coulomb/ops-warden
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
This repository has been archived on 2026-07-08. You can view files and clone it. You cannot open issues or pull requests or push a commit.
Files
1a02ec675385e7c8f4e5bd2fb202bdc6e450b512
ops-warden/workplans/archived/260624-WARDEN-WP-0013-production-integration-and-stewardship-closeout.md
tegwick 90007c2cda feat: close WP-0009/WP-0013 production integration stewardship strand 
Ship flex-auth policy gate registry and smoke evidence, archive WP-0009
through WP-0013, and add integration docs: ops-bridge cert_command
migration playbook, operator OpenBao token hygiene, principals drift
check script, and 2026-06-24 INTENT/SCOPE gap analysis.
2026-06-24 12:44:32 +02:00

6.4 KiB
Raw Blame History

id, type, title, domain, repo, status, owner, topic_slug, planning_priority, planning_order, depends_on_workplans, related_workplans, created, updated, state_hub_workstream_id
id type title domain repo status owner topic_slug planning_priority planning_order depends_on_workplans related_workplans created updated state_hub_workstream_id
WARDEN-WP-0013 workplan Production Integration & Stewardship Closeout infotech ops-warden archived codex custodian high 13
WARDEN-WP-0008
WARDEN-WP-0009
WARDEN-WP-0010
WARDEN-WP-0011
WARDEN-WP-0012
FLEX-WP-0007
2026-06-24 2026-06-24 4678c41a-c1d0-48cd-9988-4ea0380e8258

WARDEN-WP-0013 — Production Integration & Stewardship Closeout

Purpose

Close the remaining ops-warden-owned gaps after policy gate and routing shipped: refresh INTENT/SCOPE canon, archive finished workplans, document ops-bridge cert_command migration, operator OpenBao token hygiene, principals drift checks, and the policy-gate production flip checklist.

This workplan addresses the deferred Production SSH Integration Closeout strand from history/2026-06-18-post-wp0008-intent-scope-reassessment.md §6, updated for post-WP-0009 state.

Gap analysis: history/2026-06-24-intent-scope-gap-analysis.md

Scope

  • Post-WP-0009 reassessment and SCOPE alignment
  • Archive hygiene for WP-0010 and WP-0011
  • ops-bridge cert_command migration documentation (pilot agt-state-hub-bridge)
  • Operator runbook for scoped OpenBao tokens (no root in VAULT_TOKEN)
  • Principals drift check between warden inventory and railiance-infra
  • Policy gate production enablement checklist (coordinate FLEX-WP-0007)

Out of scope

  • flex-auth runtime deployment (flex-auth FLEX-WP-0007)
  • ops-bridge tunnel config changes in the ops-bridge repo (coordinate only)
  • Routing scenario playbook expansion (WARDEN-WP-0012 — parallel track)
  • OpenBao cluster deploy, flex-auth policy authoring, NK-WP-0009 tutorial
  • Implementing secret vending or foreign API proxies

Ownership boundary

Concern Owner
cert_command migration playbook ops-warden (doc); ops-bridge (tunnel config)
OpenBao token hygiene runbook ops-warden (doc); operator (execution)
Principals drift ops-warden (check doc/script); railiance-infra (host deploy)
policy.enabled: true flip operator (after FLEX-WP-0007)

T1 — Post-gap reassessment and SCOPE refresh

id: WARDEN-WP-0013-T01
status: done
priority: high
state_hub_task_id: "de46f9a2-bf11-4651-a23c-430c63f396c8"
  • Write history/2026-06-24-intent-scope-gap-analysis.md
  • Update SCOPE.md active workplan table (WP-0013, WP-0012 ready)
  • Note maturity vector and partial INTENT criterion (ops-bridge) in SCOPE

Acceptance: Gap analysis on file; SCOPE reflects 2026-06-24 repo state.

T2 — Archive hygiene (WP-0010, WP-0011)

id: WARDEN-WP-0013-T02
status: done
priority: medium
state_hub_task_id: "1b35321d-63ad-40da-a1aa-0b66190a0733"
  • Move WARDEN-WP-0010-access-routing-charter.md to workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md
  • Move WARDEN-WP-0011-routing-guide-cli.md to workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md
  • Set frontmatter status: archived on both; add closeout notes
  • Operator runs make fix-consistency REPO=ops-warden from ~/state-hub

Acceptance: Only WP-0012 (ready) and WP-0013 (active when started) remain in workplans/ root; hub synced.

T3 — ops-bridge cert_command migration playbook

id: WARDEN-WP-0013-T03
status: done
priority: high
state_hub_task_id: "ad8588b2-9ae9-4f94-bd77-8025851a38f5"
  • Write wiki/playbooks/ops-bridge-tunnel-cert.md — static-key → cert_command migration checklist for tunnel configs
  • Document pilot tunnel agt-state-hub-bridge: actor, pubkey path, cert_command string, inventory prerequisites
  • Upgrade catalog entry ops-bridge-tunnel wiki_ref to the new playbook
  • Coordinate with ops-bridge owner for pilot tunnel config change (State Hub message)
  • Record non-secret smoke evidence when pilot completes (history/ entry — pending ops-bridge)

Acceptance: Playbook exists; catalog points at it; pilot steps documented even if ops-bridge execution is pending.

Unlocks: INTENT success criterion #3 moves from partial toward met.

T4 — Operator OpenBao token hygiene runbook

id: WARDEN-WP-0013-T04
status: done
priority: medium
state_hub_task_id: "5cb35829-32eb-4d59-97a1-f4d92ce8e239"
  • Add wiki/playbooks/operator-openbao-token-hygiene.md covering scoped tokens, VAULT_TOKEN session pattern, OIDC route, HTTP 403 recovery
  • Cross-link from wiki/OpsWardenConfig.md and production example yaml

Acceptance: Operator can follow runbook without asking ops-warden for token values.

T5 — Principals inventory drift check

id: WARDEN-WP-0013-T05
status: done
priority: medium
state_hub_task_id: "4025cd32-89f8-42c3-b1e8-eaf78497d91f"
  • scripts/check_principals_drift.py compares inventory hosts vs railiance-infra/ansible/inventory/ssh_principals.yaml
  • Script notes flex-auth registry regeneration via build_flex_auth_registry.py
  • Tests in tests/test_principals_drift.py

Acceptance: Drift check runnable or documented; no secret material in script output.

T6 — Policy gate production enablement checklist

id: WARDEN-WP-0013-T06
status: done
priority: medium
state_hub_task_id: "51663f65-79cb-4108-87c8-9721f9476259"
  • Operator checklist in wiki/PolicyGatedSigning.md § Production rollout
  • Cross-link FLEX-WP-0007 and pickup brief
  • Explicit: keep policy.enabled: false until flex-auth reachable

Acceptance: Operator checklist is sequential and references cross-repo owners; no ops-warden code changes required for flex-auth deploy.

Exit criteria

  • Gap analysis and SCOPE current
  • WP-0010 and WP-0011 archived
  • ops-bridge cert_command playbook + catalog upgrade
  • Operator token hygiene runbook
  • Principals drift procedure
  • Policy gate production flip checklist (coordinate FLEX-WP-0007)

Parallel track

WARDEN-WP-0012 (routing scenario playbooks) — promoted to ready; start when P1 integration doc bandwidth allows or in parallel if staffed.

See also

  • history/2026-06-24-intent-scope-gap-analysis.md
  • history/2026-06-18-post-wp0008-intent-scope-reassessment.md
  • wiki/CertCommandInterface.md
  • ~/flex-auth/workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
Reference in New Issue View Git Blame Copy Permalink