tegwick
ac85259c20
Closes the RISK-F-0003 exposure. All 14 ungraded lanes now carry an explicit risk grade with its justification in the entry: 17 high, 10 standard, 0 ungraded. The agent read-boundary now fires (exit 7) on lanes that were silently outside it. Graded on merit rather than defensively. A first pass marked two ordinary internal workload secrets high; test_high_risk_lanes_classified asserted the opposite and was right, so both were regraded down. high means disclosure into a logged context is damaging beyond what rotation recovers. inter-hub-bootstrap-ssh is high conservatively, with the reason in the entry so it is regraded with evidence rather than assumed down. ADR-0007 records the rule the grading rests on: build-stage permissiveness applies to controls that gate work, not to controls that prevent credential disclosure. The test is friction, not severity — the read-boundary blocks nobody, since --out/--exec/--wrap remain available, so relaxing it buys nothing. A blocked operation is recovered by retrying; a credential in a logged transcript is not recovered by rotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4.4 KiB
| id | type | title | domain | repo | status | version | revision | owner | binds | created | updated | last_reviewed | review_interval | enforced_by | supersedes | successor |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ops-warden-adr-0007 | adr | ADR-0007 — Build-stage permissiveness stops at credential disclosure | infotech | ops-warden | accepted | 1.0 | 1 | ops-warden | ops-warden | 2026-08-19 | 2026-08-19 | 2026-08-19 | 6m | registry/routing/catalog.yaml risk grades; src/warden/cli.py agent read-boundary; WARDEN-WP-0032-T06 |
ADR-0007 — Build-stage permissiveness stops at credential disclosure
Status
Accepted 2026-08-19, alongside grading the last 14 ungraded catalog lanes.
Context
ADR-0006 deferred a global fail-closed authorization gate because uniform
enforcement across an estate under deep refactor hardens the access needed to
perform the refactor. The organization's declared posture is build
(WP-0029), and the operator has confirmed the estate need not be tight yet.
That is correct, and it is also the kind of principle that quietly generalises past its warrant. Read loosely, "we are in build stage" argues for relaxing every control, including the ones that stop a credential landing in a logged agent transcript. Those are not the same class of control, and the difference is not severity — it is cost.
RISK-F-0003 made the distinction concrete. ADR-0004 reads as a categorical
rule: high-risk lanes refuse raw value streaming to agent sessions. The
implementation was risk == "high" against an optional field, so 14 of 27
lanes never reached the control at all — five of them exec_capable. The
control had not been relaxed by anyone's decision. It had simply never been
reached, which is worse, because nothing announced it.
Decision
Build-stage permissiveness applies to controls that gate work. It does not apply to controls that prevent credential disclosure.
The test is friction, not severity:
- A control that can block a legitimate operation — a fail-closed
authorization gate, an enforcement stance — is a candidate for relaxation
while the organization is in
build, andADR-0006scopes that relaxation to zones. - A control that redirects how a value moves without preventing the work —
the agent read-boundary, which refuses raw stdout but leaves
--out,--exec,--wrapand--fingerprintfully available — is not relaxed by build posture, because relaxing it buys nothing. Nobody is unblocked by it.
The asymmetry that settles it: a blocked operation is recovered by retrying. A credential written into a logged transcript is not recovered by rotation — rotation limits the damage, it does not unwrite the log. The 2026-07-16 disclosure is the case in point.
Therefore, regardless of organization_posture:
- Every catalog lane carries an explicit
riskgrade. Absence is not a grade, and a lane that omits it is a defect, not a default. - Grading is done on merit, per lane. This decision is not licence to grade
everything
high— an over-broad grade is its own inaccuracy, andtenancy-posture§6's accuracy, not altitude applies to this field too. - Minimum credential-handling standards — the read-boundary, the safe fetch transports, the no-secret audit guard — hold in every posture.
Consequences
We accept the grading cost, now and on every new lane. That is the point:
WARDEN-WP-0032-T06 makes an ungraded lane impossible rather than merely
discouraged, because a rule enforced by remembering is not enforced.
We reject "build stage" as a general argument in credential-handling discussions. It is a real and useful argument about gating, and citing it against a disclosure control is a category error this record exists to name.
We note what this decision is not. It does not set severity for
RISK-F-0003 — that is risk-nexus's. It does not make ops-warden the judge of
other repos' controls. And it does not survive contact with a zone model that
says otherwise: when zone-engine defines admission standards, a zone may
legitimately require more than this floor. It may not require less.
Related
ADR-0004— high-risk lanes refuse raw value streaming to agent sessionsADR-0006— enforcement is zone-scoped, never a global flagRISK-F-0003— the read-boundary blind spot that prompted thisWARDEN-WP-0032-T05/T06— the grading, and making absence impossiblezone-engineZONE-WP-0001— where admission standards will be defined