Archived

This repository has been archived on 2026-07-08. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

tegwick d6088e4e16 Implement WP-0022 audit trail and WP-0023 INTENT–SCOPE closeout

Add unified metadata-only audit.jsonl with secret-material guard, instrument
sign/access/worker paths, and expose warden activity CLI. Surface broker hint
when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production
integration checklists plus catalog lane promotion playbook.

2026-07-01 23:32:38 +02:00

2.2 KiB

Raw Blame History

Catalog Lane Promotion — draft → active

Date: 2026-07-01
Workplan: WARDEN-WP-0023 T05

registry/routing/catalog.yaml entries start as draft until an owner-confirmed concrete path exists. Draft lanes are hidden from default warden route find unless --all is passed.

Promotion checklist

Before changing status: draft → status: active:

#	Criterion	Evidence
1	Owner confirmed	Owner repo workplan or State Hub note naming the lane ready
2	Concrete path	Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff
3	Playbook	`wiki/playbooks/<id>.md` with `#worker-checklist` section
4	Exec routing	`exec_owner` + native command or `exec_capable: true` with tested `warden access` proxy
5	Resolvable	`warden route show <id> --json` shows `resolvable: true` when placeholders are documented
6	Tests	Routing test or smoke proving lookup + handoff shape (no secret values in fixtures)
7	Review date	Update `reviewed:` in catalog entry

Promotion PR touches: registry/routing/catalog.yaml, playbook, optional tests/test_routing.py, and a one-line note in wiki/CredentialRouting.md draft table.

Worked example (already active)

ops-warden-warden-sign-token — promoted 2026-07-01 after RAILIANCE-WP-0005:

Owner: railiance-platform credential broker
Concrete grant: ops-warden/warden-sign
Playbook: wiki/playbooks/ops-warden-warden-sign-token.md
Smoke: make credential-exec-ops-warden-smoke

Draft lanes — none ready yet (2026-07-01)

Catalog `id`	Blocker
`issue-core-ingestion-api-key`	OpenBao KV path + ESO wiring not owner-signed off
`openrouter-llm-connect`	activity-core secret mount path still placeholder
`object-storage-sts`	NK-WP-0007 vending path not production-exercised
`database-dynamic-credentials`	OpenBao database engine role paths TBD per workload

Re-run promotion when the owning repo closes the blocker; do not promote on playbook prose alone.

2.2 KiB Raw Blame History

Catalog Lane Promotion — draft → active

Promotion checklist

Worked example (already active)

Draft lanes — none ready yet (2026-07-01)

See also

2.2 KiB

Raw Blame History