feat: assert flex-auth ceiling keys are declared, not assumed

flex-auth fixed enrichment so registry facts beat caller-supplied ones
(FLEX-DEC-2026-012) and asked each consumer to confirm the ceiling and
allowlist keys are actually declared -- the fix wins only where the registry
HAS a value, and a manifest omitting max_ttl_hours hands that ceiling back
to the caller.

Confirmed, and made durable rather than read once.
scripts/check_flex_auth_manifest_coverage.py audits both ways a ceiling
gets handed back: an actor with no manifest resource at all (warden sign
names ssh-cert:actor/<name> whether or not the snapshot was rebuilt --
an honour-system step in SCOPE.md), and a resource missing one of the
seven keys. A null is treated as absent, because for enrichment it is.

Also asserts the property their exploitability assessment rested on and
nothing here held: ops-warden sends no resource.attributes. It was true
when they read it, secrets-engine sends them on every request, and it was
one refactor from silently stopping being true.

Current state: no gap. 4 actors, 4 resources, all seven keys declared.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

tests/test_flex_auth_registry.py

@@ -81,3 +81,86 @@ def test_compiler_joins_explicit_workload_reference_to_resolved_zone(tmp_path):
     assert attrs["security_zone"] == "z2-continuity"
     assert attrs["security_zone_admission"] == "satisfied"
     assert attrs["security_zone_revision"] == "sha256:zone-revision"
+
+
+# --- manifest ceiling coverage (FLEX-DEC-2026-012) ----------------------------
+#
+# flex-auth fixed enrichment so registry facts beat caller-supplied ones, then
+# asked every consumer to confirm the ceiling keys are actually declared: the
+# fix wins only where the registry HAS a value. These assert the two ways a
+# ceiling gets handed back to the caller.
+
+import importlib.util  # noqa: E402
+
+import pytest  # noqa: E402
+
+_REPO = ROOT
+_spec = importlib.util.spec_from_file_location(
+    "check_flex_auth_manifest_coverage",
+    _REPO / "scripts" / "check_flex_auth_manifest_coverage.py",
+)
+_coverage = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_coverage)
+REQUIRED_CEILING_KEYS = _coverage.REQUIRED_CEILING_KEYS
+audit = _coverage.audit
+
+_build_spec = importlib.util.spec_from_file_location("build_flex_auth_registry", SCRIPT)
+_builder = importlib.util.module_from_spec(_build_spec)
+_build_spec.loader.exec_module(_builder)
+build_registry = _builder.build_registry
+
+
+def _repo_inventory_and_registry():
+    inventory = yaml.safe_load((_REPO / "examples" / "inventory.seed.yaml").read_text())
+    registry = json.loads(
+        (_REPO / "registry" / "flex-auth" / "production_registry_snapshot.json").read_text()
+    )
+    return inventory, registry
+
+
+def test_shipped_snapshot_declares_every_ceiling_key():
+    """The confirmation flex-auth asked for, as a test rather than a reading."""
+    report = audit(*_repo_inventory_and_registry())
+    assert report["unregistered_actors"] == []
+    assert report["resources_missing_keys"] == []
+    assert report["covered"] is True
+
+
+def test_actor_with_no_manifest_resource_is_a_coverage_gap():
+    """`warden sign` names ssh-cert:actor/<name> whether or not the snapshot was rebuilt."""
+    inventory, registry = _repo_inventory_and_registry()
+    inventory["actors"]["adm-added-after-the-last-build"] = {
+        "type": "adm", "principals": ["adm-full"], "ttl_hours": 48,
+    }
+    report = audit(inventory, registry)
+    assert report["unregistered_actors"] == ["adm-added-after-the-last-build"]
+    assert report["covered"] is False
+
+
+@pytest.mark.parametrize("key", REQUIRED_CEILING_KEYS)
+def test_dropping_any_single_ceiling_key_is_a_coverage_gap(key):
+    inventory, registry = _repo_inventory_and_registry()
+    resource = registry["resource_manifests"][0]["resources"][0]
+    resource["attributes"].pop(key)
+    report = audit(inventory, registry)
+    assert report["resources_missing_keys"] == [
+        {"resource": resource["id"], "missing": [key]}
+    ]
+    assert report["covered"] is False
+
+
+@pytest.mark.parametrize("key", REQUIRED_CEILING_KEYS)
+def test_a_null_ceiling_is_not_a_declaration(key):
+    """flex-auth overlays a registry value only where one exists."""
+    inventory, registry = _repo_inventory_and_registry()
+    resource = registry["resource_manifests"][0]["resources"][0]
+    resource["attributes"][key] = None
+    report = audit(inventory, registry)
+    assert report["covered"] is False
+
+
+def test_builder_output_is_covered_by_construction(tmp_path):
+    """Every resource the builder emits carries the full ceiling set."""
+    inventory = yaml.safe_load((_REPO / "examples" / "inventory.seed.yaml").read_text())
+    report = audit(inventory, build_registry(inventory))
+    assert report["covered"] is True

tests/test_policy.py

@@ -307,3 +307,47 @@ def test_advisory_decision_is_recorded_and_does_not_block(tmp_path):
         assert check_sign_policy(cfg, spec) == "decision:advisory"
     assert spec.policy_zone == "unknown"
     assert spec.policy_outcome == "audit_only"
+
+
+def test_check_request_asserts_no_resource_attributes(tmp_path, monkeypatch):
+    """The property FLEX-DEC-2026-012 turned on, asserted rather than assumed.
+
+    flex-auth's enrichment used to overlay registry facts additive-if-absent, so
+    a caller-supplied `resource.attributes` value won and the registry ceiling
+    never applied. Their exploitability assessment rested on ops-warden sending
+    no `resource.attributes` at all -- true when they read it, and nothing here
+    held it true. secrets-engine sends them on every request, so this is a
+    property of this code rather than of the protocol.
+
+    Ceilings must arrive from the registry. If a future change ever needs to send
+    an attribute, this test is the place that argument gets made.
+    """
+    from warden import policy as policy_mod
+
+    pubkey = tmp_path / "id.pub"
+    pubkey.write_text("ssh-ed25519 AAAA test\n")
+    cfg = PolicyConfig(flex_auth_url="http://flex-auth.test")
+    seen = {}
+
+    class _Response:
+        status_code = 200
+
+        def raise_for_status(self):
+            return None
+
+        def json(self):
+            return {"effect": "allow", "id": "decision:49350f1064f674d7"}
+
+    def fake_post(url, json=None, headers=None, timeout=None):
+        seen["body"] = json
+        return _Response()
+
+    monkeypatch.setattr(policy_mod.httpx, "post", fake_post)
+    policy_mod.check_sign_policy(cfg, _spec(pubkey))
+
+    assert "attributes" not in seen["body"]["resource"]
+    # The requested TTL is a policy input (ttl_out_of_bounds is denied against
+    # the registry ceiling), so it must travel as context, never as a resource
+    # attribute that would be compared against itself.
+    assert seen["body"]["context"]["ttl_hours"] == 24
+    assert set(seen["body"]["resource"]) == {"id", "type", "system", "tenant"}