95 lines
4.2 KiB
Markdown
95 lines
4.2 KiB
Markdown
|
---
|
||
|
|
id: ops-warden-adr-0008
|
||
|
|
type: adr
|
||
|
|
title: "ADR-0008 — A lane's risk grade covers every field its path discloses"
|
||
|
|
domain: infotech
|
||
|
|
repo: ops-warden
|
||
|
|
status: accepted
|
||
|
|
version: "1.0"
|
||
|
|
revision: "1"
|
||
|
|
owner: ops-warden
|
||
|
|
binds: "ops-warden"
|
||
|
|
created: "2026-08-21"
|
||
|
|
updated: "2026-08-21"
|
||
|
|
last_reviewed: "2026-08-21"
|
||
|
|
review_interval: 6m
|
||
|
|
enforced_by: "registry/routing/catalog.yaml fields + risk; tests/test_routing.py::test_high_risk_lanes_classified"
|
||
|
|
supersedes: ""
|
||
|
|
successor: ""
|
||
|
|
---
|
||
|
|
|
||
|
|
# ADR-0008 — A lane's risk grade covers every field its path discloses
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
Accepted 2026-08-21, after `secrets-engine` found two under-graded lanes while
|
||
|
|
reviewing ops-warden's own catalog metadata.
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
`ADR-0007` requires every catalog lane to carry an explicit `risk` grade. It does
|
||
|
|
not say what the grade is *of*, and the omission turned out to matter.
|
||
|
|
|
||
|
|
The catalog describes a lane by a single `fetch_command` naming a single field —
|
||
|
|
`bao kv get -field=ISSUE_CORE_API_KEY <path>`. Grading followed that description.
|
||
|
|
But the unit of disclosure is not the field, it is the **path**: `bao kv get`
|
||
|
|
without `-field` returns every key stored there, and an agent session that
|
||
|
|
discloses one field has disclosed all of them.
|
||
|
|
|
||
|
|
On 2026-08-19, grading all 27 lanes, ops-warden graded
|
||
|
|
`issue-core-ingestion-api-key` and `reuse-surface-hub-write-token` as `standard`
|
||
|
|
— "ordinary internal workload secrets". Both grades read only the headline field.
|
||
|
|
`CCR-2026-0002` records a deliberate decision to keep `GITEA_BACKEND_TOKEN` at the
|
||
|
|
first path; `CCR-2026-0005` declares a dual-consumer webhook HMAC at the second.
|
||
|
|
Neither is recovered by rotating the credential the lane is named after.
|
||
|
|
|
||
|
|
Three details make this worth a record rather than a fix:
|
||
|
|
|
||
|
|
- **The evidence was already ours.** The field sets were in the CCRs the catalog
|
||
|
|
already cites as authoritative. This was not missing data; it was unread data.
|
||
|
|
- **A test held the error still.** `test_high_risk_lanes_classified` asserted
|
||
|
|
`issue-core-ingestion-api-key` was *not* high. A first grading pass had marked
|
||
|
|
it high, the test contradicted it, and the test was believed. A test that
|
||
|
|
encodes a judgement defends that judgement from correction.
|
||
|
|
- **Another repo found it.** `secrets-engine` graded both `high` independently
|
||
|
|
while drafting catalog entries whose schema records `fields`. A schema that
|
||
|
|
names the field set makes the right grade obvious; ours did not have one.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
**A lane's `risk` grade is a property of its path, and must cover the union of
|
||
|
|
everything a read of that path would disclose.**
|
||
|
|
|
||
|
|
1. Where the field set is known, the catalog records it as `fields`, with the
|
||
|
|
authority it came from.
|
||
|
|
2. The grade is argued against the most damaging field, not the named one.
|
||
|
|
3. Where the field set is unknown, that is stated — never assumed to be one
|
||
|
|
field. An unverified field set is a reason to grade conservatively, matching
|
||
|
|
the `inter-hub-bootstrap-ssh` precedent under `ADR-0007`.
|
||
|
|
4. Establishing a field set must not be done by reading the secret. Use the
|
||
|
|
owning CCR, the owner's catalog, or `bao kv metadata`. `bao kv get` on a
|
||
|
|
high-risk path is the 2026-07-16 vector and is forbidden by
|
||
|
|
`ADR-0004` for agent sessions regardless of intent.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
`ADR-0007` is unchanged and still governs: every lane carries an explicit grade,
|
||
|
|
and absence fails safe. This record says what that grade must account for.
|
||
|
|
|
||
|
|
Grading gets more expensive: it now requires knowing what is at a path, not just
|
||
|
|
what the lane is called. That cost is the point — the cheap version produced two
|
||
|
|
wrong answers in one pass and is the reason this exists.
|
||
|
|
|
||
|
|
A test that asserts a grade is asserting a judgement. When a grade is disputed,
|
||
|
|
re-argue it from evidence before trusting the test that encodes it.
|
||
|
|
|
||
|
|
## Related
|
||
|
|
|
||
|
|
- `ADR-0007` — every lane carries an explicit grade; build-stage permissiveness
|
||
|
|
stops at credential disclosure
|
||
|
|
- `ADR-0004` — high-risk lanes refuse raw value streaming to agent sessions
|
||
|
|
- `ADR-0001` — the catalog is a pointer layer; `fields` records the owner's
|
||
|
|
declared field set with its source, and does not restate their procedure
|
||
|
|
- `WARDEN-WP-0033-T02`; `secrets-engine` `SECRETS-WP-0006`
|
||
|
|
- `history/2026-07-16-credential-disclosure-lessons.md`
|