Finish coding-agent high-risk boundary coverage

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

openbao/policies/inputs/ops-warden-high-risk-data-paths.yaml

@@ -0,0 +1,90 @@
+# GENERATED by ops-warden/scripts/emit_high_risk_paths.py -- do not edit by hand.
+# Vendored policy input. ops-warden owns the risk grade; railiance-platform owns
+# whether and how agent-high-risk-boundary denies each path.
+
+generated_at: "2026-08-21T11:28:33Z"
+source: ops-warden/registry/routing/catalog.yaml
+catalog_revision: "55f0f47a021375b8b25c924953d1b49a24e002c5"
+catalog_revision_date: "2026-08-21T13:26:10+02:00"
+catalog_dirty: false
+high_risk_lane_count: 19
+concrete_path_count: 14
+
+no_concrete_path:
+  - database-dynamic-credentials
+  - inter-hub-bootstrap-ssh
+  - object-storage-sts
+  - openbao-api-key
+  - ops-warden-warden-sign-token
+
+paths:
+  - id: agent-harness-binky-mail-approle
+    data_path: tenants/data/binky/company-email/imap
+    metadata_path: tenants/metadata/binky/company-email/imap
+    owner_repo: railiance-platform
+    fields: null
+  - id: agent-harness-forgejo-deploy
+    data_path: platform/data/workloads/agent-harness/forgejo-deploy-key
+    metadata_path: platform/metadata/workloads/agent-harness/forgejo-deploy-key
+    owner_repo: railiance-platform
+    fields: null
+  - id: audit-core-senders
+    data_path: platform/data/workloads/audit-core/senders
+    metadata_path: platform/metadata/workloads/audit-core/senders
+    owner_repo: ops-mason
+    fields: null
+  - id: binky-company-email-imap
+    data_path: tenants/data/binky/company-email/imap
+    metadata_path: tenants/metadata/binky/company-email/imap
+    owner_repo: railiance-platform
+    fields: null
+  - id: binky-qonto-api
+    data_path: tenants/data/binky/qonto-api
+    metadata_path: tenants/metadata/binky/qonto-api
+    owner_repo: railiance-platform
+    fields: null
+  - id: email-connect-transactional
+    data_path: platform/data/workloads/email-connect/transactional
+    metadata_path: platform/metadata/workloads/email-connect/transactional
+    owner_repo: railiance-platform
+    fields: null
+  - id: forgejo-admin-api-token
+    data_path: platform/data/workloads/forgejo/forgejo-admin
+    metadata_path: platform/metadata/workloads/forgejo/forgejo-admin
+    owner_repo: railiance-platform
+    fields: null
+  - id: issue-core-ingestion-api-key
+    data_path: platform/data/workloads/issue-core/issue-core/issue-core-runtime
+    metadata_path: platform/metadata/workloads/issue-core/issue-core/issue-core-runtime
+    owner_repo: railiance-platform
+    fields: [ISSUE_CORE_API_KEY, GITEA_BACKEND_TOKEN]
+  - id: openrouter-llm-connect
+    data_path: platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
+    metadata_path: platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets
+    owner_repo: railiance-platform
+    fields: null
+  - id: railiance-backup-offsite-lane
+    data_path: platform/data/workloads/railiance/backup/offsite-lane
+    metadata_path: platform/metadata/workloads/railiance/backup/offsite-lane
+    owner_repo: railiance-platform
+    fields: null
+  - id: rapp-qonto-keycape-client
+    data_path: platform/data/workloads/rapp-qonto/keycape-client
+    metadata_path: platform/metadata/workloads/rapp-qonto/keycape-client
+    owner_repo: key-cape
+    fields: null
+  - id: reuse-surface-hub-write-token
+    data_path: platform/data/workloads/reuse/reuse-surface/runtime-secrets
+    metadata_path: platform/metadata/workloads/reuse/reuse-surface/runtime-secrets
+    owner_repo: railiance-platform
+    fields: [REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET]
+  - id: scaleway-bootstrap
+    data_path: platform/data/workloads/railiance/scaleway/bootstrap
+    metadata_path: platform/metadata/workloads/railiance/scaleway/bootstrap
+    owner_repo: railiance-platform
+    fields: null
+  - id: whynot-design-npm-publish
+    data_path: platform/data/workloads/coulomb/whynot-design/npm-publish
+    metadata_path: platform/metadata/workloads/coulomb/whynot-design/npm-publish
+    owner_repo: railiance-platform
+    fields: null