access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

values/ops-warden-fetch.yaml

@@ -0,0 +1,30 @@
+# ops-warden secret-read pin (CUST-WP-0075, access-engine ADHOC-2026-10-03).
+# Answers warden check_fetch_policy: action read on resource type secret, system =
+# the lane's owner_repo. Separate from flex-auth-ops-warden (SSH signing) so each
+# decision class rolls independently (FLEX-WP-0016). Isolated: the workstation
+# reaches it through the ops-bridge tunnel flex-auth-ops-warden-fetch-railiance01
+# (127.0.0.1:19091). Every owner system is bound to the ops-warden ServiceAccount,
+# so only ops-warden may ask; callerAuth enforce as on the signing pin.
+#
+# GENERATED by tools/gen_ops_warden_fetch.py from ops-warden's routing catalog,
+# except image.digest, which the script preserves. Regenerate, do not hand-edit.
+name: flex-auth-ops-warden-fetch
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: ""
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/ops-warden-fetch/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/ops-warden-fetch/policy_package.md
+callerAuth:
+  mode: enforce
+  kubernetesURL: https://10.43.0.1
+  binding: key-cape=system:serviceaccount:ops-warden:ops-warden
+  extraBindings:
+    - railiance-platform=system:serviceaccount:ops-warden:ops-warden
+consumer:
+  isolated: true