the-custodian/docs/credential-custody-unblock-board.md

Credential Custody Unblock Board

Created: 2026-06-27 Owner: the-custodian coordination; credential owners remain with their owning repos.

Purpose

This board collects the live credential and operator-access gates that block the infrastructure stabilization plan. It records routes and non-secret evidence only. It is not a secret store, approval record, or substitute for the owning repo runbooks.

Rules

• Do not put secrets in Git, State Hub, workplans, shell history, or chat.
• Use the current ops-warden source CLI for routing if the installed warden lacks route commands: cd /home/worsch/ops-warden && uv run warden route ....
• ops-warden executes SSH certificate issuance only. It does not vend API keys, OpenBao tokens, SMTP passwords, OIDC logins, or database credentials.
• OpenBao/API credentials route to railiance-platform; interactive identity routes to key-cape; tunnels route to ops-bridge; host principal and force-command deployment routes to railiance-infra.
• Evidence may include ids, prefixes, counts, decision ids, HTTP status, and smoke pass/fail. It must not include credential values.

Route Records

Route id	Owner	Scope	Warden executes?	Reference
openbao-api-key	railiance-platform	API keys, DB credentials, provider tokens, OpenBao KV/dynamic leases	No	wiki/CredentialRouting.md#routing-table
inter-hub-bootstrap-ssh	ops-warden + railiance-infra	Inter-Hub bootstrap SSH envelope and force-command pattern	No	wiki/InterHubBootstrapAccessLane.md#worker-checklist
ssh-cert-host-access	ops-warden	Short-lived SSH cert signing for host reachability	Yes	wiki/AccessRouting.md#issue-vs-route
railiance-infra-principals	railiance-infra	Host SSH principal files and force-command deployment	No	wiki/CredentialRouting.md#routing-table
key-cape-oidc-login	key-cape	Interactive login, OIDC, MFA, JWT/authentication	No	wiki/CredentialRouting.md#quick-decision-tree
ops-bridge-tunnel	ops-bridge	SSH tunnels and port forwards	No	wiki/playbooks/ops-bridge-tunnel-cert.md#migration-checklist

Live Gates

Gate	Blocking work	Owner and route	Expected execution host	Non-secret evidence	Fallback decision	Next action	Status
Inter-Hub ops-hub bootstrap	CUST-WP-0049-T06, unblocks CUST-WP-0047-T05	inter-hub-bootstrap-ssh for the envelope; openbao-api-key for operator/runtime key custody; ssh-cert-host-access only for cert signing if remote execution is used	Local workstation with IHUB_OPERATOR_KEY_FILE, or trusted host with railiance-infra force-command wrapper	Hub id, manifest id, widget count, runtime key prefix only, bootstrap smoke result, State Hub progress id	Prefer API helper. Use deployment-side migration/bootstrap only by explicit operator approval. Manual SQL remains last-resort and must be recorded as an exception.	Operator materializes Inter-Hub operator key through approved custody, runs the ops-hub helper, stores generated runtime key outside Git, removes temp files.	Ready for operator handoff
Ops-hub runtime evidence key	IHUB-WP-0022-T04, then IHUB-WP-0022-T07	openbao-api-key owned by railiance-platform / OpenBao	Operator workstation, OpenBao UI/CLI session, or trusted cluster job; not a Codex-visible shell with printed values	OpenBao path/version or populated key count only, token exchange HTTP status, evidence submission smoke id	Attended one-time key file is acceptable only long enough to store in OpenBao and remove; no chat or State Hub transfer.	Store/provide OPS_HUB_KEY via OpenBao path, then run Inter-Hub submission smoke.	Waiting on operator custody
OpenBao unseal and token automation	NET-WP-0020, related OpenBao token-grant and policy-gate blockers	openbao-api-key for OpenBao issuer/token paths; railiance-infra-principals for host policy; ssh-cert-host-access for cert signing; key-cape-oidc-login for login/MFA	OpenBao operator terminal, cluster-admin context, or trusted railiance-infra deployment path	Policy names, role names, token accessor only, decision ids, allow/deny smoke result	Keep attended ceremony path until auto-unseal/profile is explicitly approved. Do not invent warden secret or paste VAULT_TOKEN.	Decide custody profile, apply narrow policy/role through approved issuer path, rerun smoke with non-secret evidence.	Needs operator design/approval
Forgejo production migration	RAIL-HO-WP-0005 T02/T06/T11/T12	openbao-api-key for SMTP/package/provider credentials; key-cape-oidc-login for login/MFA; ops-bridge-tunnel or ssh-cert-host-access only for host reachability	Forgejo admin/browser session, railiance01 trusted host, or approved GitOps/deployment path	Decision record id, hostname/exposure choice, SMTP sender/domain alignment, password-reset smoke, backup/restore drill id, package pull smoke, cutover approval id	Keep Gitea as read-only rollback until stabilization passes; do not retire legacy Gitea without explicit approval.	Resolve production choices, store SMTP credentials through OpenBao, run recovery and migration drills, then request cutover approval.	Needs human production decisions

Route Lookup Commands

cd /home/worsch/ops-warden
uv run warden route show openbao-api-key --json
uv run warden route show inter-hub-bootstrap-ssh --json
uv run warden route show ssh-cert-host-access --json
uv run warden route show railiance-infra-principals --json
uv run warden route show key-cape-oidc-login --json
uv run warden route show ops-bridge-tunnel --json

Pickup Order

1. Inter-Hub ops-hub bootstrap, because it unlocks both the now-view and the activity-core evidence lane.
2. Ops-hub runtime evidence key, because it is the immediate smoke gate after bootstrap.
3. OpenBao custody profile, because several credential-helper and policy-gate blockers collapse once a narrow issuer path exists.
4. Forgejo production decisions, because those require human design approval before execution can be responsibly automated.