From a565e62b2f20f5c44488367dbadff1a3d1460dcb Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 09:06:08 +0200 Subject: [PATCH] Regenerate the artifact; correct the test that classified openbao-api-key as a gap test_catalog_gaps_lists_only_interim asserted openbao-api-key was an interim cover. It encoded the same classification the entry did, so it defended the wrong answer rather than catching it -- the second time this session a test has held a judgement still (see ADR-0008). The staleness test added in T03 did its job on the first real change: it failed the moment the catalog moved without the generated artifact being re-emitted. Co-Authored-By: Claude Opus 5 --- registry/generated/high-risk-data-paths.yaml | 6 +++--- tests/test_routing.py | 8 +++++++- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index 863803f..092f6a6 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -12,9 +12,9 @@ generated_at: "2026-08-21T07:04:54Z" source: ops-warden/registry/routing/catalog.yaml -catalog_revision: "c357ce5908e562755f3c41c24074edc9d231e6ce" -catalog_revision_date: "2026-08-21T08:36:42+02:00" -catalog_dirty: true +catalog_revision: "675e04e8e67869f0e47a3ae55ab37b00112582f2" +catalog_revision_date: "2026-08-21T09:04:54+02:00" +catalog_dirty: false high_risk_lane_count: 19 concrete_path_count: 14 diff --git a/tests/test_routing.py b/tests/test_routing.py index fe28958..7892a89 100644 --- a/tests/test_routing.py +++ b/tests/test_routing.py @@ -688,7 +688,13 @@ def test_catalog_gaps_lists_only_interim(): assert "ssh-cert-host-access" not in gap_ids assert "whynot-design-npm-publish" not in gap_ids assert "binky-company-email-imap" in gap_ids - assert "openbao-api-key" in gap_ids + # WARDEN-WP-0033: openbao-api-key was listed here as an interim cover. It is + # not one -- its path_template is a // routing + # pattern rather than a single secret lane, so there is no front door for + # anyone to take over. secrets-engine refused it on exactly that ground and + # ops-warden agrees. A pointer to OpenBao is not a gap ops-warden is holding, + # and counting it as one overstated the interim surface by a lane. + assert "openbao-api-key" not in gap_ids assert all(catalog.get(i).is_interim for i in gap_ids)