Files

tegwick 364eb7dfe1 Promote issue-core-ingestion-api-key and openrouter-llm-connect lanes to active

RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003):
both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and
positive/negative access verification is audit-logged. Catalog entries gain
concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables
and playbook gates updated; routing tests repointed to still-draft lanes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-02 20:48:39 +02:00

2.5 KiB

Raw Blame History

Catalog Lane Promotion — draft → active

Date: 2026-07-01
Workplan: WARDEN-WP-0023 T05

registry/routing/catalog.yaml entries start as draft until an owner-confirmed concrete path exists. Draft lanes are hidden from default warden route find unless --all is passed.

Promotion checklist

Before changing status: draft → status: active:

#	Criterion	Evidence
1	Owner confirmed	Owner repo workplan or State Hub note naming the lane ready
2	Concrete path	Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff
3	Playbook	`wiki/playbooks/<id>.md` with `#worker-checklist` section
4	Exec routing	`exec_owner` + native command or `exec_capable: true` with tested `warden access` proxy
5	Resolvable	`warden route show <id> --json` shows `resolvable: true` when placeholders are documented
6	Tests	Routing test or smoke proving lookup + handoff shape (no secret values in fixtures)
7	Review date	Update `reviewed:` in catalog entry

Promotion PR touches: registry/routing/catalog.yaml, playbook, optional tests/test_routing.py, and a one-line note in wiki/CredentialRouting.md draft table.

Worked examples (already active)

ops-warden-warden-sign-token — promoted 2026-07-01 after RAILIANCE-WP-0005:

Owner: railiance-platform credential broker
Concrete grant: ops-warden/warden-sign
Playbook: wiki/playbooks/ops-warden-warden-sign-token.md
Smoke: make credential-exec-ops-warden-smoke

issue-core-ingestion-api-key — promoted 2026-07-02 after RAILIANCE-WP-0009 (CCR-2026-0002): KV path live, ExternalSecret issue-core/issue-core-runtime SecretSynced, positive + negative verification audit-logged.

openrouter-llm-connect — promoted 2026-07-02 after RAILIANCE-WP-0010 (CCR-2026-0003): KV path live, ExternalSecret activity-core/llm-connect-provider-secrets SecretSynced, llm-connect rolled out on the OpenBao-delivered value, positive + negative verification audit-logged.

Draft lanes (2026-07-02)

Catalog `id`	Blocker
`object-storage-sts`	NK-WP-0007 vending path not production-exercised
`database-dynamic-credentials`	OpenBao database engine role paths TBD per workload

Re-run promotion when the owning repo closes the blocker; do not promote on playbook prose alone.

2.5 KiB Raw Blame History

Catalog Lane Promotion — draft → active

Promotion checklist

Worked examples (already active)

Draft lanes (2026-07-02)

See also

2.5 KiB

Raw Blame History