coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/registry/generated/high-risk-data-paths.yaml

132 lines
6.3 KiB
YAML
Raw Normal View History

WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
# GENERATED by scripts/emit_high_risk_paths.py -- do not edit by hand.
# Concrete KV data paths for lanes ops-warden grades `risk: high`.
#
# This is an INPUT, not a policy. ops-warden states which paths it grades
# high; railiance-platform owns what agent-high-risk-boundary denies and may
# deny more, deny less, or dispute a grade (ADR-0002, ADR-0008).
#
# Grades cover every field a read of the path discloses, not the field the
# lane is named after (ADR-0008). `fields` is recorded where an owning CCR
# declares it, and is null where the field set has not been established --
# null means unknown, never 'one field'.
chore(registry): regenerate high-risk data paths for catalog a14376c Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:52 +02:00
generated_at: "2026-10-17T10:08:52Z"
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
source: ops-warden/registry/routing/catalog.yaml
chore(registry): regenerate high-risk data paths for catalog a14376c Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:52 +02:00
catalog_revision: "a14376cf62945b7df619e81c8d59d0208dec7a3f"
catalog_revision_date: "2026-10-17T12:08:49+02:00"
catalog_dirty: false
feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes nk48 1.3 owner review (owner-review-ops-warden.json): - KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane; refuses a missing, non-active, undelegated or ungraded lane, an owner outside owner_repo, and a mint/change effect on a lane not graded risk high. catalog-routing-acceptance still covers the whole catalog digest. - KERNEL-3: dispatch mode is read from the type's follow_through step (warden_executes/attended). The step must declare both booleans and a lane and agree with the descriptor's lane and owner. Attended: human actor, WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to the step lane. Owner: native delegation, owner_repo == descriptor.owner, no Warden-executed lane and no Warden-brokered mint. - CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1), platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover. Not promoted; promotion waits for owner confirmation. - Fixture catalogs and type steps in tests; published routing_lanes coverage and the workload-join count follow the four new not-applicable lanes. PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:49 +02:00
high_risk_lane_count: 38
Regenerate high-risk path artifact for inbound-library-imap-approle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1170398@bnt-lap001 Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
2026-10-05 16:13:52 +02:00
concrete_path_count: 17
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
# Graded high but not a single KV address -- a routing pattern, a broker
# grant, or a non-KV lane. Nothing here for a policy to deny.
no_concrete_path:
feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes nk48 1.3 owner review (owner-review-ops-warden.json): - KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane; refuses a missing, non-active, undelegated or ungraded lane, an owner outside owner_repo, and a mint/change effect on a lane not graded risk high. catalog-routing-acceptance still covers the whole catalog digest. - KERNEL-3: dispatch mode is read from the type's follow_through step (warden_executes/attended). The step must declare both booleans and a lane and agree with the descriptor's lane and owner. Attended: human actor, WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to the step lane. Owner: native delegation, owner_repo == descriptor.owner, no Warden-executed lane and no Warden-brokered mint. - CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1), platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover. Not promoted; promotion waits for owner confirmation. - Fixture catalogs and type steps in tests; published routing_lanes coverage and the workload-join count follow the four new not-applicable lanes. PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:49 +02:00
- consumer-owner-deployment
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- database-dynamic-credentials
Draft the flex-auth envelope-signing credential route. Pointer-only, warden_executes false. Shape lives in flex-auth; OpenBao path is not built yet. Testdata keys are not this lane. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 09:59:11 +02:00
- flex-auth-decision-envelope-signing-key
chore: regenerate high-risk data paths for fluid-telegram-operator Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
2026-10-09 19:59:49 +02:00
- fluid-telegram-operator
Add informed-decision-sitting-requester reader login lane. Exact CCR-2026-0027 OIDC role. No secret fetch. Platform owns the reviewed exchange-proof child. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
2026-09-15 20:38:47 +02:00
- informed-decision-sitting-requester-login
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- inter-hub-bootstrap-ssh
feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes nk48 1.3 owner review (owner-review-ops-warden.json): - KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane; refuses a missing, non-active, undelegated or ungraded lane, an owner outside owner_repo, and a mint/change effect on a lane not graded risk high. catalog-routing-acceptance still covers the whole catalog digest. - KERNEL-3: dispatch mode is read from the type's follow_through step (warden_executes/attended). The step must declare both booleans and a lane and agree with the descriptor's lane and owner. Attended: human actor, WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to the step lane. Owner: native delegation, owner_repo == descriptor.owner, no Warden-executed lane and no Warden-brokered mint. - CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1), platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover. Not promoted; promotion waits for owner confirmation. - Fixture catalogs and type steps in tests; published routing_lanes coverage and the workload-join count follow the four new not-applicable lanes. PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:49 +02:00
- keycape-attended-case-change
chore: regenerate high-risk data paths for keycape-client-secret-generate Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 427672@bnt-lap001 Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
2026-10-10 10:24:52 +02:00
- keycape-client-secret-generate
Re-emit the high-risk path artifact after the NetKingdom SSO lanes c374d41 added net-kingdom-lldap-bind-credential and net-kingdom-privacyidea-admin-token as `risk: high` and did not re-run the emitter, so registry/generated/high-risk-data-paths.yaml still described the catalog at 0fae090. railiance-platform consumes that file instead of hand-maintaining its deny list, and it has been reading a census two lanes short since 2026-08-23. This is precisely the drift WARDEN-WP-0033-T03 built the guard for — a lane graded high after the last emit silently failing to reach the consumer. The guard fired; nothing had acted on it. The deny list itself does not move: both lanes are blocked on their OpenBao path being published, so they land in `no_concrete_path` and concrete_path_count stays 14. What changes is the count the consumer sees — 23 high-risk lanes, two of which have no address yet. That is the honest signal and the reason the bucket is listed rather than omitted. check_agent_read_boundary.py still reports 0 uncovered. The workload-join census moves 9 -> 11 not-applicable: both lanes are provider/control-plane credentials rather than workload delivery lanes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014535@bnt-lap001 Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c
2026-08-28 21:55:33 +02:00
- net-kingdom-lldap-bind-credential
- net-kingdom-privacyidea-admin-token
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- object-storage-sts
- openbao-api-key
fix: route OpenBao platform administration login Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-22 19:08:21 +02:00
- openbao-platform-admin-login
chore: refresh high-risk route artifact Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
2026-08-22 20:55:08 +02:00
- openbao-shamir-recovery-ceremony
WARDEN-WP-0042: regenerate high-risk path artifact for openbao-structure-survey Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1170398@bnt-lap001 Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
2026-10-05 13:21:23 +02:00
- openbao-structure-survey
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- ops-warden-warden-sign-token
feat(case): KERNEL-2/3 lane resolution and mode-aware admission; CATALOG-1 draft lanes nk48 1.3 owner review (owner-review-ops-warden.json): - KERNEL-2: Executor.admit parses catalog_source and resolves descriptor.lane; refuses a missing, non-active, undelegated or ungraded lane, an owner outside owner_repo, and a mint/change effect on a lane not graded risk high. catalog-routing-acceptance still covers the whole catalog digest. - KERNEL-3: dispatch mode is read from the type's follow_through step (warden_executes/attended). The step must declare both booleans and a lane and agree with the descriptor's lane and owner. Attended: human actor, WARDEN_AGENT_ID unset, parent-session revocation scope, caller lane equal to the step lane. Owner: native delegation, owner_repo == descriptor.owner, no Warden-executed lane and no Warden-brokered mint. - CATALOG-1: draft entries keycape-attended-case-change (OW-1.3-C1), platform-secret-delivery, consumer-owner-deployment, apps-consumer-handover. Not promoted; promotion waits for owner confirmation. - Fixture catalogs and type steps in tests; published routing_lanes coverage and the workload-join count follow the four new not-applicable lanes. PARAMETER_PINS untouched (PIN-1 waits for founder acknowledgment). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
2026-10-17 12:08:49 +02:00
- platform-secret-delivery
Add platform-supplier-credentials pointer and review the OIDC RP follow-through WARDEN-WP-0043-T01: pointer lane and playbook for platform/suppliers/<supplier>/<account>. railiance-platform owns the write; warden_executes false. WARDEN-WP-0044-T01: review of net-kingdom's oidc-browser-relying-party 1.0 follow_through section. Requires a per-step lane, a narrow warden_executes, and value_handling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327285@bnt-lap001 Assistant-Session: d6532cd1-7cd5-417b-baac-b841c9103a6b
2026-10-08 23:25:22 +02:00
- platform-supplier-credentials
Register the State Hub Forgejo derivation-read routing lane. Pointer-only catalog entry so warden route find "state hub read private repository" resolves. ops-warden routes and does not execute. MASON-WP-0003-T03. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 04:57:55 +02:00
- secrets-engine-approval-client-login
