Add informed-decision-sitting-requester reader login lane.

Exact CCR-2026-0027 OIDC role. No secret fetch. Platform owns the
reviewed exchange-proof child.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

registry/generated/high-risk-data-paths.yaml

@@ -10,12 +10,12 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-09-14T07:58:30Z"
+generated_at: "2026-09-15T18:38:11Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "4ebd241d88e0f65125b3097a6d3aeccd4c294eb6"
-catalog_revision_date: "2026-09-14T04:57:55+02:00"
+catalog_revision: "8a40dcb11b729115773630e449fd880c0700372e"
+catalog_revision_date: "2026-09-14T09:59:11+02:00"
 catalog_dirty: true
-high_risk_lane_count: 28
+high_risk_lane_count: 29
 concrete_path_count: 15
 
 # Graded high but not a single KV address -- a routing pattern, a broker
@@ -23,6 +23,7 @@ concrete_path_count: 15
 no_concrete_path:
   - database-dynamic-credentials
   - flex-auth-decision-envelope-signing-key
+  - informed-decision-sitting-requester-login
   - inter-hub-bootstrap-ssh
   - net-kingdom-lldap-bind-credential
   - net-kingdom-privacyidea-admin-token

registry/routing/catalog.yaml

@@ -238,6 +238,30 @@ entries:
     exec_capable: true
     lane: login
 
+  - id: informed-decision-sitting-requester-login
+    title: Attended Informed Decision sitting-requester reader login
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended operator identity for the exact CCR-2026-0027 reader."
+    need_keywords: [informed-decision, sitting-requester, reader, login, ccr-2026-0027]
+    owner_repo: railiance-platform
+    subsystem: OpenBao scoped operator OIDC via KeyCape
+    warden_executes: false
+    wiki_ref: wiki/playbooks/informed-decision-sitting-requester-login.md
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml
+    reviewed: "2026-09-15"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-09-15"
+      verified: source-read
+    auth_method: "attended KeyCape OIDC, netkingdom role informed-decision-sitting-requester-workload-kv-read"
+    fetch_command: "bao login -no-print -method=oidc -path=netkingdom role=informed-decision-sitting-requester-workload-kv-read"
+    exec_capable: true
+    lane: login
+
   - id: openbao-shamir-recovery-ceremony
     title: Attended OpenBao Shamir seal and unseal recovery ceremony
     # A ceremony pointer, not a credential-value lane. Approval coordinates

wiki/playbooks/informed-decision-sitting-requester-login.md

@@ -0,0 +1,17 @@
+# Sitting-requester reader session
+
+CCR-2026-0027 admits only
+`platform/workloads/informed-decision/sitting-requester`. The contained Warden
+login uses `informed-decision-sitting-requester-workload-kv-read`. Its owner
+command checks exact reader policies, sibling denial of
+`secrets-engine/approval-requester`, and a create-only KeyCape token exchange.
+It does not POST sittings and never prints the client secret.
+
+Use the current source catalog explicitly:
+
+`WARDEN_ROUTING_CATALOG=/home/worsch/ops-warden/registry/routing/catalog.yaml`
+
+The reviewed child is
+`/home/worsch/railiance-platform/scripts/prove-sitting-requester-exchange.sh`.
+OpenBao is reached through `http://127.0.0.1:18200`. Warden self-revokes after
+the child exits.