feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tests/test_proxy.py

@@ -193,7 +193,6 @@ def _warden_yaml(tmp_path: Path) -> Path:
     (tmp_path / "ca").write_text("")
     cfg.write_text(
         f"backend: local\nca_key: {tmp_path/'ca'}\nstate_dir: {tmp_path/'state'}\n"
-        "policy:\n  enabled: false\n"
     )
     return cfg
 
@@ -203,10 +202,11 @@ def _proxy_env(monkeypatch, tmp_path):
     monkeypatch.setenv("WARDEN_CONFIG", str(_warden_yaml(tmp_path)))
 
 
-def test_cli_proxy_refuses_without_policy_ack(monkeypatch, tmp_path):
+def test_cli_proxy_unknown_zone_fail_open_reaches_transport_guard(monkeypatch, tmp_path):
     _proxy_env(monkeypatch, tmp_path)
     monkeypatch.setenv("VAULT_TOKEN", "caller")
-    # subprocess must never run if the gate blocks first.
+    # The unknown-zone profile proceeds when no evaluator is configured, then
+    # the independent safe-transport boundary still refuses captured stdout.
     monkeypatch.setattr(
         "warden.proxy.subprocess.run",
         lambda *a, **k: (_ for _ in ()).throw(AssertionError("fetch ran despite gate")),
@@ -216,8 +216,8 @@ def test_cli_proxy_refuses_without_policy_ack(monkeypatch, tmp_path):
         ["access", "npm", "--domain", "coulomb_social", "--field", "NPM_AUTH_TOKEN",
          "--path", "platform/x/y/z", "--fetch"],
     )
-    assert r.exit_code == 4
-    assert "not enforced" in r.stdout or "not enforced" in str(r.output)
+    assert r.exit_code == 6
+    assert "unknown-zone fail_open" in r.output
 
 
 def test_cli_proxy_requires_caller_auth(monkeypatch, tmp_path):
@@ -228,11 +228,27 @@ def test_cli_proxy_requires_caller_auth(monkeypatch, tmp_path):
     r = runner.invoke(
         app,
         ["access", "npm", "--domain", "coulomb_social", "--field", "NPM_AUTH_TOKEN",
-         "--path", "platform/x/y/z", "--fetch", "--no-policy"],
+         "--path", "platform/x/y/z", "--fetch"],
     )
     assert r.exit_code == 3
 
 
+def test_cli_proxy_rejects_retired_no_policy_bypass(monkeypatch, tmp_path):
+    _proxy_env(monkeypatch, tmp_path)
+    monkeypatch.setenv("VAULT_TOKEN", "caller")
+    monkeypatch.setattr(
+        "warden.proxy.subprocess.run",
+        lambda *a, **k: (_ for _ in ()).throw(AssertionError("fetch ran despite retired flag")),
+    )
+    r = runner.invoke(
+        app,
+        ["access", "npm", "--domain", "coulomb_social", "--field", "NPM_AUTH_TOKEN",
+         "--path", "platform/x/y/z", "--fetch", "--no-policy"],
+    )
+    assert r.exit_code == 2
+    assert "--no-policy is retired" in r.output
+
+
 # --- T4: login lane --------------------------------------------------------
 
 def test_cli_login_lane_runs_without_token_or_policy_ack(monkeypatch, tmp_path):
@@ -281,6 +297,7 @@ def test_invalid_lane_rejected(tmp_path):
         id="x", title="t", need_keywords=["k"], owner_repo="o", subsystem="s",
         warden_executes=False, wiki_ref="w", canon_ref="c", reviewed="2026-06-27",
         status="active", lane="bogus",
+        workload_ref={"applicability": "not-applicable", "reason": "fixture"},
     )
     p = tmp_path / "c.yaml"
     p.write_text(yaml.dump({"version": 1, "entries": [entry]}))
@@ -361,7 +378,7 @@ def test_access_fetch_to_nonterminal_stdout_is_refused(tmp_path, monkeypatch):
         lambda *a, **k: (_ for _ in ()).throw(AssertionError("fetch ran despite stdout guard")),
     )
     # CliRunner captures stdout (not a tty), so the guard trips without --unsafe-stdout.
-    r = runner.invoke(app, ["access", "whynot-design-npm-publish", "--fetch", "--no-policy"])
+    r = runner.invoke(app, ["access", "whynot-design-npm-publish", "--fetch"])
     assert r.exit_code == 6
     assert "sanctioned transport" in r.output.lower() or "refusing" in r.output.lower()
 
@@ -378,7 +395,7 @@ def test_access_fingerprint_masks_and_bypasses_stdout_guard(monkeypatch, tmp_pat
     monkeypatch.setattr("warden.proxy.subprocess.run", lambda *a, **k: _Fake())
     r = runner.invoke(
         app,
-        ["access", "whynot-design-npm-publish", "--fingerprint", "--no-policy"],
+        ["access", "whynot-design-npm-publish", "--fingerprint"],
     )
     assert r.exit_code == 0
     assert "top-secret-token-value" not in r.output   # value never shown
@@ -395,7 +412,7 @@ def test_access_agent_high_risk_raw_stream_refused(tmp_path, monkeypatch):
         app,
         [
             "access", "railiance-backup-offsite-lane",
-            "--fetch", "--no-policy", "--unsafe-stdout",
+            "--fetch", "--unsafe-stdout",
         ],
     )
     assert r.exit_code == 7, r.output
@@ -415,7 +432,7 @@ def test_access_agent_high_risk_fingerprint_allowed(tmp_path, monkeypatch):
     monkeypatch.setattr("warden.proxy.subprocess.run", lambda *a, **k: _Fake())
     r = runner.invoke(
         app,
-        ["access", "railiance-backup-offsite-lane", "--fingerprint", "--no-policy"],
+        ["access", "railiance-backup-offsite-lane", "--fingerprint"],
     )
     assert r.exit_code == 0, r.output
     assert "should-not-appear" not in r.output