WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008

secrets-engine reviewed our catalog metadata while drafting their five entries
and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high.
We had both as standard, and had deliberately regraded them DOWN on 2026-08-19.

They are right. Both paths carry a second credential our grade never looked at --
GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a
dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the
credential the lane is named after.

The defect is structural: we graded the lane by its headline field, but a read
returns every field at the path. Worse, the evidence was already in the CCRs we
cite as authoritative -- not missing, unread -- and a test asserted the wrong
answer, so a correct first-pass grade got overruled by it.

ADR-0008 records the rule: a grade covers every field its path discloses.
ADR-0007 is unchanged and still governs; this says what the grade is of.

Six of the remaining standard lanes have no KV path. Two have paths and no field
evidence; per ADR-0008 they are stated as unknown rather than assumed, and left
for operator-sanctioned grading.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/WARDEN-WP-0033-native-lane-handoff.md

@@ -41,7 +41,7 @@ work completed directly; this is none of those.
 
 ```task
 id: WARDEN-WP-0033-T01
-status: progress
+status: done
 priority: high
 ```
 
@@ -62,7 +62,7 @@ applied to ops-warden by someone else, correctly.
 
 ```task
 id: WARDEN-WP-0033-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -89,6 +89,30 @@ disclose, and it should.
 Fix the grade, then fix the model that produced it: record `fields` per lane and
 grade on the union. Check the other 25 lanes for the same shape.
 
+**Done 2026-08-21 — and it was two lanes, not one.** While verifying
+`reuse-surface-hub-write-token` I told secrets-engine their second field was
+unevidenced and asked them to confirm it. It was evidenced: `CCR-2026-0005`'s
+`kv_path` block lists both fields and its notes describe the HMAC's alignment
+with Forgejo org webhook id=1. A truncated grep, and a retraction sent within
+twenty minutes so they would not spend time on it. That lane was under-graded on
+exactly the same reasoning, and both had been regraded *down* in the same T05
+pass — which is what makes this a systematic flaw rather than one bad call.
+
+Blast radius checked and bounded: of the 8 remaining `standard` lanes, 6 have no
+KV path at all (SSH, policy check, tunnel, principals, issue-sink, key-cape
+login) so nothing is disclosed by a read. Two do have paths and no CCR field
+evidence — `rein-openweights-openrouter-approle` and `coulomb-social-runtime-env`
+(a whole k8s env Secret, which by shape almost certainly holds several fields).
+Deliberately **not** regraded: `ADR-0008` §3 says an unknown field set is stated
+rather than assumed, and grading is operator-sanctioned judgement, not backfill.
+They are the open item on this task.
+
+Shipped: both regrades with their evidence and the superseded reasoning kept
+inline, `fields` recorded with its CCR source, the test that had been holding the
+wrong answer inverted with an explanation of why it was wrong to trust it, and
+**`ADR-0008`** — a lane's grade covers every field its path discloses. That is a
+new binding rule, so it is a record rather than a wiki note.
+
 ```task
 id: WARDEN-WP-0033-T03
 status: todo