generated from coulomb/repo-seed
tegwick
d6088e4e16
Add unified metadata-only audit.jsonl with secret-material guard, instrument sign/access/worker paths, and expose warden activity CLI. Surface broker hint when VAULT_TOKEN is unset, refresh INTENT/SCOPE docs, and add production integration checklists plus catalog lane promotion playbook.
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Catalog Lane Promotion — draft → active
|
|
|
|
Date: 2026-07-01
|
|
Workplan: WARDEN-WP-0023 T05
|
|
|
|
`registry/routing/catalog.yaml` entries start as **`draft`** until an owner-confirmed
|
|
concrete path exists. Draft lanes are hidden from default `warden route find` unless
|
|
`--all` is passed.
|
|
|
|
---
|
|
|
|
## Promotion checklist
|
|
|
|
Before changing `status: draft` → `status: active`:
|
|
|
|
| # | Criterion | Evidence |
|
|
| --- | --- | --- |
|
|
| 1 | **Owner confirmed** | Owner repo workplan or State Hub note naming the lane ready |
|
|
| 2 | **Concrete path** | Real OpenBao path, grant id, or exec command — no unresolved `<placeholders>` in the primary handoff |
|
|
| 3 | **Playbook** | `wiki/playbooks/<id>.md` with `#worker-checklist` section |
|
|
| 4 | **Exec routing** | `exec_owner` + native command **or** `exec_capable: true` with tested `warden access` proxy |
|
|
| 5 | **Resolvable** | `warden route show <id> --json` shows `resolvable: true` when placeholders are documented |
|
|
| 6 | **Tests** | Routing test or smoke proving lookup + handoff shape (no secret values in fixtures) |
|
|
| 7 | **Review date** | Update `reviewed:` in catalog entry |
|
|
|
|
Promotion PR touches: `registry/routing/catalog.yaml`, playbook, optional
|
|
`tests/test_routing.py`, and a one-line note in `wiki/CredentialRouting.md` draft table.
|
|
|
|
---
|
|
|
|
## Worked example (already active)
|
|
|
|
**`ops-warden-warden-sign-token`** — promoted 2026-07-01 after RAILIANCE-WP-0005:
|
|
|
|
- Owner: `railiance-platform` credential broker
|
|
- Concrete grant: `ops-warden/warden-sign`
|
|
- Playbook: `wiki/playbooks/ops-warden-warden-sign-token.md`
|
|
- Smoke: `make credential-exec-ops-warden-smoke`
|
|
|
|
---
|
|
|
|
## Draft lanes — none ready yet (2026-07-01)
|
|
|
|
| Catalog `id` | Blocker |
|
|
| --- | --- |
|
|
| `issue-core-ingestion-api-key` | OpenBao KV path + ESO wiring not owner-signed off |
|
|
| `openrouter-llm-connect` | activity-core secret mount path still placeholder |
|
|
| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
|
|
| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
|
|
|
|
Re-run promotion when the owning repo closes the blocker; do not promote on
|
|
playbook prose alone.
|
|
|
|
---
|
|
|
|
## See also
|
|
|
|
- `wiki/CredentialRouting.md` — draft table index
|
|
- `wiki/playbooks/ops-warden-warden-sign-token.md` — promotion reference |