Grade every catalog lane; record ADR-0007

Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit
risk grade with its justification in the entry: 17 high, 10 standard, 0
ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently
outside it.

Graded on merit rather than defensively. A first pass marked two ordinary
internal workload secrets high; test_high_risk_lanes_classified asserted the
opposite and was right, so both were regraded down. high means disclosure into a
logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh
is high conservatively, with the reason in the entry so it is regraded with
evidence rather than assumed down.

ADR-0007 records the rule the grading rests on: build-stage permissiveness
applies to controls that gate work, not to controls that prevent credential
disclosure. The test is friction, not severity — the read-boundary blocks nobody,
since --out/--exec/--wrap remain available, so relaxing it buys nothing. A
blocked operation is recovered by retrying; a credential in a logged transcript
is not recovered by rotation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

registry/routing/catalog.yaml

@@ -37,6 +37,8 @@ version: 1
 entries:
   - id: ssh-cert-host-access
     title: Short-lived SSH certificate for host / ops reachability
+    # Emits a signed certificate — a public artifact. The private key never leaves the caller (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [ssh, certificate, cert, host, access, sign, adm, agt, atm, reachability, ops]
     owner_repo: ops-warden
     subsystem: ops-warden
@@ -57,6 +59,8 @@ entries:
 
   - id: ops-warden-warden-sign-token
     title: Scoped OpenBao token for ops-warden SSH signing (warden-sign)
+    # A scoped VAULT_TOKEN is a credential in its own right. Graded on what the value is, not on whether ops-warden currently proxies it (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [vault_token, vault, token, warden-sign, warden, ops-warden, signing, sign, smoke, flex-auth, credential, broker, lease, openbao, ssh, production]
     owner_repo: railiance-platform
     subsystem: OpenBao credential broker
@@ -90,6 +94,8 @@ entries:
 
   - id: openbao-api-key
     title: API key, DB credential, or dynamic lease
+    # Wildcard lane over platform/workloads/<domain>/<workload>/<bundle>: its ceiling is the most dangerous bundle it can resolve to (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [api, key, secret, database, db, password, token, lease, openbao, vault, kv, dynamic, credential, npm, npm_auth_token, registry]
     owner_repo: railiance-platform
     subsystem: OpenBao
@@ -123,6 +129,8 @@ entries:
 
   - id: whynot-design-npm-publish
     title: whynot-design npm publish token (@whynot/design → coulomb Gitea registry)
+    # Publish rights to the package registry — a leaked token is a supply-chain write, not a read (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [whynot-design, whynot, npm, publish, npm_auth_token, gitea, registry, coulomb, package]
     owner_repo: railiance-platform
     subsystem: OpenBao
@@ -164,6 +172,8 @@ entries:
 
   - id: flex-auth-policy-check
     title: Authorization decision — may this actor perform this action
+    # Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [authorization, policy, permission, allow, deny, may, flex-auth, topaz, pdp, decision]
     owner_repo: flex-auth
     subsystem: flex-auth
@@ -179,6 +189,8 @@ entries:
 
   - id: key-cape-oidc-login
     title: Interactive login, OIDC token, or MFA
+    # Interactive browser OIDC: a login flow, not a KV read. No stored value is fetched, and warden access already excludes is_login from raw-value streaming (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [login, oidc, identity, mfa, token, jwt, sso, keycloak, key-cape, iam, claims, authenticate, signin]
     owner_repo: key-cape
     subsystem: key-cape / Keycloak
@@ -203,6 +215,8 @@ entries:
 
   - id: ops-bridge-tunnel
     title: SSH tunnel or port forward
+    # Routes to ops-bridge and supplies a cert_command; no secret value flows (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [tunnel, port, forward, bridge, ops-bridge, reverse, transport, ssh-tunnel, cert_command]
     owner_repo: ops-bridge
     subsystem: ops-bridge
@@ -218,6 +232,8 @@ entries:
 
   - id: railiance-infra-principals
     title: Host SSH principal file or force-command deployment
+    # Principal-file deployment via Ansible; no secret value flows (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [principal, auth_principals, force-command, host, sshd, hardening, railiance-infra, ansible]
     owner_repo: railiance-infra
     subsystem: railiance-infra
@@ -233,6 +249,8 @@ entries:
 
   - id: inter-hub-bootstrap-ssh
     title: Inter-Hub bootstrap SSH envelope
+    # Graded high conservatively: ops-warden could not establish from the lane definition that no key material moves in the envelope. Regrade with evidence, do not assume down (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [inter-hub, interhub, bootstrap, ops-hub, agt-interhub-bootstrap, envelope, force-command, CUST-WP-0049]
     owner_repo: ops-warden
     subsystem: ops-warden + railiance-infra
@@ -248,6 +266,8 @@ entries:
 
   - id: activity-core-issue-sink
     title: activity-core IssueSink → issue-core REST emission
+    # Emission routing only — the API key is a separate lane (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [activity-core, issue-sink, issue-core, emission, issue_core_url, issue_core_api_key, tasks, ingest, rest, issuesink]
     owner_repo: activity-core
     subsystem: activity-core + issue-core
@@ -263,6 +283,9 @@ entries:
 
   - id: issue-core-ingestion-api-key
     title: issue-core ingestion API key (OpenBao KV + ESO)
+    # Ordinary internal workload secret: an ingestion key for a first-party
+    # service. Rotatable, no spend, no tenant data, no admin scope (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [issue-core, ingestion, api, key, openbao, issue_core_api_key, eso, external-secrets]
     owner_repo: railiance-platform
     subsystem: OpenBao + issue-core + activity-core
@@ -300,6 +323,9 @@ entries:
 
   - id: reuse-surface-hub-write-token
     title: reuse-surface federation hub write bearer token
+    # Ordinary internal workload secret. Write access to a first-party federation
+    # surface; damaging to forge, but rotatable and internal (WARDEN-WP-0032-T05).
+    risk: standard
     need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, reuse.coulomb.social]
     owner_repo: railiance-platform
     subsystem: OpenBao + reuse-surface
@@ -635,6 +661,8 @@ entries:
 
   - id: object-storage-sts
     title: Object-storage STS / temporary S3 credentials
+    # Temporary S3 credentials are still credentials (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [s3, sts, object-storage, minio, artifact-store, temporary, credentials, bucket, vending]
     owner_repo: net-kingdom
     subsystem: flex-auth + OpenBao + artifact-store
@@ -760,6 +788,8 @@ entries:
 
   - id: audit-core-senders
     title: audit-core sender registry (write and operator-read tokens)
+    # Vends write and operator-read tokens (WARDEN-WP-0032-T05).
+    risk: high
     need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
     owner_repo: ops-mason
     subsystem: OpenBao + audit-core