrapAccessLane.md` with the catalog id.
- [ ] Document attended vs unattended bootstrap branches.
- [ ] Cross-link flex-auth and OpenBao expectations (pointers, not restated steps).

### T3 — ops-bridge tunnel migration

```task
id: WARDEN-WP-0012-T03
status: todo
priority: medium
```

- [ ] Playbook: static-key → `cert_command` migration checklist.
- [ ] Pilot tunnel notes (`agt-state-hub-bridge`) — coordinate with ops-bridge.

### T4 — Platform secret scenarios (LLM, STS, DB)

```task
id: WARDEN-WP-0012-T04
status: todo
priority: low
```

- [ ] Playbooks for OpenRouter, object-storage STS, DB dynamic creds.
- [ ] Each ends with an owner-repo action; no warden secret code; pointers to canon.

### T5 — Drift review cadence

```task
id: WARDEN-WP-0012-T05
status: todo
priority: low
```

- [ ] Document a review cadence against net-kingdom canon.
- [ ] `warden route list --stale` keyed off the `reviewed:` date field.
- [ ] Process note in `wiki/AccessRouting.md`.

---

## Acceptance

- Every active catalog entry has a `wiki_ref` to an existing section; no active entry
  points at a path its owner has not shipped (those stay `draft`).
- `warden route find` resolves common agent queries without wiki grep.
- Playbooks and catalog contain no secret material — only owners, pointers, checklists.

---

## See also

- `WARDEN-WP-0010`, `WARDEN-WP-0011`
- `wiki/CredentialRouting.md`
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`