WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008

secrets-engine reviewed our catalog metadata while drafting their five entries
and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high.
We had both as standard, and had deliberately regraded them DOWN on 2026-08-19.

They are right. Both paths carry a second credential our grade never looked at --
GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a
dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the
credential the lane is named after.

The defect is structural: we graded the lane by its headline field, but a read
returns every field at the path. Worse, the evidence was already in the CCRs we
cite as authoritative -- not missing, unread -- and a test asserted the wrong
answer, so a correct first-pass grade got overruled by it.

ADR-0008 records the rule: a grade covers every field its path discloses.
ADR-0007 is unchanged and still governs; this says what the grade is of.

Six of the remaining standard lanes have no KV path. Two have paths and no field
evidence; per ADR-0008 they are stated as unknown rather than assumed, and left
for operator-sanctioned grading.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/adr/ADR-0008-grade-the-path-not-the-field.md

@@ -0,0 +1,94 @@
+---
+id: ops-warden-adr-0008
+type: adr
+title: "ADR-0008 — A lane's risk grade covers every field its path discloses"
+domain: infotech
+repo: ops-warden
+status: accepted
+version: "1.0"
+revision: "1"
+owner: ops-warden
+binds: "ops-warden"
+created: "2026-08-21"
+updated: "2026-08-21"
+last_reviewed: "2026-08-21"
+review_interval: 6m
+enforced_by: "registry/routing/catalog.yaml fields + risk; tests/test_routing.py::test_high_risk_lanes_classified"
+supersedes: ""
+successor: ""
+---
+
+# ADR-0008 — A lane's risk grade covers every field its path discloses
+
+## Status
+
+Accepted 2026-08-21, after `secrets-engine` found two under-graded lanes while
+reviewing ops-warden's own catalog metadata.
+
+## Context
+
+`ADR-0007` requires every catalog lane to carry an explicit `risk` grade. It does
+not say what the grade is *of*, and the omission turned out to matter.
+
+The catalog describes a lane by a single `fetch_command` naming a single field —
+`bao kv get -field=ISSUE_CORE_API_KEY <path>`. Grading followed that description.
+But the unit of disclosure is not the field, it is the **path**: `bao kv get`
+without `-field` returns every key stored there, and an agent session that
+discloses one field has disclosed all of them.
+
+On 2026-08-19, grading all 27 lanes, ops-warden graded
+`issue-core-ingestion-api-key` and `reuse-surface-hub-write-token` as `standard`
+— "ordinary internal workload secrets". Both grades read only the headline field.
+`CCR-2026-0002` records a deliberate decision to keep `GITEA_BACKEND_TOKEN` at the
+first path; `CCR-2026-0005` declares a dual-consumer webhook HMAC at the second.
+Neither is recovered by rotating the credential the lane is named after.
+
+Three details make this worth a record rather than a fix:
+
+- **The evidence was already ours.** The field sets were in the CCRs the catalog
+  already cites as authoritative. This was not missing data; it was unread data.
+- **A test held the error still.** `test_high_risk_lanes_classified` asserted
+  `issue-core-ingestion-api-key` was *not* high. A first grading pass had marked
+  it high, the test contradicted it, and the test was believed. A test that
+  encodes a judgement defends that judgement from correction.
+- **Another repo found it.** `secrets-engine` graded both `high` independently
+  while drafting catalog entries whose schema records `fields`. A schema that
+  names the field set makes the right grade obvious; ours did not have one.
+
+## Decision
+
+**A lane's `risk` grade is a property of its path, and must cover the union of
+everything a read of that path would disclose.**
+
+1. Where the field set is known, the catalog records it as `fields`, with the
+   authority it came from.
+2. The grade is argued against the most damaging field, not the named one.
+3. Where the field set is unknown, that is stated — never assumed to be one
+   field. An unverified field set is a reason to grade conservatively, matching
+   the `inter-hub-bootstrap-ssh` precedent under `ADR-0007`.
+4. Establishing a field set must not be done by reading the secret. Use the
+   owning CCR, the owner's catalog, or `bao kv metadata`. `bao kv get` on a
+   high-risk path is the 2026-07-16 vector and is forbidden by
+   `ADR-0004` for agent sessions regardless of intent.
+
+## Consequences
+
+`ADR-0007` is unchanged and still governs: every lane carries an explicit grade,
+and absence fails safe. This record says what that grade must account for.
+
+Grading gets more expensive: it now requires knowing what is at a path, not just
+what the lane is called. That cost is the point — the cheap version produced two
+wrong answers in one pass and is the reason this exists.
+
+A test that asserts a grade is asserting a judgement. When a grade is disputed,
+re-argue it from evidence before trusting the test that encodes it.
+
+## Related
+
+- `ADR-0007` — every lane carries an explicit grade; build-stage permissiveness
+  stops at credential disclosure
+- `ADR-0004` — high-risk lanes refuse raw value streaming to agent sessions
+- `ADR-0001` — the catalog is a pointer layer; `fields` records the owner's
+  declared field set with its source, and does not restate their procedure
+- `WARDEN-WP-0033-T02`; `secrets-engine` `SECRETS-WP-0006`
+- `history/2026-07-16-credential-disclosure-lessons.md`

docs/adr/README.md

@@ -69,3 +69,4 @@ and the publication is a defect.
 | `ADR-0005` | Implement one lane narrowly, route everything else | ops-warden |
 | `ADR-0006` | Enforcement is zone-scoped, never a global flag | ops-warden |
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure | ops-warden |
+| `ADR-0008` | A lane's risk grade covers every field its path discloses | ops-warden |