From 50e185ed7b6d0583f5b505b398949679c305582e Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 20 Aug 2026 07:11:03 +0200 Subject: [PATCH] Check the OpenBao half of the read-boundary; route RISK-F-0004 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit agent-high-risk-boundary denies 5 data paths, covering 6 of ops-warden's 17 high-risk lanes. Eight high-risk lanes with concrete KV paths are not denied, four of which were already graded high before the 2026-08-19 regrade — the divergence is pre-existing and the regrade only made the lists comparable. This is the layer that matters most: warden access exits 7 for all 17, but that protects only the ops-warden path. The policy protects a direct bao kv get, which is the 2026-07-16 vector. Routed to risk-nexus as RISK-F-0004 with fix_owner railiance-platform, since the policy is theirs. Live confirmation outstanding — ops-warden's OpenBao token is expired, so this is a static file-vs-catalog comparison and the finding says so rather than implying it was verified against the server. Co-Authored-By: Claude Opus 5 --- WORK-RECORDS.md | 2 +- workplans/WARDEN-WP-0032-security-zones.md | 27 +++++++++++++++++++--- 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 07d7174..c0c082b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -120,4 +120,4 @@ | task | WARDEN-WP-0032-T03 | wait | — | workplans/WARDEN-WP-0032-security-zones.md | | task | WARDEN-WP-0032-T04 | wait | — | workplans/WARDEN-WP-0032-security-zones.md | | task | WARDEN-WP-0032-T05 | done | — | workplans/WARDEN-WP-0032-security-zones.md | -| task | WARDEN-WP-0032-T06 | wait | — | workplans/WARDEN-WP-0032-security-zones.md | +| task | WARDEN-WP-0032-T06 | progress | — | workplans/WARDEN-WP-0032-security-zones.md | diff --git a/workplans/WARDEN-WP-0032-security-zones.md b/workplans/WARDEN-WP-0032-security-zones.md index 1e4a836..10e5bfc 100644 --- a/workplans/WARDEN-WP-0032-security-zones.md +++ b/workplans/WARDEN-WP-0032-security-zones.md @@ -256,9 +256,30 @@ ungraded lane being committed. Four regression tests cover it. maturity-derived default: an experimental-context lane may be explicitly accepted, which is a graded decision rather than an omission. -**Still open on this task:** whether the maturity-derived default replaces the -`ungraded` sentinel entirely (waits on `ZONE-WP-0001-T03`), and verifying -OpenBao's `agent-high-risk-boundary` policy covers these paths. +**Second layer checked 2026-08-20 — it does not cover them.** The OpenBao side +was compared statically (policy file vs catalog): `agent-high-risk-boundary` +denies 5 data paths covering **6** of the **17** high-risk lanes. Eight +high-risk lanes with concrete KV paths are not denied — and **four of those were +already graded `high` before the regrade**, so the divergence is pre-existing +rather than something the grading introduced. It had simply never been +comparable before. + +This matters more than the ops-warden half: `warden access` exits 7 for all 17, +but that only protects the ops-warden path. The OpenBao policy is what protects a +direct `bao kv get`, which is the actual 2026-07-16 vector. + +Routed to `risk-nexus` as **`RISK-F-0004`**, `fix_owner: railiance-platform` — +the policy is theirs, and ops-warden does not amend another repo's control. + +**Live confirmation still outstanding.** ops-warden's OpenBao token is expired +(`bao token lookup` → 403), so `bao policy read` and `bao token capabilities` +could not be run and the deployed policy may differ from the file. A +capabilities-only verification script is ready and needs an operator +`bao login -method=oidc` to run; it is deliberately capabilities-only, never a +read. + +**Still open:** whether the maturity-derived default replaces the `ungraded` +sentinel entirely (waits on `ZONE-WP-0001-T03`). ## Related