generated from coulomb/repo-seed
tegwick
90007c2cda
Ship flex-auth policy gate registry and smoke evidence, archive WP-0009 through WP-0013, and add integration docs: ops-bridge cert_command migration playbook, operator OpenBao token hygiene, principals drift check script, and 2026-06-24 INTENT/SCOPE gap analysis.
202 lines
6.4 KiB
Markdown
202 lines
6.4 KiB
Markdown
---
|
|
id: WARDEN-WP-0013
|
|
type: workplan
|
|
title: "Production Integration & Stewardship Closeout"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: archived
|
|
owner: codex
|
|
topic_slug: custodian
|
|
planning_priority: high
|
|
planning_order: 13
|
|
depends_on_workplans:
|
|
- WARDEN-WP-0008
|
|
- WARDEN-WP-0009
|
|
- WARDEN-WP-0010
|
|
- WARDEN-WP-0011
|
|
related_workplans:
|
|
- WARDEN-WP-0012
|
|
- FLEX-WP-0007
|
|
created: "2026-06-24"
|
|
updated: "2026-06-24"
|
|
state_hub_workstream_id: "4678c41a-c1d0-48cd-9988-4ea0380e8258"
|
|
---
|
|
|
|
# WARDEN-WP-0013 — Production Integration & Stewardship Closeout
|
|
|
|
## Purpose
|
|
|
|
Close the remaining **ops-warden-owned** gaps after policy gate and routing shipped:
|
|
refresh INTENT/SCOPE canon, archive finished workplans, document ops-bridge
|
|
`cert_command` migration, operator OpenBao token hygiene, principals drift checks,
|
|
and the policy-gate production flip checklist.
|
|
|
|
This workplan addresses the deferred **Production SSH Integration Closeout** strand
|
|
from `history/2026-06-18-post-wp0008-intent-scope-reassessment.md` §6, updated for
|
|
post-WP-0009 state.
|
|
|
|
**Gap analysis:** `history/2026-06-24-intent-scope-gap-analysis.md`
|
|
|
|
## Scope
|
|
|
|
- Post-WP-0009 reassessment and SCOPE alignment
|
|
- Archive hygiene for WP-0010 and WP-0011
|
|
- ops-bridge `cert_command` migration documentation (pilot `agt-state-hub-bridge`)
|
|
- Operator runbook for scoped OpenBao tokens (no root in `VAULT_TOKEN`)
|
|
- Principals drift check between warden inventory and railiance-infra
|
|
- Policy gate production enablement checklist (coordinate FLEX-WP-0007)
|
|
|
|
## Out of scope
|
|
|
|
- flex-auth runtime deployment (flex-auth **FLEX-WP-0007**)
|
|
- ops-bridge tunnel config changes in the ops-bridge repo (coordinate only)
|
|
- Routing scenario playbook expansion (**WARDEN-WP-0012** — parallel track)
|
|
- OpenBao cluster deploy, flex-auth policy authoring, NK-WP-0009 tutorial
|
|
- Implementing secret vending or foreign API proxies
|
|
|
|
## Ownership boundary
|
|
|
|
| Concern | Owner |
|
|
| --- | --- |
|
|
| cert_command migration playbook | ops-warden (doc); ops-bridge (tunnel config) |
|
|
| OpenBao token hygiene runbook | ops-warden (doc); operator (execution) |
|
|
| Principals drift | ops-warden (check doc/script); railiance-infra (host deploy) |
|
|
| `policy.enabled: true` flip | operator (after FLEX-WP-0007) |
|
|
|
|
---
|
|
|
|
## T1 — Post-gap reassessment and SCOPE refresh
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "de46f9a2-bf11-4651-a23c-430c63f396c8"
|
|
```
|
|
|
|
- [x] Write `history/2026-06-24-intent-scope-gap-analysis.md`
|
|
- [x] Update `SCOPE.md` active workplan table (WP-0013, WP-0012 ready)
|
|
- [x] Note maturity vector and partial INTENT criterion (ops-bridge) in SCOPE
|
|
|
|
**Acceptance:** Gap analysis on file; SCOPE reflects 2026-06-24 repo state.
|
|
|
|
---
|
|
|
|
## T2 — Archive hygiene (WP-0010, WP-0011)
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "1b35321d-63ad-40da-a1aa-0b66190a0733"
|
|
```
|
|
|
|
- [x] Move `WARDEN-WP-0010-access-routing-charter.md` to
|
|
`workplans/archived/260624-WARDEN-WP-0010-access-routing-charter.md`
|
|
- [x] Move `WARDEN-WP-0011-routing-guide-cli.md` to
|
|
`workplans/archived/260624-WARDEN-WP-0011-routing-guide-cli.md`
|
|
- [x] Set frontmatter `status: archived` on both; add closeout notes
|
|
- [x] Operator runs `make fix-consistency REPO=ops-warden` from `~/state-hub`
|
|
|
|
**Acceptance:** Only WP-0012 (ready) and WP-0013 (active when started) remain in
|
|
`workplans/` root; hub synced.
