test_catalog_gaps_lists_only_interim asserted openbao-api-key was an interim
cover. It encoded the same classification the entry did, so it defended the
wrong answer rather than catching it -- the second time this session a test has
held a judgement still (see ADR-0008).
The staleness test added in T03 did its job on the first real change: it failed
the moment the catalog moved without the generated artifact being re-emitted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three fixes, the first of which is my own botched edit from an hour ago.
1. The "six delivery modes" claim was never actually removed. I ran a str.replace
with no assertion on the result, it matched nothing, and the print said "ok".
The wrong claim sat in all seven lanes while I told secrets-engine it was
fixed. This edit asserts 5/1/1 and fails loudly otherwise.
2. Five lanes ACCEPTED (SECRETS-WP-0006, decision ae676382). The blocker now
records that secrets-engine holds the entry and that the interim proxy retires
on approved native verification in T05 -- not on acceptance. Retiring early
would drop the cover before the replacement is proven.
3. Two lanes REFUSED, and both refusals are right:
- key-cape-oidc-login: intended_owner corrected secrets-engine -> key-cape.
Login and identity-token issuance were never secrets-engine's. Not yet asked
of key-cape, and the record says so.
- openbao-api-key: not a delegable lane at all -- a <domain>/<workload>/<bundle>
routing template, not one secret lane, so there is no front door to own.
interim -> native with railiance-platform named: OpenBao is itself the front
door and this entry is a pointer to it, never an interim cover. It should
not have been inflating the interim count.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
railiance-platform asked for a generated list to consume instead of hand-
maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two
lists drift for four lanes in RISK-F-0009.
19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed
separately so absence does not read as omission. Carries catalog_revision and a
dirty flag. fields is null where unestablished, never a one-element guess.
The header states plainly that this is an input and not a policy: railiance-
platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002
survives the handoff.
Two CI tests guard staleness, because a consumer applies this to a live control.
Note the immediate consequence of T02: 2 uncovered against a policy they closed
to 0 yesterday.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
