generated from coulomb/repo-seed
tegwick
1237cc767b
Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
146 lines
5.0 KiB
Markdown
146 lines
5.0 KiB
Markdown
---
|
|
id: WARDEN-WP-0012
|
|
type: workplan
|
|
title: "Routing Scenario Playbooks"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: custodian
|
|
planning_priority: medium
|
|
planning_order: 12
|
|
created: "2026-06-18"
|
|
updated: "2026-06-24"
|
|
state_hub_workstream_id: "a7e712a0-02f8-4f83-944e-6b207e77bc4c"
|
|
---
|
|
|
|
# WARDEN-WP-0012 — Routing Scenario Playbooks
|
|
|
|
**Scope:** Grow the routing catalog and wiki playbooks for high-frequency NetKingdom
|
|
access scenarios. Each wiki playbook restates **what the worker does on the owning
|
|
system** and tracks an upstream canon doc; the catalog only points at it. ops-warden
|
|
authors procedure only for the SSH lane.
|
|
|
|
**Out of scope:** Implementing custody in ops-warden; creating OpenBao paths in
|
|
railiance-platform (coordinate only); authoring flex-auth policy; restating an
|
|
owner's procedure inside the catalog.
|
|
|
|
**Depends on:** WARDEN-WP-0010 (charter + catalog schema), WARDEN-WP-0011 (routing CLI).
|
|
|
|
**Status:** `finished` — playbooks shipped; draft entries await owner path promotion.
|
|
|
|
---
|
|
|
|
## Anti-stale rule
|
|
|
|
A scenario is added to the catalog as `status: active` **only when its owning repo's
|
|
path actually exists** and a `wiki_ref` is written. Until then it stays `status:
|
|
draft` and is hidden from default `warden route find`/`list`. We do not seed
|
|
agent-visible entries for paths that owners have not shipped — a confident-looking
|
|
pointer to a non-existent path is worse than no entry.
|
|
|
|
---
|
|
|
|
## Scenario backlog
|
|
|
|
| Catalog id | Routing focus | Executing owner | Gate |
|
|
| --- | --- | --- | --- |
|
|
| `issue-core-ingestion-api-key` | OpenBao KV path, K8s injection, rotation | railiance-platform + issue-core | path exists |
|
|
| `activity-core-issue-sink` | `ISSUE_CORE_URL` + consumer key custody | activity-core + issue-core | path exists |
|
|
| `inter-hub-bootstrap-ssh` | SSH envelope + on-host wrapper reads OpenBao | ops-warden SSH + railiance-infra | ready (SSH lane) |
|
|
| `openrouter-llm-connect` | OpenBao → K8s Secret in activity-core | railiance-platform | path exists |
|
|
| `object-storage-sts` | NK-WP-0007 vending path | net-kingdom + flex-auth + OpenBao | canon exists |
|
|
| `ops-bridge-tunnel-cert` | cert_command vs static-key migration | ops-bridge | done (WP-0013) |
|
|
| `human-oidc-login` | key-cape / Keycloak IAM Profile | key-cape | canon exists |
|
|
| `flex-auth-resource-check` | Policy decision before sensitive action | flex-auth | canon exists |
|
|
| `host-principal-deploy` | auth_principals sync | railiance-infra | canon exists |
|
|
|
|
---
|
|
|
|
## Tasks
|
|
|
|
### T1 — issue-core ingestion key playbook
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "830bb512-0288-4dba-9dd4-ccfd28a4921f"
|
|
```
|
|
|
|
- [x] Coordinate with railiance-platform to canonicalize the OpenBao path first.
|
|
(Documented expected path from `railiance-platform/docs/argocd-gitops.md`;
|
|
live KV path not yet shipped — promotion blocked per anti-stale rule.)
|
|
- [x] Then write `wiki/playbooks/issue-core-ingestion-api-key.md` (prerequisites,
|
|
ESO pattern, rotation, privileged-read policy) and promote the catalog entry
|
|
from `draft` to `active` with a `wiki_ref`. (Playbook + `wiki_ref` done;
|
|
stays `draft` until path ships.)
|
|
|
|
### T2 — Inter-Hub and bootstrap lanes
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "7726a703-6e00-4e49-9380-ed3fb3268827"
|
|
```
|
|
|
|
- [x] Align `wiki/InterHubBootstrapAccessLane.md` with catalog id `inter-hub-bootstrap-ssh`
|
|
- [x] Document attended vs unattended bootstrap branches
|
|
- [x] Cross-link flex-auth and OpenBao expectations (pointers, not restated steps)
|
|
- [x] Promote catalog entry to `active` with `wiki_ref`
|
|
|
|
### T3 — ops-bridge tunnel migration
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "9fb397f0-0abb-48f5-bb62-7e77edae93bb"
|
|
```
|
|
|
|
- [x] Playbook: `wiki/playbooks/ops-bridge-tunnel-cert.md` (WARDEN-WP-0013)
|
|
- [x] Pilot tunnel `agt-state-hub-bridge` documented; ops-bridge coordination sent
|
|
|
|
### T4 — Platform secret scenarios (LLM, STS, DB)
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T04
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "edcf4ed7-f18d-4a92-a42d-8cc7ca0ab792"
|
|
```
|
|
|
|
- [x] Playbooks for OpenRouter, object-storage STS, DB dynamic creds.
|
|
- [x] Each ends with an owner-repo action; no warden secret code; pointers to canon.
|
|
|
|
### T5 — Drift review cadence
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T05
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "db98d655-8551-487b-9413-41bf97fc06e1"
|
|
```
|
|
|
|
- [x] Document a review cadence against net-kingdom canon.
|
|
- [x] `warden route list --stale` keyed off the `reviewed:` date field.
|
|
- [x] Process note in `wiki/AccessRouting.md`.
|
|
|
|
---
|
|
|
|
## Acceptance
|
|
|
|
- Every active catalog entry has a `wiki_ref` to an existing section; no active entry
|
|
points at a path its owner has not shipped (those stay `draft`).
|
|
- `warden route find` resolves common agent queries without wiki grep.
|
|
- Playbooks and catalog contain no secret material — only owners, pointers, checklists.
|
|
|
|
---
|
|
|
|
## See also
|
|
|
|
- `WARDEN-WP-0010`, `WARDEN-WP-0011`
|
|
- `wiki/CredentialRouting.md`
|
|
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`
|