feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tests/test_routing.py

@@ -4,6 +4,7 @@ No test here requires a live subsystem — routing is a read-only pointer layer.
 """
 import json
 import re
+from datetime import date
 from pathlib import Path
 
 import pytest
@@ -11,10 +12,9 @@ import yaml
 from typer.testing import CliRunner
 
 from warden.cli import app
-from datetime import date
-
 from warden.routing import CatalogError, load_catalog
 from warden.routing.catalog import days_since_review, find_catalog_path, is_review_stale
+from warden.scorecard import check_catalog_rotation_coverage
 
 runner = CliRunner()
 
@@ -40,6 +40,10 @@ SSH_ENTRY = {
     "canon_ref": "net-kingdom/docs/x.md",
     "reviewed": "2026-06-18",
     "status": "active",
+    "workload_ref": {
+        "applicability": "not-applicable",
+        "reason": "generic certificate action",
+    },
     "cert_command": "warden sign <actor> --pubkey <path>",
     "steps": ["confirm inventory", "sign"],
 }
@@ -55,6 +59,10 @@ ROUTED_ENTRY = {
     "canon_ref": "net-kingdom/docs/x.md",
     "reviewed": "2026-06-18",
     "status": "active",
+    "workload_ref": {
+        "applicability": "not-applicable",
+        "reason": "generic credential pattern",
+    },
 }
 
 
@@ -76,6 +84,45 @@ def test_real_catalog_has_one_executed_lane():
     assert [e.id for e in executed] == ["ssh-cert-host-access"]
 
 
+def test_every_catalog_lane_declares_workload_applicability():
+    catalog = load_catalog(_repo_catalog())
+    assert all(entry.workload_ref is not None for entry in catalog.entries)
+    assert {entry.workload_ref.resolution for entry in catalog.entries} == {
+        "resolved", "unknown", "not-applicable"
+    }
+
+
+def test_managed_and_operational_workload_references_parse():
+    catalog = load_catalog(_repo_catalog())
+    managed = catalog.get("issue-core-ingestion-api-key").workload_ref
+    assert managed.resolution == "resolved"
+    assert (managed.rapp_id, managed.name, managed.deployable) == (
+        "rapp-issue-core", "issue-core", "issue-core"
+    )
+    operational = catalog.get("ops-warden-warden-sign-token").workload_ref
+    assert operational.resolution == "resolved"
+    assert operational.rapp_id is None
+    assert operational.name == "ops-warden"
+    assert operational.declaration_ref == "tenancy.yaml"
+
+
+def test_workload_reference_rejects_ambiguous_absence(tmp_path):
+    bad = dict(ROUTED_ENTRY)
+    bad.pop("workload_ref")
+    with pytest.raises(CatalogError, match="workload_ref"):
+        load_catalog(_write_catalog(tmp_path, [bad]))
+
+
+def test_workload_reference_rejects_malformed_managed_target(tmp_path):
+    bad = dict(ROUTED_ENTRY)
+    bad["workload_ref"] = {
+        "applicability": "applicable",
+        "rapp_id": "rapp-issue-core",
+    }
+    with pytest.raises(CatalogError, match="requires name"):
+        load_catalog(_write_catalog(tmp_path, [bad]))
+
+
 def test_ops_warden_warden_sign_lane_has_native_exec():
     """RAILIANCE-WP-0005 T08 — broker lane routes to railiance-platform credential exec."""
     catalog = load_catalog(_repo_catalog())
@@ -454,9 +501,6 @@ def test_every_entry_has_reviewed_date():
 # Rotation / re-establishment guidance registry (WARDEN-WP-0026 T06)
 # ---------------------------------------------------------------------------
 
-from warden.scorecard import check_catalog_rotation_coverage
-
-
 def test_every_active_vending_lane_has_rotation_guidance():
     """Coverage gate: an active lane that vends a secret must say how to renew it."""
     catalog = load_catalog(_repo_catalog())
@@ -774,6 +818,32 @@ def test_unrecognised_grade_is_treated_as_high():
     assert entry.is_graded is False
 
 
+def test_ungraded_risk_uses_maturity_derived_zone_default():
+    entry = _bare_entry()
+    assert entry.risk_for_zone(
+        effective_zone="z0-experimental",
+        admission="satisfied",
+        synthetic_only=True,
+    ) == "standard"
+    assert entry.risk_for_zone(
+        effective_zone="z0-experimental",
+        admission="unknown",
+        synthetic_only=True,
+    ) == "high"
+    assert entry.risk_for_zone(
+        effective_zone="z3-critical",
+        admission="satisfied",
+    ) == "critical"
+    assert entry.risk_for_zone(effective_zone="unknown") == "high"
+
+
+def test_explicit_risk_grade_always_wins_over_zone_default():
+    entry = _bare_entry(risk="standard")
+    assert entry.risk_for_zone(
+        effective_zone="z3-critical", admission="satisfied"
+    ) == "standard"
+
+
 def test_low_risk_vocabulary_is_explicit():
     for grade in ("standard", "low", "accepted"):
         entry = _bare_entry(risk=grade)
@@ -870,6 +940,11 @@ def test_cli_route_gaps_fail_on_stale_exits_3(repo_catalog_env):
     assert result.exit_code == 3
     rows = json.loads(result.stdout)
     assert any(r["stale"] for r in rows)
-    # A lane can be stale on age or on never having been verified; both must be
-    # expressible, or asked-and-waiting silently passes the gate.
-    assert any(r["stale"] and r["days_since_review"] == 0 for r in rows)
+    # A freshly reviewed lane can still be stale because it was never verified;
+    # asked-and-waiting must not silently pass the gate as the calendar moves.
+    assert any(
+        r["stale"]
+        and r["days_since_review"] <= 1
+        and r["verified"] == "asked-and-waiting"
+        for r in rows
+    )