WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

wiki/playbooks/agent-read-boundary.md

@@ -0,0 +1,77 @@
+# Agent read-boundary on high-risk lanes
+
+Date: 2026-07-16  
+Workplan: WARDEN-WP-0026 T04  
+OpenBao policy: `railiance-platform/openbao/policies/agent-high-risk-boundary.hcl`
+
+Coding agents must not hold **raw data-read** on high-risk secrets. They may
+inspect **capabilities** and **metadata**, and may receive values only through
+sanctioned transports (file / exec env / response-wrapping token) under a human
+operator identity.
+
+---
+
+## Risk classification (catalog `risk:`)
+
+| Class | Criteria | Catalog default |
+| --- | --- | --- |
+| `high` | Recovery escrow (e.g. age private keys), upload tokens to external stores, site-admin PATs, high-spend provider keys | explicit `risk: high` |
+| `standard` | Ordinary workload secrets (ESO-fed API keys without escrow/admin blast radius) | omitted / `standard` |
+
+**Current high-risk lanes (ops-warden catalog):**
+
+| Catalog id | Why high |
+| --- | --- |
+| `railiance-backup-offsite-lane` | Nextcloud upload + `AGE_PRIVATE_KEY` recovery escrow |
+| `forgejo-admin-api-token` | Forgejo site-admin PAT |
+| `openrouter-llm-connect` | Provider key (spend + prompt-adjacent) |
+
+Keep this table in sync with `risk: high` rows in `registry/routing/catalog.yaml`
+and path denials in `agent-high-risk-boundary.hcl`.
+
+---
+
+## OpenBao side
+
+1. **Operator OIDC roles** keep `workload-kv-read-*` for the lane (data `read`).
+2. **Agent identities** attach `agent-high-risk-boundary` (or equivalent) and
+   **must not** also attach the lane's `workload-kv-read-*` policy.
+3. Verify with capabilities only (never `kv get` for deny tests):
+
+```bash
+# Agent-shaped token
+AGENT=$(bao token create -policy=agent-high-risk-boundary -ttl=5m -field=token)
+bao token capabilities "$AGENT" platform/data/workloads/railiance/backup/offsite-lane
+# → deny
+bao token capabilities "$AGENT" platform/metadata/workloads/railiance/backup/offsite-lane
+# → read
+bao token revoke "$AGENT"
+```
+
+Wrapped/proxied access for agents: a human operator (or credential broker with
+response-wrap) fetches under an operator identity and delivers via
+`warden access … --wrap` / `--out` / `--exec`. Agents do not unwrap into chat.
+
+---
+
+## ops-warden side
+
+When `WARDEN_AGENT_ID` is set and the lane is `risk: high`, `warden access --fetch`
+**refuses raw value streaming** (exit 7). Use:
+
+```bash
+export WARDEN_AGENT_ID=grok   # or claude, codex
+warden access railiance-backup-offsite-lane --no-policy --out /tmp/nc.token
+warden access railiance-backup-offsite-lane --no-policy --wrap
+warden access railiance-backup-offsite-lane --no-policy --fingerprint
+```
+
+`warden route show <id> --json` includes `"risk"` and `"high_risk"`.
+
+---
+
+## See also
+
+- `.claude/rules/credential-routing.md` — safe transports
+- `wiki/playbooks/exposed-taint.md` — EXPOSED metadata convention
+- `history/2026-07-16-credential-disclosure-lessons.md`