generated from coulomb/repo-seed
tegwick
dcfcc4b20a
Drop the "operational access desk" framing (and the rejected "coach" metaphor) for plain language: ops-warden issues short-lived SSH certs and routes every other credential need to its owner. SSH is the only lane it executes. Adds WARDEN-WP-0010/0011/0012 with a pointer-layer routing catalog that points at owner docs rather than restating them, enforced structurally (non-SSH entries carrying a steps block fail CI). Drops the scope-creep-prone `check` command; hides unshipped-path scenarios as draft. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
136 lines
4.3 KiB
Markdown
136 lines
4.3 KiB
Markdown
---
|
|
id: WARDEN-WP-0012
|
|
type: workplan
|
|
title: "Routing Scenario Playbooks"
|
|
domain: custodian
|
|
repo: ops-warden
|
|
status: backlog
|
|
owner: codex
|
|
topic_slug: custodian
|
|
planning_priority: medium
|
|
planning_order: 12
|
|
created: "2026-06-18"
|
|
updated: "2026-06-18"
|
|
---
|
|
|
|
# WARDEN-WP-0012 — Routing Scenario Playbooks
|
|
|
|
**Scope:** Grow the routing catalog and wiki playbooks for high-frequency NetKingdom
|
|
access scenarios. Each wiki playbook restates **what the worker does on the owning
|
|
system** and tracks an upstream canon doc; the catalog only points at it. ops-warden
|
|
authors procedure only for the SSH lane.
|
|
|
|
**Out of scope:** Implementing custody in ops-warden; creating OpenBao paths in
|
|
railiance-platform (coordinate only); authoring flex-auth policy; restating an
|
|
owner's procedure inside the catalog.
|
|
|
|
**Depends on:** WARDEN-WP-0010 (charter + catalog schema), WARDEN-WP-0011 (routing CLI).
|
|
|
|
**Status:** `backlog` — start after WP-0010 T3 and WP-0011 T2 ship.
|
|
|
|
---
|
|
|
|
## Anti-stale rule
|
|
|
|
A scenario is added to the catalog as `status: active` **only when its owning repo's
|
|
path actually exists** and a `wiki_ref` is written. Until then it stays `status:
|
|
draft` and is hidden from default `warden route find`/`list`. We do not seed
|
|
agent-visible entries for paths that owners have not shipped — a confident-looking
|
|
pointer to a non-existent path is worse than no entry.
|
|
|
|
---
|
|
|
|
## Scenario backlog
|
|
|
|
| Catalog id | Routing focus | Executing owner | Gate |
|
|
| --- | --- | --- | --- |
|
|
| `issue-core-ingestion-api-key` | OpenBao KV path, K8s injection, rotation | railiance-platform + issue-core | path exists |
|
|
| `activity-core-issue-sink` | `ISSUE_CORE_URL` + consumer key custody | activity-core + issue-core | path exists |
|
|
| `inter-hub-bootstrap-ssh` | SSH envelope + on-host wrapper reads OpenBao | ops-warden SSH + railiance-infra | ready (SSH lane) |
|
|
| `openrouter-llm-connect` | OpenBao → K8s Secret in activity-core | railiance-platform | path exists |
|
|
| `object-storage-sts` | NK-WP-0007 vending path | net-kingdom + flex-auth + OpenBao | canon exists |
|
|
| `ops-bridge-tunnel-cert` | cert_command vs static-key migration | ops-bridge | coordinate |
|
|
| `human-oidc-login` | key-cape / Keycloak IAM Profile | key-cape | canon exists |
|
|
| `flex-auth-resource-check` | Policy decision before sensitive action | flex-auth | canon exists |
|
|
| `host-principal-deploy` | auth_principals sync | railiance-infra | canon exists |
|
|
|
|
---
|
|
|
|
## Tasks
|
|
|
|
### T1 — issue-core ingestion key playbook
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T01
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
- [ ] Coordinate with railiance-platform to canonicalize the OpenBao path first.
|
|
- [ ] Then write `wiki/playbooks/issue-core-ingestion-api-key.md` (prerequisites,
|
|
ESO pattern, rotation, privileged-read policy) and promote the catalog entry
|
|
from `draft` to `active` with a `wiki_ref`.
|
|
|
|
### T2 — Inter-Hub and bootstrap lanes
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T02
|
|
status: todo
|
|
priority: medium
|
|
```
|
|
|
|
- [ ] Align `wiki/InterHubBootstrapAccessLane.md` with the catalog id.
|
|
- [ ] Document attended vs unattended bootstrap branches.
|
|
- [ ] Cross-link flex-auth and OpenBao expectations (pointers, not restated steps).
|
|
|
|
### T3 — ops-bridge tunnel migration
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T03
|
|
status: todo
|
|
priority: medium
|
|
```
|
|
|
|
- [ ] Playbook: static-key → `cert_command` migration checklist.
|
|
- [ ] Pilot tunnel notes (`agt-state-hub-bridge`) — coordinate with ops-bridge.
|
|
|
|
### T4 — Platform secret scenarios (LLM, STS, DB)
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T04
|
|
status: todo
|
|
priority: low
|
|
```
|
|
|
|
- [ ] Playbooks for OpenRouter, object-storage STS, DB dynamic creds.
|
|
- [ ] Each ends with an owner-repo action; no warden secret code; pointers to canon.
|
|
|
|
### T5 — Drift review cadence
|
|
|
|
```task
|
|
id: WARDEN-WP-0012-T05
|
|
status: todo
|
|
priority: low
|
|
```
|
|
|
|
- [ ] Document a review cadence against net-kingdom canon.
|
|
- [ ] `warden route list --stale` keyed off the `reviewed:` date field.
|
|
- [ ] Process note in `wiki/AccessRouting.md`.
|
|
|
|
---
|
|
|
|
## Acceptance
|
|
|
|
- Every active catalog entry has a `wiki_ref` to an existing section; no active entry
|
|
points at a path its owner has not shipped (those stay `draft`).
|
|
- `warden route find` resolves common agent queries without wiki grep.
|
|
- Playbooks and catalog contain no secret material — only owners, pointers, checklists.
|
|
|
|
---
|
|
|
|
## See also
|
|
|
|
- `WARDEN-WP-0010`, `WARDEN-WP-0011`
|
|
- `wiki/CredentialRouting.md`
|
|
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`
|