tegwick 7d4381e887 WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075) ... check_fetch_policy now posts only to policy.fetch_flex_auth_url (access-engine pin flex-auth-ops-warden-fetch, workstation 127.0.0.1:19091). Signing keeps policy.flex_auth_url. Unset or unreachable fetch evaluator fails closed with a message naming it; no fallback to the signing pin or to allow. warden access advisory output names the fetch evaluator. Recorded under WARDEN-WP-0039-T03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3		2026-10-03 09:18:54 +02:00
..
inventory.seed.yaml	feat: adopt security zones and explicit workload refs	2026-08-22 15:36:37 +02:00
posture-conformance.example.yaml	feat(WARDEN-WP-0015): T3 conformance checker + T4 dev-tier contract doubles	2026-06-27 19:30:30 +02:00
rapp-qonto-posture-conformance.yaml	Route rapp-qonto workload identity	2026-07-27 20:37:09 +02:00
warden.production.example.yaml	WARDEN: separate fetch evaluator URL for secret-read checks (CUST-WP-0075)	2026-10-03 09:18:54 +02:00
worker.env.example	feat(WARDEN-WP-0021): T1+T2 — scheduled worker tick enabled (systemd --user timer)	2026-06-30 15:19:23 +02:00