chore: regenerate high-risk-data-paths artifact (catalog revision metadata only)

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0

registry/generated/high-risk-data-paths.yaml

@@ -10,11 +10,11 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-10-14T16:21:15Z"
+generated_at: "2026-10-14T16:46:11Z"
 source: ops-warden/registry/routing/catalog.yaml
 catalog_revision: "8dbf62515a4e6b18d0b67beaa475a4747bf75cc7"
 catalog_revision_date: "2026-10-14T18:21:02+02:00"
-catalog_dirty: false
+catalog_dirty: true
 high_risk_lane_count: 35
 concrete_path_count: 17
 

registry/routing/catalog.yaml

@@ -665,11 +665,13 @@ entries:
     # proxies reads as the caller and never holds the value.
     # Data-plane identity is whichever token the OpenBao CLI resolves
     # (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token). That is not the
-    # flex-auth caller. CCR-2026-0005 does not bind an OIDC role to
-    # workload-kv-read-reuse-surface-runtime; the only live binding is the
-    # ESO Kubernetes role reuse-surface-runtime-eso. platform-admin must not
-    # receive the scoped policy. See the playbook.
-    auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); no OIDC role binds workload-kv-read-reuse-surface-runtime"
+    # flex-auth caller. CCR-2026-0005 does not bind an OIDC role. The only
+    # live binding is Kubernetes role reuse-surface-runtime-eso.
+    # CCR-2026-0044 (proposed, railiance-platform) reserves a dedicated
+    # caller. ops-mason (MASON-WP-0011) says that role stays out of
+    # auth_method until member and non-member verification both pass.
+    # platform-admin must not receive the scoped policy. See the playbook.
+    auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); dedicated caller unnamed until CCR-2026-0044 is approved and member plus non-member verification pass"
     path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets"
     fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets"
     policy_ref: "flex-auth check secret.read:reuse"

tests/test_reuse_surface_caller_gate.py

@@ -0,0 +1,17 @@
+"""The reuse-surface catalog caller stays unnamed until verification."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from warden.routing import load_catalog
+
+
+def test_dedicated_caller_stays_unnamed_until_ccr_2026_0044_verification():
+    catalog = load_catalog(Path(__file__).resolve().parents[1] / "registry" / "routing" / "catalog.yaml")
+    entry = catalog.get("reuse-surface-hub-write-token")
+    assert entry is not None
+    auth = entry.auth_method or ""
+    # MASON-WP-0011: the proposed OIDC role is not the auth method yet.
+    assert "reuse-surface-hub-writer" not in auth
+    assert "CCR-2026-0044" in auth
+    assert "unnamed" in auth

wiki/playbooks/reuse-surface-hub-write-token.md

@@ -39,9 +39,9 @@ recorded in CCR-2026-0005.
 
 A capabilities check on one shell and a proxy in another can disagree. The OpenBao CLI in the proxy uses that process's ambient token. An attended `platform-admin` login (entity `4a1f663c-0621-0483-edd0-f852274f4b6b`, policies `default`, `operator-custody`, `platform-admin`) can show `read` on both exact paths while `auth/netkingdom/role/coding-agent` is denied: that role's `agent-high-risk-boundary` policy denies data read on this path. The 2026-10-14 hub registration attempt was that shape. PDP decision `f730e3da14beebdd` allowed the fetch; OpenBao then returned HTTP 403 and the helper did not run.
 
-Do not attach `workload-kv-read-reuse-surface-runtime` to the platform-admin entity. CCR-2026-0005 does not name that caller. The only live binding is Kubernetes role `auth/kubernetes/role/reuse-surface-runtime-eso` (ServiceAccount `reuse/reuse-surface-eso`, audience `openbao`) with policy `workload-kv-read-reuse-surface-runtime-eso`: data read plus token self lookup and revoke. The caller-facing policy file allows read of the exact data and metadata paths and is not attached to any `auth/netkingdom` role.
+Do not attach `workload-kv-read-reuse-surface-runtime` to the platform-admin entity. CCR-2026-0005 does not name that caller. The only live binding is Kubernetes role `auth/kubernetes/role/reuse-surface-runtime-eso` (ServiceAccount `reuse/reuse-surface-eso`, audience `openbao`) with policy `workload-kv-read-reuse-surface-runtime-eso`: data read plus token self lookup and revoke. The caller-facing policy file allows read of the exact data and metadata paths and is not attached to any live `auth/netkingdom` role.
 
-A dedicated caller is a new `auth/netkingdom` OIDC role in railiance-platform, same shape as the other `workload-kv-read` roles: `token_policies` only `workload-kv-read-reuse-surface-runtime`, `token_no_default_policy` true, and a sibling path still denied. Platform-operator and reuse-surface-owner approve the named principal first. ops-warden does not apply that binding.
+The dedicated caller is proposed, not applied. railiance-platform `CCR-2026-0044` (status `proposed`) and ops-mason `MASON-WP-0011` reserve OIDC role `reuse-surface-hub-writer-workload-kv-read` for group `reuse-surface-hub-writers`, policy `workload-kv-read-reuse-surface-runtime` only. Apply waits on platform-operator and reuse-surface-owner approval, key-cape confirmation of that group, and a member entity other than `4a1f663c-0621-0483-edd0-f852274f4b6b`. The catalog `auth_method` stays unnamed until `ops-mason/scripts/verify-reuse-surface-hub-writer.py` passes in both `member` and `non-member` modes. Those receipts do not exist yet. ops-warden does not apply the role and does not put it in `auth_method` before that gate.
 
 ### Break-glass (cluster read)