WARDEN-WP-0026 finish Strand A (T04/T05/T07)

Promote railiance-backup-offsite-lane to active/resolvable after
capabilities-safe re-verify. Add catalog risk=high, agent read-boundary
(exit 7 + OpenBao policy companion), EXPOSED taint via warden taint, and
close WP-0026.

wiki/playbooks/railiance-backup-offsite-lane.md

@@ -1,7 +1,7 @@
 # Railiance Offsite Backup Lane
 
-Date: 2026-07-07  
-Catalog: `railiance-backup-offsite-lane` (status `draft`, `resolvable: false` until verified)  
+Date: 2026-07-16  
+Catalog: `railiance-backup-offsite-lane` (status `active`, `resolvable: true`, `risk: high`)  
 Owner: `railiance-platform` (CCR-2026-0004)
 
 Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A).
@@ -15,9 +15,11 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
 | --- | --- |
 | Mount | `platform` |
 | Path | `platform/workloads/railiance/backup/offsite-lane` |
-| Fields | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` |
-| Policy | `workload-kv-read-railiance-backup-offsite-lane` |
+| Fields | `NC_WEBDAV_TOKEN` (primary fetch), `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` (recovery escrow) |
+| Policy | `workload-kv-read-railiance-backup-offsite-lane` (operator OIDC) |
+| Agent policy | `agent-high-risk-boundary` — **deny** data-read; metadata only |
 | OIDC role | `railiance-backup-workload-kv-read` (`groups=net-kingdom-admins`) |
+| Risk | `high` (upload token + age recovery escrow) |
 
 ---
 
@@ -29,7 +31,16 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
    bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
    ```
 
-2. **Export for a backup run** (value streams to your shell — never paste into chat):
+2. **Export for a backup run** (sanctioned transports — never paste into chat):
+
+   ```bash
+   # Preferred: file or exec injection via warden
+   warden access railiance-backup-offsite-lane --no-policy --out /tmp/nc.token
+   # or:
+   warden access railiance-backup-offsite-lane --no-policy --exec -- env | grep -v .
+   ```
+
+   If you must use raw bao in an interactive human shell (not an agent session):
 
    ```bash
    export RAILIANCE_BACKUP_NC_TOKEN=$(
@@ -40,10 +51,11 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
    )
    ```
 
-3. **Or proxy via warden access** (after catalog promotion):
+3. **Proxy via warden access** (catalog active + resolvable):
 
    ```bash
-   warden access railiance-backup-offsite-lane --no-policy --fetch --field NC_WEBDAV_TOKEN
+   warden access railiance-backup-offsite-lane --no-policy --fetch --out /tmp/nc.token
+   # Primary field is NC_WEBDAV_TOKEN. AGE_PRIVATE_KEY is recovery escrow only.
    ```
 
 4. **Run backup**:
@@ -57,6 +69,8 @@ Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
    ```
 
 `AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills.
+**Agents** (`WARDEN_AGENT_ID` set) cannot stream raw high-risk values; use `--out` /
+`--exec` / `--wrap`. See `wiki/playbooks/agent-read-boundary.md`.
 
 ---
 
@@ -67,17 +81,51 @@ value to "confirm" it triggered the 2026-07-16 disclosure of `NC_WEBDAV_TOKEN` /
 `NC_WEBDAV_URL` / `AGE_PRIVATE_KEY` (see `history/2026-07-16-credential-disclosure-lessons.md`).
 
 ```bash
-# Positive: lane OIDC identity can read the data path
-bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
-bao token capabilities "$(bao print token)" platform/data/workloads/railiance/backup/offsite-lane
+# Positive: lane policy identity can read the data path
+LANE=$(bao token create -policy=workload-kv-read-railiance-backup-offsite-lane -ttl=2m -field=token)
+bao token capabilities "$LANE" platform/data/workloads/railiance/backup/offsite-lane
 #   → expect: read
+bao token revoke "$LANE"
 
 # Negative: default-only identity is denied (no value is read)
 DEFAULT_TOKEN=$(bao token create -policy=default -field=token)   # if this is denied, that IS the pass — do NOT fall back
 bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/railiance/backup/offsite-lane
 #   → expect: deny
+bao token revoke "$DEFAULT_TOKEN"
+
+# Agent boundary: data deny, metadata allow
+AGENT=$(bao token create -policy=agent-high-risk-boundary -ttl=2m -field=token)
+bao token capabilities "$AGENT" platform/data/workloads/railiance/backup/offsite-lane   # deny
+bao token capabilities "$AGENT" platform/metadata/workloads/railiance/backup/offsite-lane # read
+bao token revoke "$AGENT"
 ```
 
 The capability lists contain no secret material — safe to record on
 `CCR-2026-0004` as promotion evidence. Full pattern:
-`wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification`.
+`wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification`.
+
+### Evidence recorded 2026-07-16 (WP-0026 T07)
+
+| Check | Result |
+| --- | --- |
+| Policy `workload-kv-read-railiance-backup-offsite-lane` present | pass |
+| OIDC role `railiance-backup-workload-kv-read` bound to `net-kingdom-admins` + lane policy | pass |
+| Lane-policy token capabilities on data path | `read` |
+| Default-policy token capabilities on data path | `deny` |
+| Agent-boundary token on data / metadata | `deny` / `read` |
+| Field presence (keys only, lengths; no values) | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` present |
+| EXPOSED taint on version 2 | set (see `warden taint railiance-backup-offsite-lane`) |
+| Rotation guidance | `warden rotate-guide railiance-backup-offsite-lane` |
+
+---
+
+## Taint / rotation
+
+```bash
+warden taint railiance-backup-offsite-lane
+warden rotate-guide railiance-backup-offsite-lane
+```
+
+Rotation of exposed values is the **operator's optional call** (buildup mode);
+promotion is not blocked on rotation. After rotation, clear `exposed_*`
+custom_metadata keys (`wiki/playbooks/exposed-taint.md`).