feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

wiki/playbooks/agent-read-boundary.md

@@ -62,9 +62,9 @@ When `WARDEN_AGENT_ID` is set and the lane is `risk: high`, `warden access --fet
 
 ```bash
 export WARDEN_AGENT_ID=grok   # or claude, codex
-warden access railiance-backup-offsite-lane --no-policy --out /tmp/nc.token
-warden access railiance-backup-offsite-lane --no-policy --wrap
-warden access railiance-backup-offsite-lane --no-policy --fingerprint
+warden access railiance-backup-offsite-lane --out /tmp/nc.token
+warden access railiance-backup-offsite-lane --wrap
+warden access railiance-backup-offsite-lane --fingerprint
 ```
 
 `warden route show <id> --json` includes `"risk"` and `"high_risk"`.

wiki/playbooks/binky-company-email-imap.md

@@ -47,10 +47,10 @@ Config (host/port/env names only):
 2. Fetch via sanctioned transport (never paste into chat):
 
    ```bash
-   warden access binky-company-email-imap --all --no-policy --out /tmp/imap.user
+   warden access binky-company-email-imap --all --out /tmp/imap.user
    # primary field is IMAP_USERNAME; for password use --field after template support
    # or:
-   warden access binky-company-email-imap --all --no-policy --exec -- \
+   warden access binky-company-email-imap --all --exec -- \
      env IMAP_USERNAME=…  # prefer secrets-engine / dual-field exec when wired
    ```
 

wiki/playbooks/binky-qonto-api.md

@@ -53,7 +53,7 @@ Design: `binky-control/integrations/qonto-mcp.md`
 
    ```bash
    # lengths / presence only when debugging
-   warden access binky-qonto-api --all --no-policy --exec -- \
+   warden access binky-qonto-api --all --exec -- \
      sh -c 'export QONTO_API_KEY="$API_KEY" QONTO_ORGANIZATION_ID="$API_USER";
             # then: qonto-mcp-server or curl thirdparty with Authorization login:key
             :'

wiki/playbooks/ops-bridge-tunnel-cert.md

@@ -122,10 +122,11 @@ bridge up state-hub-railiance01
 - [ ] Tunnel establishes without static cert file on disk
 - [ ] Re-run `bridge up` after cert TTL expires — `cert_command` re-issues automatically
 
-### 5. Policy gate (optional, after FLEX-WP-0007)
+### 5. Zone-aware policy evidence
 
-When `policy.enabled: true`, confirm `signatures.log` includes `policy_decision_id`
-on tunnel-driven signs. See `wiki/PolicyGatedSigning.md`.
+Confirm `signatures.log` records `policy_zone`, `policy_failure_mode`,
+`policy_outcome`, and `policy_decision_id` when flex-auth returns a decision on
+tunnel-driven signs. See `wiki/PolicyGatedSigning.md`.
 
 ---
 
@@ -177,4 +178,4 @@ starting cutover (WARDEN-WP-0023).
 - `wiki/OpsWardenConfig.md` — cert_command example
 - `wiki/playbooks/operator-openbao-token-hygiene.md`
 - `wiki/AuditTrail.md` — query recent signs via `warden activity`
-- `warden route show ops-bridge-tunnel --json`
+- `warden route show ops-bridge-tunnel --json`

wiki/playbooks/railiance-backup-offsite-lane.md

@@ -35,9 +35,9 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
 
    ```bash
    # Preferred: file or exec injection via warden
-   warden access railiance-backup-offsite-lane --no-policy --out /tmp/nc.token
+   warden access railiance-backup-offsite-lane --out /tmp/nc.token
    # or:
-   warden access railiance-backup-offsite-lane --no-policy --exec -- env | grep -v .
+   warden access railiance-backup-offsite-lane --exec -- env | grep -v .
    ```
 
    If you must use raw bao in an interactive human shell (not an agent session):
@@ -54,7 +54,7 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
 3. **Proxy via warden access** (catalog active + resolvable):
 
    ```bash
-   warden access railiance-backup-offsite-lane --no-policy --fetch --out /tmp/nc.token
+   warden access railiance-backup-offsite-lane --fetch --out /tmp/nc.token
    # Primary field is NC_WEBDAV_TOKEN. AGE_PRIVATE_KEY is recovery escrow only.
    ```
 

wiki/playbooks/reuse-surface-hub-write-token.md

@@ -61,7 +61,7 @@ Never paste values into chat, State Hub, workplans, or Git.
 3. **Or proxy via warden access** (same `bao kv get`, audited metadata only):
    ```bash
    warden route show reuse-surface-hub-write-token --json
-   warden access reuse-surface-hub-write-token --no-policy --fetch
+   warden access reuse-surface-hub-write-token --fetch
    ```
 
 4. **Webhook HMAC** (same path, second field — must match Forgejo org webhook):
@@ -87,4 +87,4 @@ Never paste values into chat, State Hub, workplans, or Git.
 Rotation: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md`
 (OpenBao patch → ESO `force-sync` → hub rollout → `make reuse-forgejo-webhook` when
 the webhook HMAC changes → `make reuse-webhook-smoke`). Lifecycle:
-`railiance-platform/docs/credential-lane-lifecycle-runbook.md` (CCR-2026-0005).
+`railiance-platform/docs/credential-lane-lifecycle-runbook.md` (CCR-2026-0005).

wiki/playbooks/tenant-secret-onboarding.md

@@ -69,7 +69,7 @@ First worked lane: `tenants/binky/company-email/imap` (CCR-2026-0007).
 
 ```bash
 bao login -method=oidc -path=netkingdom role=<lane>-workload-kv-read
-warden access <catalog-id> --no-policy --out /tmp/secret.file   # mode 0600
+warden access <catalog-id> --out /tmp/secret.file   # mode 0600
 # agents: never raw --fetch stream; WARDEN_AGENT_ID + risk=high → exit 7
 ```
 

wiki/playbooks/whynot-design-npm-publish.md

@@ -48,11 +48,10 @@ this token** — it is the access front door: `warden access` proxies the read f
    **ops-warden transparent fallback** — same lane via the `warden access` proxy (fetches as
    you, holds nothing). Field-verified flags (whynot-design, @whynot/design@0.4.0):
    ```bash
-   # --exec needs the env-var name; --no-policy is required while the gate is advisory
-   # (policy.enabled=false), else the call exits 4.
-   warden access whynot-design-npm-publish --no-policy --field NPM_AUTH_TOKEN \
+   # --exec needs the env-var name. The zone-aware policy gate always runs first.
+   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN \
      --exec -- npm publish
-   warden access whynot-design-npm-publish --no-policy --field NPM_AUTH_TOKEN --fetch
+   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN --fetch
    ```
    On either path the value transits to you (or the child env) and never enters
    ops-warden's memory, disk, or audit log.