- secrets-engine-requester-login
- state-hub-forge-derivation-read
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
paths:
- id: agent-harness-binky-mail-approle
data_path: tenants/data/binky/company-email/imap
metadata_path: tenants/metadata/binky/company-email/imap
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: agent-harness-forgejo-deploy
data_path: platform/data/workloads/agent-harness/forgejo-deploy-key
metadata_path: platform/metadata/workloads/agent-harness/forgejo-deploy-key
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: audit-core-senders
data_path: platform/data/workloads/audit-core/senders
metadata_path: platform/metadata/workloads/audit-core/senders
owner_repo: ops-mason
fields: null # field set not established -- unknown, not one
- id: binky-company-email-imap
data_path: tenants/data/binky/company-email/imap
metadata_path: tenants/metadata/binky/company-email/imap
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: binky-qonto-api
data_path: tenants/data/binky/qonto-api
metadata_path: tenants/metadata/binky/qonto-api
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
CUST-WP-0075: regenerate high-risk path artifact for core-hub-forgejo-source-read Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 12:55:45 +02:00
- id: core-hub-forgejo-source-read
data_path: platform/data/workloads/core-hub/forgejo-source-read
metadata_path: platform/metadata/workloads/core-hub/forgejo-source-read
owner_repo: railiance-platform
fields: [FORGEJO_SOURCE_TOKEN, API_USER, API_BASE_URL, TOKEN_SCOPES, GENERATED_AT]
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- id: email-connect-transactional
data_path: platform/data/workloads/email-connect/transactional
metadata_path: platform/metadata/workloads/email-connect/transactional
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: forgejo-admin-api-token
data_path: platform/data/workloads/forgejo/forgejo-admin
metadata_path: platform/metadata/workloads/forgejo/forgejo-admin
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
Regenerate high-risk path artifact for inbound-library-imap-approle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1170398@bnt-lap001 Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
2026-10-05 16:13:52 +02:00
- id: inbound-library-imap-approle
data_path: platform/data/workloads/inbound-library/imap
metadata_path: platform/metadata/workloads/inbound-library/imap
owner_repo: ops-mason
fields: null # field set not established -- unknown, not one
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- id: issue-core-ingestion-api-key
data_path: platform/data/workloads/issue-core/issue-core/issue-core-runtime
metadata_path: platform/metadata/workloads/issue-core/issue-core/issue-core-runtime
owner_repo: railiance-platform
fields: [ISSUE_CORE_API_KEY, GITEA_BACKEND_TOKEN]
- id: openrouter-llm-connect
data_path: platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
metadata_path: platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
chore: refresh high-risk credential paths Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
2026-09-01 00:47:25 +02:00
- id: policy-nexus-forgejo-source-read
data_path: platform/data/workloads/policy-nexus/forgejo-source-read
metadata_path: platform/metadata/workloads/policy-nexus/forgejo-source-read
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
WARDEN-WP-0033-T03: emit the high-risk data-path artifact railiance-platform asked for a generated list to consume instead of hand- maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two lists drift for four lanes in RISK-F-0009. 19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed separately so absence does not read as omission. Carries catalog_revision and a dirty flag. fields is null where unestablished, never a one-element guess. The header states plainly that this is an input and not a policy: railiance- platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002 survives the handoff. Two CI tests guard staleness, because a consumer applies this to a live control. Note the immediate consequence of T02: 2 uncovered against a policy they closed to 0 yesterday. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:38:13 +02:00
- id: railiance-backup-offsite-lane
data_path: platform/data/workloads/railiance/backup/offsite-lane
metadata_path: platform/metadata/workloads/railiance/backup/offsite-lane
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: rapp-qonto-keycape-client
data_path: platform/data/workloads/rapp-qonto/keycape-client
metadata_path: platform/metadata/workloads/rapp-qonto/keycape-client
owner_repo: key-cape
fields: null # field set not established -- unknown, not one
- id: reuse-surface-hub-write-token
data_path: platform/data/workloads/reuse/reuse-surface/runtime-secrets
metadata_path: platform/metadata/workloads/reuse/reuse-surface/runtime-secrets
owner_repo: railiance-platform
fields: [REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET]
- id: scaleway-bootstrap
data_path: platform/data/workloads/railiance/scaleway/bootstrap
metadata_path: platform/metadata/workloads/railiance/scaleway/bootstrap
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
- id: whynot-design-npm-publish
data_path: platform/data/workloads/coulomb/whynot-design/npm-publish
metadata_path: platform/metadata/workloads/coulomb/whynot-design/npm-publish
owner_repo: railiance-platform
fields: null # field set not established -- unknown, not one
Reference in a new issue Copy permalink