WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

registry/routing/catalog.yaml

@@ -290,6 +290,8 @@ entries:
     canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
     reviewed: "2026-07-02"
     status: active
+    # High-risk: provider API key with spend impact + prompt-adjacent (WP-0026 T04).
+    risk: high
     # Concrete, owner-confirmed lane — railiance-platform CCR-2026-0003 / RAILIANCE-WP-0010
     # (promoted 2026-07-02): policy workload-kv-read-llm-connect-provider-secrets and k8s
     # auth role external-secrets-activity-core applied; ExternalSecret
@@ -321,13 +323,20 @@ entries:
     warden_executes: false
     wiki_ref: wiki/playbooks/railiance-backup-offsite-lane.md#worker-checklist
     canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
-    reviewed: "2026-07-07"
-    status: draft
+    reviewed: "2026-07-16"
+    status: active
+    # High-risk: WebDAV upload token + AGE recovery escrow (WP-0026 T04).
+    risk: high
     # CCR-2026-0004: policy + OIDC role applied; values provisioned 2026-07-07.
-    # Promote to active after positive/negative caller verification.
+    # Capabilities-safe re-verify 2026-07-16 (WP-0026 T07): lane-policy token
+    # capabilities=read on data path; default-policy and agent-high-risk-boundary = deny;
+    # field keys present (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY) via metadata
+    # lengths only — no value read. Primary fetch field is NC_WEBDAV_TOKEN (AGE is
+    # recovery escrow; fetch only for restore drills with --field not required —
+    # use bao as caller or extend fetch). EXPOSED taint set on version 2 (T05).
     auth_method: "caller's own OpenBao token (OIDC netkingdom role railiance-backup-workload-kv-read)"
     path_template: "platform/workloads/railiance/backup/offsite-lane"
-    fetch_command: "bao kv get -field=<FIELD> platform/workloads/railiance/backup/offsite-lane"
+    fetch_command: "bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane"
     exec_capable: true
     lane: secret
     # Mixed lane: NC_WEBDAV_TOKEN rotates (provider re-mint); AGE_PRIVATE_KEY
@@ -344,6 +353,7 @@ entries:
         - "Re-establish AGE_PRIVATE_KEY: generate a new keypair (`age-keygen`), decrypt existing offsite artifacts with the old key and re-encrypt to the new recipient, then `bao kv put ... AGE_PRIVATE_KEY=@file` (mode-0600 file, shred after)."
         - "Because AGE_PRIVATE_KEY is recovery escrow, retain the old key offline until re-encryption of all retained backups is confirmed."
         - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact."
+        - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)."
 
   - id: forgejo-admin-api-token
     title: Forgejo operator/admin API token (PAT)
@@ -355,7 +365,8 @@ entries:
     canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
     reviewed: "2026-07-13"
     status: active
-    resolvable: true
+    # High-risk: site-admin PAT (WP-0026 T04).
+    risk: high
     # CCR-2026-0006: approved by platform-operator 2026-07-12; policy
     # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on
     # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at