WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

src/warden/routing/catalog.py

@@ -22,7 +22,7 @@ from typing import List, Optional
 
 import yaml
 
-from warden.routing.models import RotationGuide, RouteEntry
+from warden.routing.models import VALID_RISK, RotationGuide, RouteEntry
 
 # Structured handoff string fields (WP-0014) — templates and pointers only.
 # Every one is scanned for accidental secret material; see _assert_no_secret_material.
@@ -303,6 +303,12 @@ def _parse_entry(raw: dict, index: int) -> RouteEntry:
             f"entry {entry_id!r} has invalid lane {lane!r} (expected one of {_VALID_LANES})"
         )
 
+    risk = str(raw.get("risk", "standard")).strip() or "standard"
+    if risk not in VALID_RISK:
+        raise CatalogError(
+            f"entry {entry_id!r} has invalid risk {risk!r} (expected one of {VALID_RISK})"
+        )
+
     return RouteEntry(
         id=entry_id,
         title=str(raw["title"]),
@@ -326,6 +332,7 @@ def _parse_entry(raw: dict, index: int) -> RouteEntry:
         exec_command=handoff["exec_command"],
         pointer_command=handoff["pointer_command"],
         rotation=_parse_rotation(entry_id, raw.get("rotation")),
+        risk=risk,
     )
 
 

src/warden/routing/models.py

@@ -28,6 +28,13 @@ class RotationGuide:
     automatable: bool = False
 
 
+# Risk classes for agent read-boundary (WARDEN-WP-0026 T04).
+# high  — recovery escrow, upload tokens, admin PATs, high-spend provider keys.
+#         Agent identities must not hold raw data-read (metadata/capabilities only).
+# standard — ordinary workload secrets (ESO-fed, non-escrow); normal least-privilege.
+VALID_RISK = ("standard", "high")
+
+
 @dataclass
 class RouteEntry:
     id: str
@@ -69,11 +76,18 @@ class RouteEntry:
     pointer_command: Optional[str] = None    # e.g. "secrets-engine route <id> --json"
     # Rotation / re-establishment guidance (WP-0026 T06) — advisory, no secret values.
     rotation: Optional[RotationGuide] = None
+    # Agent read-boundary risk class (WP-0026 T04). high → agents use wrap/out/exec only.
+    risk: str = "standard"  # "standard" | "high"
 
     @property
     def is_active(self) -> bool:
         return self.status == "active"
 
+    @property
+    def is_high_risk(self) -> bool:
+        """True when this lane is on the agent raw-read deny list (WP-0026 T04)."""
+        return self.risk == "high"
+
     @property
     def has_rotation(self) -> bool:
         """True when this lane carries renewal guidance (WP-0026 T06)."""