tegwick 7d4381e887 WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075) ... check_fetch_policy now posts only to policy.fetch_flex_auth_url (access-engine pin flex-auth-ops-warden-fetch, workstation 127.0.0.1:19091). Signing keeps policy.flex_auth_url. Unset or unreachable fetch evaluator fails closed with a message naming it; no fallback to the signing pin or to allow. warden access advisory output names the fetch evaluator. Recorded under WARDEN-WP-0039-T03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3		2026-10-03 09:18:54 +02:00
..
inventory.seed.yaml	feat: adopt security zones and explicit workload refs	2026-08-22 15:36:37 +02:00
posture-conformance.example.yaml
rapp-qonto-posture-conformance.yaml
warden.production.example.yaml	WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075)	2026-10-03 09:18:54 +02:00
worker.env.example