access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

workplans/ADHOC-2026-10-03.md

@@ -0,0 +1,87 @@
+---
+id: FLEX-WP-ADHOC-2026-10-03
+type: workplan
+title: "2026-10-03 secret-read evaluator for ops-warden fetch checks"
+domain: infotech
+repo: flex-auth
+status: blocked
+owner: claude
+topic_slug: netkingdom
+created: "2026-10-03"
+updated: "2026-10-03"
+---
+
+# 2026-10-03 — secret-read evaluator for ops-warden fetch checks
+
+Opened from the-custodian bug `b792c5d0-f1ff-41cf-90a7-5697ef582a41`
+(CUST-WP-0075, CCR-2026-0031 provisioning; ops-warden side `faf11061`).
+Founder direction 2026-10-03 (the-custodian `docs/agent-environment-orientation.md`
+§0): fixing the security layer is wanted; live changes still need his go.
+
+**Bug.** ops-warden `check_fetch_policy` posts `read` on `secret:<need_id>`
+with `resource.system = <owner_repo>` to `policy.flex_auth_url`
+(`127.0.0.1:19090`, the tunnel to `flex-auth-ops-warden`, the SSH signing pin).
+That pin binds only system `ops-warden`, and its package returns `wrong_system`
+for anything else, so every non-SSH fetch lane got 403.
+
+## Build the secret-read evaluator (repo side)
+
+```task
+id: FLEX-WP-ADHOC-2026-10-03-T01
+status: done
+priority: high
+```
+
+Separate isolated pin `flex-auth-ops-warden-fetch` (one decision class per pin,
+FLEX-WP-0016):
+
+- `examples/ops-warden-fetch/`: package `ops-warden.secret.read` v1, registry,
+  15 fixtures, 6 Rego tests, check requests.
+- `values/ops-warden-fetch.yaml`: enforce; key-cape and railiance-platform bound
+  to the ops-warden ServiceAccount.
+- `tools/gen_ops_warden_fetch.py`: generates the registry, `catalog_lanes` and
+  the bindings from ops-warden's catalog; `--check` reports drift.
+- Chart `callerAuth.extraBindings`; `tests/stage1.sh` render and drift check.
+- `cmd/flex-auth/ops_warden_fetch_test.go`: decisions, caller bindings read from
+  the values file, registry/policy parity.
+
+2026-10-03: `make ci` green; 12 lanes across 2 owner systems.
+
+## Deploy the pin (founder go required)
+
+```task
+id: FLEX-WP-ADHOC-2026-10-03-T02
+status: wait
+priority: high
+needs_human: true
+blocking_reason: "Live railiance01 change; founder go needed for CI image digest, helm install and tunnel."
+```
+
+Steps, none run yet:
+
+1. Push `main`; Forgejo `image.yaml` builds (trigger `examples/**`). Take the
+   digest from "Report immutable digest" and set `image.digest` in
+   `values/ops-warden-fetch.yaml` (the generator preserves it). Commit.
+2. Preflight on railiance01: CPU headroom
+   (`kubectl describe node | grep -A4 "Allocated resources"`; the new pod
+   requests 25m CPU / 32Mi), then a server dry-run of
+   `helm template flex-auth-ops-warden-fetch charts/flex-auth -f values/ops-warden-fetch.yaml --namespace flex-auth`.
+3. Install on the node (`export KUBECONFIG=/etc/rancher/k3s/k3s.yaml`; chart and
+   values copied with scp):
+   `helm upgrade --install flex-auth-ops-warden-fetch charts/flex-auth -f values/ops-warden-fetch.yaml --namespace flex-auth --atomic`.
+   `flex-auth-ops-warden` (signing) is not touched.
+4. Read the new Service ClusterIP (`kubectl -n flex-auth get svc flex-auth-ops-warden-fetch`).
+5. Workstation tunnel in ops-bridge (`~/.config/bridge/tunnels.yaml`), modelled on
+   `flex-auth-ops-warden-railiance01`: name `flex-auth-ops-warden-fetch-railiance01`,
+   host `92.205.62.239`, `remote_host: <ClusterIP>`, `remote_port: 8080`,
+   `local_port: 19091`, health check `http://127.0.0.1:19091/healthz`; then
+   `bridge up flex-auth-ops-warden-fetch-railiance01`.
+6. Probe with an ops-warden ServiceAccount token minted for audience `flex-auth`
+   (as in FLEX-WP-0016-T03):
+   `check_request_allow_forgejo_admin_api_token.json` → 200 allow;
+   `check_request_deny_unknown_need.json` → 200 deny `unknown_need`;
+   no token → 401; `resource.system: ops-warden` → 403.
+7. ops-warden points its fetch checks at `http://127.0.0.1:19091`, separate from
+   the signing URL `:19090` (its side: WARDEN-WP-0039-T03).
+
+Close-down checklist row 1 (the-custodian) is updated by message, not by edit.