Ward
The credential broker
StatusBuildIn build
01What it does
Ward is Steward's credential-custody limb, a broker that hands a worker a named grant instead of a credential value, so no interface can ever emit, mask, or leak the secret bytes themselves; when Ward is down, authenticated work stops and escalates rather than falling back to an unsafe path.
Without it, a worker that needs to authenticate reaches for a raw token or a masked rendering of one, and (as three 2026-07-25 incidents showed) a masking bug or a debugging reflex can leak the real value.
03Who it works with
A substrate member is called, never run. Everything below reads its declared contract at the moment it needs it, which is why it has no step of its own in any workflow.
- StewardOperates (module of)Lives inside Steward's repo as a dependency-isolated module; parent/limb, not a peer
- HelmConsumes (names, never resolves)Helm names a grant in a dispatch brief; only Ward resolves it
- LatchOperates (sibling layer)Latch authenticates humans; Ward brokers machine credentials; neither reaches the other
- ManifoldOperates (precedent)Same one-door-per-machine substrate shape, different resource
- CourierFeeds (soft dependency)Courier's SendGrid key is intended to become a Ward-issued grant at slice 2
Others on the substrate plane