WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

src/warden/cli.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import os
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Annotated, List, Optional
@@ -630,6 +631,9 @@ def _entry_summary(entry) -> dict:
         "canon_ref": entry.canon_ref,
         "reviewed": entry.reviewed,
         "status": entry.status,
+        # Agent read-boundary (WP-0026 T04) — high-risk lanes deny raw agent data reads.
+        "risk": entry.risk,
+        "high_risk": entry.is_high_risk,
         # Renewal guidance (WP-0026 T06) — advisory, no secret values. `has_rotation`
         # lets a caller gate before asking for the full block via `warden rotate-guide`.
         "has_rotation": entry.has_rotation,
@@ -803,6 +807,63 @@ def route_show(
         )
 
 
+@app.command("taint")
+def taint_show(
+    entry_id: Annotated[str, typer.Argument(help="Catalog entry id (see `warden route list`)")],
+    output_json: Annotated[bool, typer.Option("--json", help="Output JSON")] = False,
+) -> None:
+    """Report whether a lane's OpenBao secret is marked EXPOSED (WP-0026 T05).
+
+    Reads KV v2 *metadata only* (custom_metadata: exposed_at, exposed_version, …).
+    Never reads secret data. Advisory — does not rotate or clear taint.
+    """
+    from warden.taint import TaintError, fetch_taint_status
+
+    catalog = _load_catalog()
+    entry = catalog.get(entry_id)
+    if entry is None:
+        # Drafts are findable by exact id via get even when not listed.
+        err.print(
+            f"[red]Unknown routing id {entry_id!r}.[/red] Try: warden route find {entry_id!r} --all"
+        )
+        raise typer.Exit(1)
+
+    try:
+        status = fetch_taint_status(entry)
+    except TaintError as e:
+        err.print(f"[red]taint status unavailable:[/red] {e}")
+        raise typer.Exit(2)
+
+    if output_json:
+        print(json.dumps(status.to_dict(), indent=2))
+        return
+
+    console.print(f"[bold]Taint status — {entry.title}[/bold]  ([cyan]{entry.id}[/cyan])")
+    console.print(f"  path            : {status.path}")
+    if status.error:
+        console.print(f"  [yellow]query error[/yellow] : {status.error}")
+        console.print(
+            "  [dim]Need caller OpenBao auth with metadata-read on the path "
+            "(agent-high-risk-boundary allows metadata; workload-kv-read allows both).[/dim]"
+        )
+        raise typer.Exit(3)
+    if status.tainted:
+        console.print("  tainted         : [red]yes (EXPOSED)[/red]")
+        console.print(f"  exposed_at      : {status.exposed_at}")
+        console.print(f"  exposed_version : {status.exposed_version}")
+        console.print(f"  exposed_reason  : {status.exposed_reason}")
+        console.print(f"  exposed_ref     : {status.exposed_ref}")
+        console.print(f"  current_version : {status.current_version}")
+        console.print(
+            "\n[yellow]Advisory:[/yellow] rotate/re-establish per "
+            f"`warden rotate-guide {entry.id}` then clear custom_metadata keys "
+            "(exposed_at, exposed_version, …). No auto-rotation (Strand B)."
+        )
+    else:
+        console.print("  tainted         : [green]no[/green]")
+        console.print(f"  current_version : {status.current_version}")
+
+
 @app.command("rotate-guide")
 def rotate_guide(
     entry_id: Annotated[str, typer.Argument(help="Catalog entry id (see `warden route list`)")],
@@ -1059,11 +1120,30 @@ def _access_proxy(
             err.print(f"[red]{e}[/red]")
             raise typer.Exit(2)
 
+    # T04 — agent identity on a high-risk lane: never stream raw secret data.
+    # Agents may use sanctioned transports (--out / --exec / --wrap / --fingerprint).
+    agent_id = os.environ.get("WARDEN_AGENT_ID", "").strip()
+    raw_value_stream = (
+        not is_login and not do_exec and not wrap and not out_path and not fingerprint
+    )
+    if raw_value_stream and entry.is_high_risk and agent_id:
+        err.print(
+            f"[red]Agent read-boundary:[/red] {entry.id!r} is risk=high; "
+            f"agent identity {agent_id!r} must not stream raw secret data.\n"
+            "Use a sanctioned transport (value stays off the session transcript):\n"
+            "  --out FILE     write to a mode-0600 file\n"
+            "  --exec -- CMD  inject into a child process env only\n"
+            "  --wrap         single-use OpenBao wrapping token (unwrap out-of-band)\n"
+            "  --fingerprint  masked presence/length/hash only\n"
+            "OpenBao policy `agent-high-risk-boundary` also denies data-read for agents."
+        )
+        raise typer.Exit(7)
+
     # T02 — the sanctioned fetch transports (file / env / wrapping token) never put a
     # secret value on stdout. Streaming a value to stdout is the documented anti-pattern:
     # allowed only to an interactive terminal, and only with an explicit acknowledgment
     # when stdout is captured/piped (the logged-context disclosure risk).
-    if not is_login and not do_exec and not wrap and not out_path and not fingerprint:
+    if raw_value_stream:
         import sys as _sys
 
         if not _sys.stdout.isatty() and not unsafe_stdout: