generated from coulomb/repo-seed
tegwick
364eb7dfe1
RAILIANCE-WP-0009 T06 / RAILIANCE-WP-0010 T06 (CCR-2026-0002, CCR-2026-0003): both OpenBao KV paths are live, ESO delivers the Secrets in cluster, and positive/negative access verification is audit-logged. Catalog entries gain concrete zero-placeholder handoffs (exec_capable, resolvable); draft tables and playbook gates updated; routing tests repointed to still-draft lanes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
66 lines
2.5 KiB
Markdown
66 lines
2.5 KiB
Markdown
# Catalog Lane Promotion — draft → active
|
|
|
|
Date: 2026-07-01
|
|
Workplan: WARDEN-WP-0023 T05
|
|
|
|
`registry/routing/catalog.yaml` entries start as **`draft`** until an owner-confirmed
|
|
concrete path exists. Draft lanes are hidden from default `warden route find` unless
|
|
`--all` is passed.
|
|
|
|
---
|
|
|
|
## Promotion checklist
|
|
|
|
Before changing `status: draft` → `status: active`:
|
|
|
|
| # | Criterion | Evidence |
|
|
| --- | --- | --- |
|
|
| 1 | **Owner confirmed** | Owner repo workplan or State Hub note naming the lane ready |
|
|
| 2 | **Concrete path** | Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff |
|
|
| 3 | **Playbook** | `wiki/playbooks/<id>.md` with `#worker-checklist` section |
|
|
| 4 | **Exec routing** | `exec_owner` + native command **or** `exec_capable: true` with tested `warden access` proxy |
|
|
| 5 | **Resolvable** | `warden route show <id> --json` shows `resolvable: true` when placeholders are documented |
|
|
| 6 | **Tests** | Routing test or smoke proving lookup + handoff shape (no secret values in fixtures) |
|
|
| 7 | **Review date** | Update `reviewed:` in catalog entry |
|
|
|
|
Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
|
|
`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
|
|
|
|
---
|
|
|
|
## Worked examples (already active)
|
|
|
|
**`ops-warden-warden-sign-token`** — promoted 2026-07-01 after RAILIANCE-WP-0005:
|
|
|
|
- Owner: `railiance-platform` credential broker
|
|
- Concrete grant: `ops-warden/warden-sign`
|
|
- Playbook: `wiki/playbooks/ops-warden-warden-sign-token.md`
|
|
- Smoke: `make credential-exec-ops-warden-smoke`
|
|
|
|
**`issue-core-ingestion-api-key`** — promoted 2026-07-02 after RAILIANCE-WP-0009
|
|
(CCR-2026-0002): KV path live, ExternalSecret `issue-core/issue-core-runtime`
|
|
SecretSynced, positive + negative verification audit-logged.
|
|
|
|
**`openrouter-llm-connect`** — promoted 2026-07-02 after RAILIANCE-WP-0010
|
|
(CCR-2026-0003): KV path live, ExternalSecret
|
|
`activity-core/llm-connect-provider-secrets` SecretSynced, llm-connect rolled
|
|
out on the OpenBao-delivered value, positive + negative verification audit-logged.
|
|
|
|
---
|
|
|
|
## Draft lanes (2026-07-02)
|
|
|
|
| Catalog `id` | Blocker |
|
|
| --- | --- |
|
|
| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
|
|
| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
|
|
|
|
Re-run promotion when the owning repo closes the blocker; do not promote on
|
|
playbook prose alone.
|
|
|
|
---
|
|
|
|
## See also
|
|
|
|
- `wiki/CredentialRouting.md` — draft table index
|
|
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference |