feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

src/warden/cli.py

@@ -16,6 +16,7 @@ from warden.config import ConfigError, WardenConfig, load_config
 from warden.policy import check_sign_policy
 from warden.inventory import ActorEntry, InventoryError, PrincipalsInventory, load_inventory, save_inventory
 from warden.models import ActorType, CertSpec, DEFAULT_TTL_HOURS, validate_actor_name
+from warden.routing.catalog import blocker_stale_days
 from warden.scorecard import run_scorecard
 
 app = typer.Typer(
@@ -120,7 +121,7 @@ def _get_ca(cfg: WardenConfig):
 
 
 def _apply_policy_gate(cfg: WardenConfig, spec: CertSpec) -> None:
-    """Run flex-auth check when policy.enabled; sets spec.policy_decision_id."""
+    """Run the zone-aware flex-auth check; record any returned decision id."""
     decision_id = check_sign_policy(cfg.policy, spec)
     if decision_id:
         spec.policy_decision_id = decision_id
@@ -644,6 +645,7 @@ def _entry_summary(entry) -> dict:
         # Agent read-boundary (WP-0026 T04) — high-risk lanes deny raw agent data reads.
         "risk": entry.risk,
         "high_risk": entry.is_high_risk,
+        "workload_ref": entry.workload_ref.to_dict(),
         # Renewal guidance (WP-0026 T06) — advisory, no secret values. `has_rotation`
         # lets a caller gate before asking for the full block via `warden rotate-guide`.
         "has_rotation": entry.has_rotation,
@@ -771,9 +773,6 @@ def route_list(
     )
 
 
-from warden.routing.catalog import blocker_stale_days
-
-
 def _gap_is_stale(entry, delegation, reviewed: str, stale_days) -> bool:
     """An interim lane needs attention on either of two independent grounds.
 
@@ -1255,6 +1254,14 @@ def _access_proxy(
             "token stays in the caller's own store.[/dim]"
         )
     else:
+        if no_policy:
+            err.print(
+                "[red]--no-policy is retired[/red]: security-zones_v0.1 selects "
+                "the policy stance and failure mode. Remove the flag; an unresolved "
+                "workload uses the explicit unknown-zone profile."
+            )
+            raise typer.Exit(2)
+
         # G1 — caller identity. ops-warden adds no token of its own.
         if not caller_auth_present():
             err.print(
@@ -1263,24 +1270,20 @@ def _access_proxy(
             )
             raise typer.Exit(3)
 
-        # G3 — policy gate before fetch.
-        if cfg.policy.enabled:
-            try:
-                decision_id = check_fetch_policy(
-                    cfg.policy, need_id=entry.id, owner_repo=entry.owner_repo, domain=domain
-                )
-            except CAError as e:
-                err.print(f"[red]Policy gate denied the fetch:[/red] {e}")
-                raise typer.Exit(4)
-            err.print(f"[green]flex-auth allow[/green] (decision {decision_id}).")
-        elif not no_policy:
-            err.print(
-                "[yellow]flex-auth gate is not enforced[/yellow] (policy.enabled=false). "
-                "Re-run with [bold]--no-policy[/bold] to proxy ungated, or enable the gate."
+        # G3 — the zone-aware policy gate always runs before fetch.
+        try:
+            decision_id = check_fetch_policy(
+                cfg.policy, need_id=entry.id, owner_repo=entry.owner_repo, domain=domain
             )
+        except CAError as e:
+            err.print(f"[red]Policy gate denied the fetch:[/red] {e}")
             raise typer.Exit(4)
+        if decision_id:
+            err.print(f"[green]flex-auth decision[/green] ({decision_id}).")
         else:
-            err.print("[yellow]Proxying ungated[/yellow] (--no-policy; gate not enforced).")
+            err.print(
+                "[yellow]flex-auth unavailable; unknown-zone fail_open applied[/yellow]."
+            )
 
     # Wrapping (WP-0026 T02) uses its own command shape; the value-bearing transports
     # share the resolved fetch command.
@@ -1434,7 +1437,10 @@ def access(
     ] = False,
     no_policy: Annotated[
         bool,
-        typer.Option("--no-policy", help="Acknowledge proxying when the flex-auth gate is not enforced"),
+        typer.Option(
+            "--no-policy",
+            help="Retired compatibility flag; zone-aware policy evaluation cannot be bypassed",
+        ),
     ] = False,
 ) -> None:
     """Operator front door: how to obtain any credential, gated and audited.