feat: refuse to answer a write with a read (WARDEN-WP-0038)

`warden plan` scored needs by keyword overlap with no notion of what the
caller wanted to DO, so "generate a successor secret and CAS-write it to two
custodians" matched the lane that READS that path and inherited its
`autonomous` verdict -- answered with --out/--exec/--wrap.

Two counterparties reported it in two days. key-cape distrusted the output on
principle and was right to; railiance-platform, answering as the write
authority being wrongly bypassed, said plainly that `founder_required` is the
verdict it should have returned and that until it is fixed a plan result must
not stand in for the owner's answer.

A mutating need on a lane ops-warden does not permanently own can no longer
reach any branch returning `autonomous`: it becomes `founder_required` with
an approve act naming the write owner, or `unroutable` with a CCR stub when
the lane admits no rotation route. Commands carry no read transport either
way, which is the half that made the wrong verdict actionable.

The ownership test does the work a verb list cannot. SSH certificate
issuance is itself a mutating act, so `delegation.mode: permanent` -- not the
absence of a verb -- separates ops-warden's own front door from someone
else's custody. A regression asserts `warden sign` still proceeds; a guard
that refused our own lane would be worse than the defect it fixes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

src/warden/plan.py

@@ -98,6 +98,48 @@ def _candidate_row(entry: RouteEntry, score: int) -> dict:
     }
 
 
+#: Verbs that make a need a request to CHANGE custody rather than to read it
+#: (WARDEN-WP-0038). Reported independently by key-cape (2026-09-08) and
+#: railiance-platform (2026-09-09): a need saying "generate a successor secret and
+#: CAS-write it to two custodians" scored well against the lane that READS that
+#: path and inherited its `autonomous` verdict, answered with three read
+#: transports.
+#:
+#: Deliberately not including "issue" or "sign". SSH certificate issuance is a
+#: mutating act ops-warden owns outright, and the ownership test below is what
+#: separates it from someone else's custody — not the absence of the verb.
+MUTATE_TOKENS = frozenset({
+    "rotate", "rotating", "rotation", "rerotate",
+    "generate", "regenerate", "mint", "reissue",
+    "write", "rewrite", "put", "patch", "cas",
+    "provision", "reprovision", "create", "install",
+    "revoke", "revoking", "disable", "delete", "remove",
+    "replace", "successor", "reset", "restart", "update",
+})
+
+
+def _need_intent(need: str) -> str:
+    """``mutate`` when the need asks to change a credential, else ``read``.
+
+    Token match, not substring: "update" must not fire on "updated docs" any
+    more than it already would, but "no-update" style hyphenation is normalised
+    the same way the scorer normalises it.
+    """
+    tokens = {t.strip(".,;:()") for t in need.lower().replace("-", " ").split()}
+    return "mutate" if tokens & MUTATE_TOKENS else "read"
+
+
+def _owns_write_authority(entry: RouteEntry) -> bool:
+    """Whether ops-warden may itself perform a mutating act on this lane.
+
+    True only where ops-warden is the designed owner of the front door — the SSH
+    signing lane, `delegation.mode: permanent`. Everywhere else ops-warden is a
+    pointer or a caller-identity proxy (`ADR-0002`, `ADR-0005`), so a write is
+    another component's custody act and no plan verdict here can authorise it.
+    """
+    return entry.effective_delegation.mode == "permanent"
+
+
 def _score_for(catalog: Catalog, entry: RouteEntry, need: str) -> int:
     if entry.id == need.strip():
         return 100
@@ -294,6 +336,7 @@ def build_plan(
         )
 
     entry, score = matches[0]
+    intent = _need_intent(need)
 
     # Draft-only top match without active alternatives → unroutable
     if entry.status == "draft" and not include_draft:
@@ -378,6 +421,80 @@ def build_plan(
             domain=domain,
         )
 
+    # --- mutating need on a lane ops-warden does not own (WARDEN-WP-0038) ------
+    #
+    # Must run before any branch that can return `autonomous`. A write is a
+    # custody act belonging to the lane owner, and `autonomous` is documented as
+    # the signal to proceed without the founder — so returning it here would let
+    # this front door authorise a mutation on someone else's custody. It would
+    # also answer a write with `--out`/`--exec`/`--wrap`, which are reads.
+    if intent == "mutate" and not _owns_write_authority(entry):
+        rotation = entry.rotation
+        owner = (rotation.owner if rotation else None) or entry.owner_repo
+        reasons = [
+            "need asks to change a credential, not read one",
+            f"write authority on this lane belongs to {owner}, not ops-warden",
+        ]
+        if rotation is not None:
+            act = FounderAct(
+                kind="approve",
+                summary=(
+                    f"Attended owner act required to change {entry.id} — "
+                    f"{owner} holds write authority"
+                ),
+                details={
+                    "lane_id": entry.id,
+                    "write_owner": owner,
+                    "rotation_method": rotation.method,
+                    "rotation_automatable": rotation.automatable,
+                    "wiki_ref": entry.wiki_ref,
+                    "guidance_command": f"warden rotate-guide {entry.id}",
+                    "desk_hint": f"warden desk --act approve --lane {entry.id}",
+                },
+            )
+            if not rotation.automatable:
+                reasons.append(
+                    "lane records the rotation as not automatable — an executable "
+                    "driver must not attempt it"
+                )
+            return AccessPlan(
+                need=need,
+                verdict="founder_required",
+                organization_posture=org,
+                policy_gate=gate,
+                lane_id=entry.id,
+                lane_title=entry.title,
+                match_score=score,
+                # Deliberately empty: every command this lane offers is a READ,
+                # and offering one against a write need is the reported defect.
+                commands=[f"warden rotate-guide {entry.id}   # guidance, not execution"],
+                founder_act=act,
+                catalog=freshness,
+                candidates=candidates,
+                reasons=reasons,
+                actor=actor,
+                domain=domain,
+            )
+        stub = _ccr_stub(need)
+        stub["owner_hint"] = f"{owner} (write authority for {entry.id})"
+        reasons.append("lane records no rotation route — the act has no admitted transport")
+        return AccessPlan(
+            need=need,
+            verdict="unroutable",
+            organization_posture=org,
+            policy_gate=gate,
+            lane_id=entry.id,
+            lane_title=entry.title,
+            match_score=score,
+            commands=[],
+            ccr_stub=stub,
+            catalog=freshness,
+            candidates=candidates,
+            reasons=reasons,
+            actor=actor,
+            domain=domain,
+        )
+
     if _lane_is_autonomous(entry):
         return AccessPlan(
             need=need,