WARDEN-WP-0042: route the OpenBao structure survey to ops-mason

Pointer-only catalog entry openbao-structure-survey (warden_executes: false,
owner ops-mason, ceremony lane, not exec_capable) pointing at ops-mason's
ops-mason-build grant, scripts/plan-survey.py and construction-plan-format
section 2, plus a short pointer playbook. ops-warden holds no survey code
and no token. Routing-lane coverage re-measured: not_applicable 15 -> 16.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1170398@bnt-lap001
Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583

pep-stance.yaml

@@ -94,7 +94,7 @@ on_apply:
 # a register that cannot detect its own staleness is only as good as the last
 # re-measure, and this one was stale by eight lanes before the test caught it.
 classification_coverage:
-  measured: "2026-10-03"
+  measured: "2026-10-05"
   attribution: self-measured
   signing_targets:
     resolved: 0
@@ -103,7 +103,7 @@ classification_coverage:
   routing_lanes:
     resolved: 4
     unknown: 20
-    not_applicable: 15
+    not_applicable: 16
 
 verdict_caching: none
 input_claim_caching: "registry/flex-auth/production_registry_snapshot.json, rebuilt by scripts/build_flex_auth_registry.py"

registry/routing/catalog.yaml

@@ -1385,3 +1385,31 @@ entries:
         - "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists."
         - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
         - "Confirm metadata gone or version bumped; capabilities-safe only."
+
+  - id: openbao-structure-survey
+    title: OpenBao existing-structure survey for a construction plan (section 2)
+    # Pointer only (WARDEN-WP-0042). Founder decision: ops-warden routes,
+    # ops-mason surveys. No survey code and no token live in ops-warden; the
+    # survey runs under ops-mason's own scoped ops-mason-build grant.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Attended builder survey under a founder-minted grant; reads OpenBao structure metadata, not a workload credential."
+    need_keywords: [survey, structure survey, openbao structure, existing structure, existing policies, existing lane, auth roles, approle roles, policy list, auth list, secrets list, construction plan, construction plan section 2, plan-survey, ops-mason-build]
+    owner_repo: ops-mason
+    subsystem: OpenBao structure metadata via ops-mason-build grant
+    warden_executes: false
+    wiki_ref: wiki/playbooks/openbao-structure-survey.md#worker-checklist
+    canon_ref: ops-mason/docs/construction-plan-format.md
+    reviewed: "2026-10-05"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: ops-mason
+      reviewed: "2026-10-05"
+      verified: source-read
+    auth_method: "founder-minted scoped grant: ops-mason scripts/bao-session.sh grant <task> (policy ops-mason-build, 45m, display_name claude-<task>)"
+    exec_owner: ops-mason
+    exec_command: "ops-mason/scripts/plan-survey.py --kv-path <PATH> --policy <POLICY> --approle <ROLE> --consumer <REPO> --keyword <WORD>"
+    exec_capable: false
+    lane: ceremony

tests/test_workload_join.py

@@ -19,8 +19,10 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     # (c374d41) remain provider/control-plane credentials. Lanes added after
     # 2026-09-09 moved the denominator without moving `resolved`; these counts
     # and pep-stance.yaml's classification_coverage measure the same populations
-    # and must be updated together.
-    assert len(report["not_applicable"]) == 15
+    # and must be updated together. 16 since 2026-10-05: the
+    # openbao-structure-survey pointer (WARDEN-WP-0042) is a builder survey
+    # under a founder-minted grant, not a workload credential.
+    assert len(report["not_applicable"]) == 16
     assert {row["lane"] for row in report["resolved"]} == {
         "ops-warden-warden-sign-token",
         "issue-core-ingestion-api-key",

wiki/playbooks/openbao-structure-survey.md

@@ -0,0 +1,24 @@
+# OpenBao existing-structure survey (construction plan section 2)
+
+Catalog: `openbao-structure-survey` (status `active`, pointer only)
+Owner: `ops-mason` — `scripts/plan-survey.py`, `docs/construction-plan-format.md` § 2
+Routing record: `WARDEN-WP-0042`; owner work: `ops-mason/MASON-WP-0008`
+
+ops-warden routes this need and does nothing else. It holds no survey code and
+no OpenBao token; the survey runs under ops-mason's own scoped
+`ops-mason-build` grant, which reads structure metadata and is denied every
+secret value.
+
+## Worker checklist
+
+1. Ask the founder for an ops-mason grant for the task. The founder runs
+   `./scripts/bao-session.sh grant <task>` in `~/ops-mason`; an agent does not
+   log in or grant.
+2. Run `./scripts/plan-survey.py` in `~/ops-mason` with the demand's KV path,
+   proposed policy, role and consumer, exactly as documented in
+   `ops-mason/docs/construction-plan-format.md` § 2.
+3. Paste its output as section 2 of the plan and turn the draft answer into
+   a reviewed one.
+
+Anything the grant refuses is ops-mason's to resolve with the founder; do not
+reach for a broader session through ops-warden.

workplans/WARDEN-WP-0042-openbao-structure-survey-route.md

@@ -0,0 +1,52 @@
+---
+id: WARDEN-WP-0042
+type: workplan
+title: "Route the OpenBao existing-structure survey to ops-mason"
+domain: infotech
+repo: ops-warden
+status: finished
+flavor: implementation
+owner: claude
+topic_slug: netkingdom
+created: "2026-10-05"
+updated: "2026-10-05"
+depends_on: []
+---
+
+ops-mason construction plans need an existing-structure survey (section 2)
+built from live OpenBao metadata. Founder decision: ops-warden routes,
+ops-mason surveys. ops-mason implements `scripts/plan-survey.py` under its
+own `ops-mason-build` grant (`ops-mason/MASON-WP-0008`). ops-warden gets no
+survey code and no token, per the no-double-source rule
+(`WARDEN-WP-0010`, `docs/adr/ADR-0001-catalog-is-a-pointer-layer.md`).
+
+## Add the pointer-only catalog entry
+
+```task
+id: WARDEN-WP-0042-T01
+status: done
+priority: medium
+```
+
+`registry/routing/catalog.yaml` entry `openbao-structure-survey`: owner
+`ops-mason`, `warden_executes: false`, `exec_capable: false`, no `steps`,
+native delegation to ops-mason, lane `ceremony` (the grant is a founder act),
+`risk: high` (the grant can write policies and auth roles), `auth_method`
+naming the ops-mason grant, `exec_owner`/`exec_command` pointing at the
+survey script, `canon_ref` at `ops-mason/docs/construction-plan-format.md`.
+Short pointer playbook `wiki/playbooks/openbao-structure-survey.md`.
+
+## Verify routing offline
+
+```task
+id: WARDEN-WP-0042-T02
+status: done
+priority: medium
+```
+
+`make test` passes, including catalog validation and layer conformance.
+`warden access "openbao structure survey"`, `warden access "construction
+plan section 2"` and `warden route find "existing policies auth roles
+survey"` resolve to the entry; `warden plan` returns `founder_required`
+with the survey command; `warden access ... --exec` refuses (not
+exec_capable).