|
|
|
|
---
|
|
|
|
## T3 — ops-bridge cert_command migration playbook
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ad8588b2-9ae9-4f94-bd77-8025851a38f5"
|
|
```
|
|
|
|
- [x] Write `wiki/playbooks/ops-bridge-tunnel-cert.md` — static-key → `cert_command`
|
|
migration checklist for tunnel configs
|
|
- [x] Document pilot tunnel `agt-state-hub-bridge`: actor, pubkey path, cert_command
|
|
string, inventory prerequisites
|
|
- [x] Upgrade catalog entry `ops-bridge-tunnel` `wiki_ref` to the new playbook
|
|
- [x] Coordinate with ops-bridge owner for pilot tunnel config change (State Hub message)
|
|
- [ ] Record non-secret smoke evidence when pilot completes (`history/` entry — pending ops-bridge)
|
|
|
|
**Acceptance:** Playbook exists; catalog points at it; pilot steps documented even
|
|
if ops-bridge execution is pending.
|
|
|
|
**Unlocks:** INTENT success criterion #3 moves from partial toward met.
|
|
|
|
---
|
|
|
|
## T4 — Operator OpenBao token hygiene runbook
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "5cb35829-32eb-4d59-97a1-f4d92ce8e239"
|
|
```
|
|
|
|
- [x] Add `wiki/playbooks/operator-openbao-token-hygiene.md` covering scoped tokens,
|
|
`VAULT_TOKEN` session pattern, OIDC route, HTTP 403 recovery
|
|
- [x] Cross-link from `wiki/OpsWardenConfig.md` and production example yaml
|
|
|
|
**Acceptance:** Operator can follow runbook without asking ops-warden for token values.
|
|
|
|
---
|
|
|
|
## T5 — Principals inventory drift check
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T05
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "4025cd32-89f8-42c3-b1e8-eaf78497d91f"
|
|
```
|
|
|
|
- [x] `scripts/check_principals_drift.py` compares inventory `hosts` vs
|
|
`railiance-infra/ansible/inventory/ssh_principals.yaml`
|
|
- [x] Script notes flex-auth registry regeneration via `build_flex_auth_registry.py`
|
|
- [x] Tests in `tests/test_principals_drift.py`
|
|
|
|
**Acceptance:** Drift check runnable or documented; no secret material in script output.
|
|
|
|
---
|
|
|
|
## T6 — Policy gate production enablement checklist
|
|
|
|
```task
|
|
id: WARDEN-WP-0013-T06
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "51663f65-79cb-4108-87c8-9721f9476259"
|
|
```
|
|
|
|
- [x] Operator checklist in `wiki/PolicyGatedSigning.md` § Production rollout
|
|
- [x] Cross-link FLEX-WP-0007 and pickup brief
|
|
- [x] Explicit: keep `policy.enabled: false` until flex-auth reachable
|
|
|
|
**Acceptance:** Operator checklist is sequential and references cross-repo owners;
|
|
no ops-warden code changes required for flex-auth deploy.
|
|
|
|
---
|
|
|
|
## Exit criteria
|
|
|
|
- Gap analysis and SCOPE current
|
|
- WP-0010 and WP-0011 archived
|
|
- ops-bridge cert_command playbook + catalog upgrade
|
|
- Operator token hygiene runbook
|
|
- Principals drift procedure
|
|
- Policy gate production flip checklist (coordinate FLEX-WP-0007)
|
|
|
|
## Parallel track
|
|
|
|
**WARDEN-WP-0012** (routing scenario playbooks) — promoted to `ready`; start when
|
|
P1 integration doc bandwidth allows or in parallel if staffed.
|
|
|
|
## See also
|
|
|
|
- `history/2026-06-24-intent-scope-gap-analysis.md`
|
|
- `history/2026-06-18-post-wp0008-intent-scope-reassessment.md`
|
|
- `wiki/CertCommandInterface.md`
|
|
- `~/flex-auth/workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md` |