43 lines
2.3 KiB
Markdown
43 lines
2.3 KiB
Markdown
# ops-warden Secret Posture Review
|
|
|
|
Date: 2026-06-27
|
|
Owner: the-custodian coordination; ops-warden owns the source standard.
|
|
|
|
## Review Outcome
|
|
|
|
ops-warden is moving from a simple "SSH certs plus route pointers" surface to a
|
|
more useful access and conformance steward:
|
|
|
|
- it still directly issues only the SSH certificate lane;
|
|
- it routes other credential needs to their owning subsystem;
|
|
- `warden access` may advise or proxy `exec_capable` lanes as the caller, without
|
|
storing values or becoming a secret broker;
|
|
- WARDEN-WP-0015 adds workload security posture: `dev/test/prod` environment
|
|
posture plus `M0-M3` workload maturity and a secret-flow lattice.
|
|
|
|
This helps CUST-WP-0051 because a security blocker can now be classified instead
|
|
of left as a generic "credentials needed" stop.
|
|
|
|
## Blocker Refinement Rules
|
|
|
|
| Situation | CUST-WP-0051 action |
|
|
| --- | --- |
|
|
| Dev/test implementation needs a credential-shaped dependency | Use synthetic contract doubles; do not wait for production secrets. |
|
|
| Production smoke needs a real value | Route to the owner, collect non-secret evidence, and keep the value out of Codex-visible surfaces. |
|
|
| Route is `exec_capable` | Prefer `warden access --fetch/--exec` as the caller over copy/paste handling. |
|
|
| Workload maturity is below the secret requirement | Keep the blocker; resolve by maturity advancement, policy/design change, or avoiding the secret. |
|
|
| OpenBao unseal, break-glass, or issuer custody is unresolved | Keep as operator ceremony/design blocker. |
|
|
|
|
## Current CUST-WP-0051 Read
|
|
|
|
| Gate | Refined blocker |
|
|
| --- | --- |
|
|
| Ops-hub runtime `OPS_HUB_KEY` | Production real-value custody gate; implementation is not blocked, live smoke is. |
|
|
| Inter-Hub ops-hub bootstrap | Access/custody gate with an attended execution path; no need to request secret values from ops-warden. |
|
|
| activity-core -> issue-core | Production API key injection/evidence gate; route is known through `activity-core-issue-sink`. |
|
|
| OpenBao unseal/helper | M3-style ceremony gate; operator design remains required. |
|
|
| Forgejo production migration | Production readiness gate spanning credentials, recovery drills, and cutover approval. |
|
|
|
|
Evidence stays non-secret: route id, owner, posture, maturity, policy decision id,
|
|
OpenBao path/version, populated-key count, smoke id, token accessor, or drill id.
|