tegwick c357ce5908 WARDEN-WP-0033 T01/T02: two under-graded lanes, and ADR-0008

secrets-engine reviewed our catalog metadata while drafting their five entries
and graded issue-core-ingestion-api-key and reuse-surface-hub-write-token high.
We had both as standard, and had deliberately regraded them DOWN on 2026-08-19.

They are right. Both paths carry a second credential our grade never looked at --
GITEA_BACKEND_TOKEN (CCR-2026-0002, a deliberate field-set decision) and a
dual-consumer webhook HMAC (CCR-2026-0005). Neither is recovered by rotating the
credential the lane is named after.

The defect is structural: we graded the lane by its headline field, but a read
returns every field at the path. Worse, the evidence was already in the CCRs we
cite as authoritative -- not missing, unread -- and a test asserted the wrong
answer, so a correct first-pass grade got overruled by it.

ADR-0008 records the rule: a grade covers every field its path discloses.
ADR-0007 is unchanged and still governs; this says what the grade is of.

Six of the remaining standard lanes have no KV path. Two have paths and no field
evidence; per ADR-0008 they are stated as unknown rather than assumed, and left
for operator-sanctioned grading.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-21 08:36:42 +02:00

4.2 KiB

Raw Blame History

id	type	title	domain	repo	status	version	revision	owner	binds	created	updated	last_reviewed	review_interval	enforced_by	supersedes	successor
ops-warden-adr-0008	adr	ADR-0008 — A lane's risk grade covers every field its path discloses	infotech	ops-warden	accepted	1.0	1	ops-warden	ops-warden	2026-08-21	2026-08-21	2026-08-21	6m	registry/routing/catalog.yaml fields + risk; tests/test_routing.py::test_high_risk_lanes_classified

ADR-0008 — A lane's risk grade covers every field its path discloses

Status

Accepted 2026-08-21, after secrets-engine found two under-graded lanes while reviewing ops-warden's own catalog metadata.

Context

ADR-0007 requires every catalog lane to carry an explicit risk grade. It does not say what the grade is of, and the omission turned out to matter.

The catalog describes a lane by a single fetch_command naming a single field — bao kv get -field=ISSUE_CORE_API_KEY <path>. Grading followed that description. But the unit of disclosure is not the field, it is the path: bao kv get without -field returns every key stored there, and an agent session that discloses one field has disclosed all of them.

On 2026-08-19, grading all 27 lanes, ops-warden graded issue-core-ingestion-api-key and reuse-surface-hub-write-token as standard — "ordinary internal workload secrets". Both grades read only the headline field. CCR-2026-0002 records a deliberate decision to keep GITEA_BACKEND_TOKEN at the first path; CCR-2026-0005 declares a dual-consumer webhook HMAC at the second. Neither is recovered by rotating the credential the lane is named after.

Three details make this worth a record rather than a fix:

The evidence was already ours. The field sets were in the CCRs the catalog already cites as authoritative. This was not missing data; it was unread data.
A test held the error still. test_high_risk_lanes_classified asserted issue-core-ingestion-api-key was not high. A first grading pass had marked it high, the test contradicted it, and the test was believed. A test that encodes a judgement defends that judgement from correction.
Another repo found it. secrets-engine graded both high independently while drafting catalog entries whose schema records fields. A schema that names the field set makes the right grade obvious; ours did not have one.

Decision

A lane's risk grade is a property of its path, and must cover the union of everything a read of that path would disclose.

Where the field set is known, the catalog records it as fields, with the authority it came from.
The grade is argued against the most damaging field, not the named one.
Where the field set is unknown, that is stated — never assumed to be one field. An unverified field set is a reason to grade conservatively, matching the inter-hub-bootstrap-ssh precedent under ADR-0007.
Establishing a field set must not be done by reading the secret. Use the owning CCR, the owner's catalog, or bao kv metadata. bao kv get on a high-risk path is the 2026-07-16 vector and is forbidden by ADR-0004 for agent sessions regardless of intent.

Consequences

ADR-0007 is unchanged and still governs: every lane carries an explicit grade, and absence fails safe. This record says what that grade must account for.

Grading gets more expensive: it now requires knowing what is at a path, not just what the lane is called. That cost is the point — the cheap version produced two wrong answers in one pass and is the reason this exists.

A test that asserts a grade is asserting a judgement. When a grade is disputed, re-argue it from evidence before trusting the test that encodes it.

ADR-0007 — every lane carries an explicit grade; build-stage permissiveness stops at credential disclosure
ADR-0004 — high-risk lanes refuse raw value streaming to agent sessions
ADR-0001 — the catalog is a pointer layer; fields records the owner's declared field set with its source, and does not restate their procedure
WARDEN-WP-0033-T02; secrets-engine SECRETS-WP-0006
history/2026-07-16-credential-disclosure-lessons.md

4.2 KiB Raw Blame History