From d7f4ebcfe0769dc704b37f5dbac14957ec826318 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 28 Aug 2026 21:55:33 +0200 Subject: [PATCH] Re-emit the high-risk path artifact after the NetKingdom SSO lanes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit c374d41 added net-kingdom-lldap-bind-credential and net-kingdom-privacyidea-admin-token as `risk: high` and did not re-run the emitter, so registry/generated/high-risk-data-paths.yaml still described the catalog at 0fae090. railiance-platform consumes that file instead of hand-maintaining its deny list, and it has been reading a census two lanes short since 2026-08-23. This is precisely the drift WARDEN-WP-0033-T03 built the guard for — a lane graded high after the last emit silently failing to reach the consumer. The guard fired; nothing had acted on it. The deny list itself does not move: both lanes are blocked on their OpenBao path being published, so they land in `no_concrete_path` and concrete_path_count stays 14. What changes is the count the consumer sees — 23 high-risk lanes, two of which have no address yet. That is the honest signal and the reason the bucket is listed rather than omitted. check_agent_read_boundary.py still reports 0 uncovered. The workload-join census moves 9 -> 11 not-applicable: both lanes are provider/control-plane credentials rather than workload delivery lanes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014535@bnt-lap001 Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c --- registry/generated/high-risk-data-paths.yaml | 10 ++++++---- tests/test_workload_join.py | 4 +++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml index 6c2c341..a0b7ea0 100644 --- a/registry/generated/high-risk-data-paths.yaml +++ b/registry/generated/high-risk-data-paths.yaml @@ -10,12 +10,12 @@ # declares it, and is null where the field set has not been established -- # null means unknown, never 'one field'. -generated_at: "2026-08-22T23:31:10Z" +generated_at: "2026-08-28T19:54:29Z" source: ops-warden/registry/routing/catalog.yaml -catalog_revision: "0fae0904ce8d8694338dd53a8a79abec5fec788d" -catalog_revision_date: "2026-08-23T01:31:05+02:00" +catalog_revision: "c374d41a4925720ae7706dfda020537b60a07eb9" +catalog_revision_date: "2026-08-23T21:43:12+02:00" catalog_dirty: false -high_risk_lane_count: 21 +high_risk_lane_count: 23 concrete_path_count: 14 # Graded high but not a single KV address -- a routing pattern, a broker @@ -23,6 +23,8 @@ concrete_path_count: 14 no_concrete_path: - database-dynamic-credentials - inter-hub-bootstrap-ssh + - net-kingdom-lldap-bind-credential + - net-kingdom-privacyidea-admin-token - object-storage-sts - openbao-api-key - openbao-platform-admin-login diff --git a/tests/test_workload_join.py b/tests/test_workload_join.py index 559a875..dab4df8 100644 --- a/tests/test_workload_join.py +++ b/tests/test_workload_join.py @@ -14,7 +14,9 @@ def test_repo_catalog_uses_only_explicit_workload_references(): assert report["ok"] is True assert len(report["resolved"]) == 3 assert len(report["unknown"]) == 17 - assert len(report["not_applicable"]) == 9 + # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are + # provider/control-plane credentials, not workload delivery lanes. + assert len(report["not_applicable"]) == 11 assert {row["lane"] for row in report["resolved"]} == { "ops-warden-warden-sign-token", "issue-core-ingestion-api-key",