coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Regenerate the artifact; correct the test that classified openbao-api-key as a gap
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
test_catalog_gaps_lists_only_interim asserted openbao-api-key was an interim
cover. It encoded the same classification the entry did, so it defended the
wrong answer rather than catching it -- the second time this session a test has
held a judgement still (see ADR-0008).

The staleness test added in T03 did its job on the first real change: it failed
the moment the catalog moved without the generated artifact being re-emitted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 09:06:08 +02:00
parent 675e04e8e6
commit a565e62b2f
2 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
registry/generated/high-risk-data-paths.yaml
View file

@ -12,9 +12,9 @@
generated_at: "2026-08-21T07:04:54Z"
source: ops-warden/registry/routing/catalog.yaml
catalog_revision: "c357ce5908e562755f3c41c24074edc9d231e6ce"
catalog_revision_date: "2026-08-21T08:36:42+02:00"
catalog_dirty: true
catalog_revision: "675e04e8e67869f0e47a3ae55ab37b00112582f2"
catalog_revision_date: "2026-08-21T09:04:54+02:00"
catalog_dirty: false
high_risk_lane_count: 19
concrete_path_count: 14

8
tests/test_routing.py
View file

@ -688,7 +688,13 @@ def test_catalog_gaps_lists_only_interim():
assert "ssh-cert-host-access" not in gap_ids
assert "whynot-design-npm-publish" not in gap_ids
assert "binky-company-email-imap" in gap_ids
assert "openbao-api-key" in gap_ids
# WARDEN-WP-0033: openbao-api-key was listed here as an interim cover. It is
# not one -- its path_template is a <domain>/<workload>/<bundle> routing
# pattern rather than a single secret lane, so there is no front door for
# anyone to take over. secrets-engine refused it on exactly that ground and
# ops-warden agrees. A pointer to OpenBao is not a gap ops-warden is holding,
# and counting it as one overstated the interim surface by a lane.
assert "openbao-api-key" not in gap_ids
assert all(catalog.get(i).is_interim for i in gap_ids)