feat: refuse to answer a write with a read (WARDEN-WP-0038)

`warden plan` scored needs by keyword overlap with no notion of what the
caller wanted to DO, so "generate a successor secret and CAS-write it to two
custodians" matched the lane that READS that path and inherited its
`autonomous` verdict -- answered with --out/--exec/--wrap.

Two counterparties reported it in two days. key-cape distrusted the output on
principle and was right to; railiance-platform, answering as the write
authority being wrongly bypassed, said plainly that `founder_required` is the
verdict it should have returned and that until it is fixed a plan result must
not stand in for the owner's answer.

A mutating need on a lane ops-warden does not permanently own can no longer
reach any branch returning `autonomous`: it becomes `founder_required` with
an approve act naming the write owner, or `unroutable` with a CCR stub when
the lane admits no rotation route. Commands carry no read transport either
way, which is the half that made the wrong verdict actionable.

The ownership test does the work a verb list cannot. SSH certificate
issuance is itself a mutating act, so `delegation.mode: permanent` -- not the
absence of a verb -- separates ops-warden's own front door from someone
else's custody. A regression asserts `warden sign` still proceeds; a guard
that refused our own lane would be worse than the defect it fixes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

workplans/WARDEN-WP-0038-plan-mutation-intent.md

@@ -4,14 +4,14 @@ type: workplan
 title: "warden plan must distinguish reading a secret from mutating one"
 domain: infotech
 repo: ops-warden
-status: proposed
+status: finished
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1
 depends_on_workplans:
   - WARDEN-WP-0029
 created: "2026-09-08"
-updated: "2026-09-08"
+updated: "2026-09-09"
 state_hub_workstream_id: "751ad530-e44b-52c4-b70e-cb47568a0179"
 ---
 
@@ -70,3 +70,57 @@ acts it admits (`read`, `rotate`, `provision`) and `plan` could refuse any act a
 lane does not declare — stricter, and it fails closed on lanes that say nothing,
 which is the majority today. That is a catalog schema change and needs its own
 argument.
+
+## Confirmed independently, then fixed — 2026-09-09
+
+`railiance-platform` hit the same defect from the other side while answering the
+Qonto custody routing question (msg `7c7228ac`). Having stated that the correct
+verdict is `founder_required` — attended OIDC via `netkingdom` `role=platform-admin`,
+through the governed `openbao-platform-admin-login` lane — they added:
+
+> Note this is the same verdict your `warden plan` should have returned; it
+> returning `autonomous` and offering read transports for a write is a real
+> defect and WARDEN-WP-0038 is the right place for it. Until that is fixed, do
+> not let a plan result stand in for this answer.
+
+Two counterparties reporting the same wrong verdict in two days, one of whom is
+the write authority being wrongly bypassed, moved this from proposed to shipped.
+
+### What shipped
+
+`_need_intent()` classifies a need as `mutate` or `read` by token match, and
+`_owns_write_authority()` tests `delegation.mode == "permanent"`. A mutating need
+on a lane ops-warden does not permanently own can no longer reach any branch that
+returns `autonomous`:
+
+- lane declares a `rotation` → `founder_required`, with an `approve` act naming
+  the write owner, the rotation method, whether it is automatable, and
+  `warden rotate-guide` as guidance;
+- lane declares none → `unroutable` with a CCR stub whose `owner_hint` names the
+  write authority.
+
+**Commands are empty of read transports either way.** That is the half that made
+the wrong verdict actionable rather than merely wrong: `--out`, `--exec`,
+`--wrap` and a bare `bao kv get` were being offered as the answer to a write, and
+a test now asserts none of them appears.
+
+### The design question in the plan, answered by use
+
+The plan asked whether intent belongs in the matcher or in the lane. It went in
+the matcher, with the *ownership* test doing the work that a verb list cannot:
+SSH certificate issuance is itself a mutating act, and `warden sign` must stay
+`autonomous`. `delegation.mode: permanent` is what separates ops-warden's own
+front door from someone else's custody — not the absence of a verb from a list.
+A regression asserts the SSH lane still proceeds, because a guard that refuses
+our own lane would be a worse defect than the one it fixes.
+
+The stricter alternative — lanes declaring which acts they admit, `plan` refusing
+anything undeclared — is not built. It is a catalog schema change that would fail
+closed on the majority of lanes, which say nothing today, and it needs its own
+argument rather than arriving as a side effect of this fix.
+
+### Not claimed
+
+This narrows what `warden plan` will assert; it does not make the tool an
+authority on custody. railiance-platform's instruction stands and is the right
+standing posture: a plan result does not substitute for the owner's answer.