feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

src/warden/routing/catalog.py

@@ -26,9 +26,11 @@ import yaml
 from warden.routing.models import (
     VALID_DELEGATION_MODES,
     VALID_RISK,
+    VALID_WORKLOAD_APPLICABILITY,
     Delegation,
     RotationGuide,
     RouteEntry,
+    WorkloadReference,
 )
 
 # Structured handoff string fields (WP-0014) — templates and pointers only.
@@ -64,6 +66,7 @@ _REQUIRED_FIELDS = (
     "canon_ref",
     "reviewed",
     "status",
+    "workload_ref",
 )
 _VALID_STATUS = ("active", "draft")
 _VALID_LANES = ("secret", "login")
@@ -516,6 +519,82 @@ def _parse_delegation(entry_id: str, raw: Optional[dict]) -> Optional[Delegation
     )
 
 
+def _parse_workload_ref(entry_id: str, raw: object) -> WorkloadReference:
+    """Parse an explicit workload join without attempting identity inference."""
+    if not isinstance(raw, dict):
+        raise CatalogError(
+            f"entry {entry_id!r} workload_ref must be a mapping; every lane must "
+            "declare applicable or not-applicable"
+        )
+
+    applicability = str(raw.get("applicability", "")).strip()
+    if applicability not in VALID_WORKLOAD_APPLICABILITY:
+        raise CatalogError(
+            f"entry {entry_id!r} workload_ref.applicability {applicability!r} invalid "
+            f"(expected one of {VALID_WORKLOAD_APPLICABILITY})"
+        )
+
+    def optional(name: str) -> Optional[str]:
+        value = raw.get(name)
+        return str(value).strip() if value is not None and str(value).strip() else None
+
+    ref = WorkloadReference(
+        applicability=applicability,
+        rapp_id=optional("rapp_id"),
+        name=optional("name"),
+        deployable=optional("deployable"),
+        declaration_ref=optional("declaration_ref"),
+        reason=optional("reason"),
+        unknown_reason=optional("unknown_reason"),
+    )
+
+    target_fields = (ref.rapp_id, ref.name, ref.deployable, ref.declaration_ref)
+    if applicability == "not-applicable":
+        if not ref.reason:
+            raise CatalogError(
+                f"entry {entry_id!r} workload_ref.reason is required for not-applicable"
+            )
+        if any(target_fields) or ref.unknown_reason:
+            raise CatalogError(
+                f"entry {entry_id!r} not-applicable workload_ref must not carry a "
+                "workload target or unknown_reason"
+            )
+        return ref
+
+    if ref.unknown_reason:
+        if any(target_fields) or ref.reason:
+            raise CatalogError(
+                f"entry {entry_id!r} unknown workload_ref must carry only "
+                "applicability and unknown_reason"
+            )
+        return ref
+
+    if not ref.name:
+        raise CatalogError(
+            f"entry {entry_id!r} applicable workload_ref requires name or "
+            "unknown_reason"
+        )
+    if ref.rapp_id:
+        if ref.declaration_ref:
+            raise CatalogError(
+                f"entry {entry_id!r} managed workload_ref must not also carry "
+                "declaration_ref"
+            )
+    elif not ref.declaration_ref:
+        raise CatalogError(
+            f"entry {entry_id!r} operational workload_ref requires declaration_ref"
+        )
+    if ref.deployable and not ref.rapp_id:
+        raise CatalogError(
+            f"entry {entry_id!r} workload_ref.deployable requires rapp_id"
+        )
+    if ref.reason:
+        raise CatalogError(
+            f"entry {entry_id!r} applicable workload_ref must not carry reason"
+        )
+    return ref
+
+
 def _parse_entry(raw: dict, index: int) -> RouteEntry:
     if not isinstance(raw, dict):
         raise CatalogError(f"entry #{index} is not a mapping")
@@ -576,12 +655,16 @@ def _parse_entry(raw: dict, index: int) -> RouteEntry:
             f"entry {entry_id!r} has invalid lane {lane!r} (expected one of {_VALID_LANES})"
         )
 
-    risk = str(raw.get("risk", "standard")).strip() or "standard"
-    if risk not in VALID_RISK:
+    risk_value = raw.get("risk")
+    risk = str(risk_value).strip() if risk_value is not None else "ungraded"
+    risk = risk or "ungraded"
+    if risk != "ungraded" and risk not in VALID_RISK:
         raise CatalogError(
             f"entry {entry_id!r} has invalid risk {risk!r} (expected one of {VALID_RISK})"
         )
 
+    workload_ref = _parse_workload_ref(entry_id, raw.get("workload_ref"))
+
     return RouteEntry(
         id=entry_id,
         title=str(raw["title"]),
@@ -593,6 +676,7 @@ def _parse_entry(raw: dict, index: int) -> RouteEntry:
         canon_ref=str(raw["canon_ref"]),
         reviewed=str(raw["reviewed"]),
         status=status,
+        workload_ref=workload_ref,
         steps=[str(s) for s in steps],
         cert_command=str(cert_command) if cert_command else None,
         auth_method=handoff["auth_method"],