# ops-warden Secret Posture Review

Date: 2026-06-27
Owner: the-custodian coordination; ops-warden owns the source standard.

## Review Outcome

ops-warden is moving from a simple "SSH certs plus route pointers" surface to a
more useful access and conformance steward:

- it still directly issues only the SSH certificate lane;
- it routes other credential needs to their owning subsystem;
- `warden access` may advise or proxy `exec_capable` lanes as the caller, without
  storing values or becoming a secret broker;
- WARDEN-WP-0015 adds workload security posture: `dev/test/prod` environment
  posture plus `M0-M3` workload maturity and a secret-flow lattice.

This helps CUST-WP-0051 because a security blocker can now be classified instead
of left as a generic "credentials needed" stop.

## Blocker Refinement Rules

| Situation | CUST-WP-0051 action |
| --- | --- |
| Dev/test implementation needs a credential-shaped dependency | Use synthetic contract doubles; do not wait for production secrets. |
| Production smoke needs a real value | Route to the owner, collect non-secret evidence, and keep the value out of Codex-visible surfaces. |
| Route is `exec_capable` | Prefer `warden access --fetch/--exec` as the caller over copy/paste handling. |
| Workload maturity is below the secret requirement | Keep the blocker; resolve by maturity advancement, policy/design change, or avoiding the secret. |
| OpenBao unseal, break-glass, or issuer custody is unresolved | Keep as operator ceremony/design blocker. |

## Current CUST-WP-0051 Read

| Gate | Refined blocker |
| --- | --- |
| Ops-hub runtime `OPS_HUB_KEY` | Production real-value custody gate; implementation is not blocked, live smoke is. |
| Inter-Hub ops-hub bootstrap | Access/custody gate with an attended execution path; no need to request secret values from ops-warden. |
| activity-core -> issue-core | Production API key injection/evidence gate; route is known through `activity-core-issue-sink`. |
| OpenBao unseal/helper | M3-style ceremony gate; operator design remains required. |
| Forgejo production migration | Production readiness gate spanning credentials, recovery drills, and cutover approval. |

Evidence stays non-secret: route id, owner, posture, maturity, policy decision id,
OpenBao path/version, populated-key count, smoke id, token accessor, or drill id.