fix: route OpenBao recovery ceremonies safely

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836

tests/test_plan.py

@@ -80,6 +80,23 @@ def test_plan_first_time_openbao_database_admin_uses_platform_admin_login():
     )
 
 
+def test_plan_openbao_shamir_recovery_uses_approval_ceremony_not_secret_provision():
+    plan = build_plan(
+        "coordinate one attended production OpenBao emergency seal/unseal drill "
+        "with a fresh encrypted off-host Raft snapshot receipt, verified "
+        "provider-console access, two-of-three Shamir custodian quorum, named "
+        "driver and abort operator, without exposing credential values"
+    )
+    assert plan.verdict == "founder_required"
+    assert plan.lane_id == "openbao-shamir-recovery-ceremony"
+    assert plan.founder_act is not None
+    assert plan.founder_act.kind == "approve"
+    assert "openbao-shamir-recovery-ceremony" in plan.founder_act.details["desk_hint"]
+    assert "paste_once" not in plan.founder_act.details["desk_hint"]
+    assert all("warden access" not in item for item in plan.commands)
+    assert any("openbao-shamir-recovery-ceremony" in item for item in plan.commands)
+
+
 def test_plan_unroutable():
     # Zero keyword overlap with catalog (avoid tokens like secret/key/token)
     plan = build_plan("xyzzy-plugh-fnord-qqq-zzzz")

tests/test_routing.py

@@ -170,6 +170,18 @@ def test_platform_admin_login_lane_is_exact_and_non_value_bearing():
     assert entry.workload_ref.resolution == "not-applicable"
 
 
+def test_openbao_recovery_ceremony_is_non_value_bearing_owner_pointer():
+    entry = load_catalog(_repo_catalog()).get("openbao-shamir-recovery-ceremony")
+    assert entry.lane == "ceremony"
+    assert entry.risk == "high"
+    assert entry.owner_repo == "railiance-platform"
+    assert entry.warden_executes is False
+    assert entry.exec_capable is False
+    assert entry.has_handoff is False
+    assert entry.vends_secret is False
+    assert entry.workload_ref.resolution == "not-applicable"
+
+
 def test_find_exact_id_wins_over_keyword_collision():
     catalog = load_catalog(_repo_catalog())
     # "npm" alone collides with openbao-api-key; the exact id must resolve uniquely.