WARDEN-WP-0033-T03: emit the high-risk data-path artifact

railiance-platform asked for a generated list to consume instead of hand-
maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two
lists drift for four lanes in RISK-F-0009.

19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed
separately so absence does not read as omission. Carries catalog_revision and a
dirty flag. fields is null where unestablished, never a one-element guess.

The header states plainly that this is an input and not a policy: railiance-
platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002
survives the handoff.

Two CI tests guard staleness, because a consumer applies this to a live control.
Note the immediate consequence of T02: 2 uncovered against a policy they closed
to 0 yesterday.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

registry/generated/high-risk-data-paths.yaml

@@ -0,0 +1,100 @@
+# GENERATED by scripts/emit_high_risk_paths.py -- do not edit by hand.
+# Concrete KV data paths for lanes ops-warden grades `risk: high`.
+#
+# This is an INPUT, not a policy. ops-warden states which paths it grades
+# high; railiance-platform owns what agent-high-risk-boundary denies and may
+# deny more, deny less, or dispute a grade (ADR-0002, ADR-0008).
+#
+# Grades cover every field a read of the path discloses, not the field the
+# lane is named after (ADR-0008). `fields` is recorded where an owning CCR
+# declares it, and is null where the field set has not been established --
+# null means unknown, never 'one field'.
+
+generated_at: "2026-08-21T06:37:27Z"
+source: ops-warden/registry/routing/catalog.yaml
+catalog_revision: "c357ce5908e562755f3c41c24074edc9d231e6ce"
+catalog_revision_date: "2026-08-21T08:36:42+02:00"
+catalog_dirty: false
+high_risk_lane_count: 19
+concrete_path_count: 14
+
+# Graded high but not a single KV address -- a routing pattern, a broker
+# grant, or a non-KV lane. Nothing here for a policy to deny.
+no_concrete_path:
+  - database-dynamic-credentials
+  - inter-hub-bootstrap-ssh
+  - object-storage-sts
+  - openbao-api-key
+  - ops-warden-warden-sign-token
+
+paths:
+  - id: agent-harness-binky-mail-approle
+    data_path: tenants/data/binky/company-email/imap
+    metadata_path: tenants/metadata/binky/company-email/imap
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: agent-harness-forgejo-deploy
+    data_path: platform/data/workloads/agent-harness/forgejo-deploy-key
+    metadata_path: platform/metadata/workloads/agent-harness/forgejo-deploy-key
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: audit-core-senders
+    data_path: platform/data/workloads/audit-core/senders
+    metadata_path: platform/metadata/workloads/audit-core/senders
+    owner_repo: ops-mason
+    fields: null   # field set not established -- unknown, not one
+  - id: binky-company-email-imap
+    data_path: tenants/data/binky/company-email/imap
+    metadata_path: tenants/metadata/binky/company-email/imap
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: binky-qonto-api
+    data_path: tenants/data/binky/qonto-api
+    metadata_path: tenants/metadata/binky/qonto-api
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: email-connect-transactional
+    data_path: platform/data/workloads/email-connect/transactional
+    metadata_path: platform/metadata/workloads/email-connect/transactional
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: forgejo-admin-api-token
+    data_path: platform/data/workloads/forgejo/forgejo-admin
+    metadata_path: platform/metadata/workloads/forgejo/forgejo-admin
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: issue-core-ingestion-api-key
+    data_path: platform/data/workloads/issue-core/issue-core/issue-core-runtime
+    metadata_path: platform/metadata/workloads/issue-core/issue-core/issue-core-runtime
+    owner_repo: railiance-platform
+    fields: [ISSUE_CORE_API_KEY, GITEA_BACKEND_TOKEN]
+  - id: openrouter-llm-connect
+    data_path: platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
+    metadata_path: platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: railiance-backup-offsite-lane
+    data_path: platform/data/workloads/railiance/backup/offsite-lane
+    metadata_path: platform/metadata/workloads/railiance/backup/offsite-lane
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: rapp-qonto-keycape-client
+    data_path: platform/data/workloads/rapp-qonto/keycape-client
+    metadata_path: platform/metadata/workloads/rapp-qonto/keycape-client
+    owner_repo: key-cape
+    fields: null   # field set not established -- unknown, not one
+  - id: reuse-surface-hub-write-token
+    data_path: platform/data/workloads/reuse/reuse-surface/runtime-secrets
+    metadata_path: platform/metadata/workloads/reuse/reuse-surface/runtime-secrets
+    owner_repo: railiance-platform
+    fields: [REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET]
+  - id: scaleway-bootstrap
+    data_path: platform/data/workloads/railiance/scaleway/bootstrap
+    metadata_path: platform/metadata/workloads/railiance/scaleway/bootstrap
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one
+  - id: whynot-design-npm-publish
+    data_path: platform/data/workloads/coulomb/whynot-design/npm-publish
+    metadata_path: platform/metadata/workloads/coulomb/whynot-design/npm-publish
+    owner_repo: railiance-platform
+    fields: null   # field set not established -- unknown, not one