Finish coding-agent high-risk boundary coverage

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Close agent high-risk OpenBao boundary coverage"
 domain: financials
 repo: railiance-platform
-status: blocked
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-21"
-updated: "2026-08-21"
+updated: "2026-08-22"
 related:
   - WARDEN-WP-0032
   - RISK-F-0009
@@ -43,9 +43,11 @@ priority: high
 state_hub_task_id: "44d1a4bf-70bb-4d50-a40a-2158acc96b36"
 ```
 
-Run the capabilities-only ops-warden audit against the policy. The 2026-08-21
-reconciliation found 17 high-risk lanes: six covered, six concrete uncovered,
-and five without a concrete KV address. No credential value was read.
+Run the capabilities-only ops-warden audit against the policy. The initial
+2026-08-21 reconciliation found 17 high-risk lanes: six covered, six concrete
+uncovered, and five without a concrete KV address. The final generated input
+contains 19 high-risk lanes, 14 concrete entries, and five without an address.
+No credential value was read.
 
 ## T02 — Close the concrete deny gaps
 
@@ -61,9 +63,10 @@ rapp-qonto Keycape client, agent-harness Forgejo deploy key, audit-core senders,
 email-connect transactional, and Scaleway bootstrap. Add regression coverage
 for every concrete path currently emitted by the catalog audit.
 
-Completed 2026-08-21. The source policy covers all 12 unique concrete paths
-(including the Core Hub path, which has no catalog lane), and the local
-catalog audit reports all 12 catalog entries covered with none uncovered.
+Completed 2026-08-22. After ops-warden corrected two multi-field grades, the
+source policy covers all 13 unique concrete catalog paths plus the additional
+reviewed Core Hub path. The generated-input check reports all 14 concrete
+catalog entries covered with none uncovered.
 
 ## T03 — Apply and verify live
 
@@ -79,13 +82,11 @@ and rerun the catalog audit with `policy_source: server`. Inspect policy/token
 role metadata to determine whether an agent identity carries the boundary and
 whether any role combines it with a workload-read policy. Do not mint a token.
 
-Completed 2026-08-21 under attended `platform-admin` OIDC. OpenBao accepted the
-policy; normalized readback matched source, and the server-backed catalog audit
-reported 17 high-risk lanes, 12 covered entries, zero uncovered, and five
-pattern/non-KV lanes without a concrete address. Metadata-only inspection of
-all discoverable netkingdom, Kubernetes, AppRole, and token roles found zero
-attachments of `agent-high-risk-boundary` and therefore zero roles combining
-it with a workload-read policy. No token was minted and no Secret was read.
+Completed initially on 2026-08-21 and reconciled again on 2026-08-22 under
+attended `platform-admin` OIDC. OpenBao accepted the policy; normalized
+readback matched source, and the final server-backed audit reported 19
+high-risk lanes, 14 covered entries, zero uncovered, and five pattern/non-KV
+lanes without a concrete address. No Secret value was read.
 
 ## T04 — Route the result
 
@@ -105,11 +106,15 @@ Completed 2026-08-21 via State Hub message
 attachment finding, the distinct-agent-identity blocker, and the requested
 versioned generated artifact shape.
 
+Ops-warden delivered revision `55f0f47a021375b8b25c924953d1b49a24e002c5`
+on 2026-08-21. The platform now vendors it as a checked policy input and has a
+repeatable upstream-equality plus policy-coverage command.
+
 ## T05 — Establish a distinct coding-agent identity
 
 ```task
 id: RAILIANCE-WP-0022-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "47aa5ed9-95c5-4a23-a460-e4bbd3ed6f65"
 ```
@@ -119,12 +124,40 @@ The policy is live but no role attaches it. Do not add the boundary to
 recovery work may require the protected values. The identity owner must define
 a distinct coding-agent issuance path, attach this boundary there, and prove
 deny-wins behavior when combined with an otherwise readable workload policy.
-This is blocked on an identity-owner decision and is not invented here.
+Completed 2026-08-22. State Hub decision
+`f0955252-7b20-4c80-86e9-f8080ec60793` establishes the platform-owned AppRole
+`coding-agent-railiance-platform` as the operational machine identity. Its
+single-use SecretIDs expire after five minutes; its tokens last at most 15
+minutes, have eight uses, omit the default policy, and attach both
+`agent-high-risk-boundary` and the otherwise-readable issue-core workload
+policy. A live ephemeral login proved data capabilities resolve to `deny` and
+metadata to `read`; the token was revoked without reading the KV value.
+
+The exact-bound KeyCape JWT role is also live as the issuer-backed migration
+target. KeyCape principal registration remains an identity hardening follow-up,
+not a blocker to the active AppRole boundary.
+
+## T06 — Consume the generated catalog artifact
+
+```task
+id: RAILIANCE-WP-0022-T06
+status: done
+priority: high
+```
+
+Consume ops-warden's versioned `high-risk-data-paths.yaml` as a policy-check
+input, add the two newly regraded issue-core and reuse-surface paths, and rerun
+source plus live coverage. The input remains ops-warden's risk statement, not
+the policy authority; railiance-platform continues to own every deny decision.
+
+Completed 2026-08-22. The vendored input matches the clean upstream artifact,
+the repository check covers all 14 entries, and the server-backed audit reports
+zero uncovered. Evidence: `docs/evidence/agent-high-risk-boundary-2026-08-21.md`.
 
 ## Acceptance
 
 - [x] Every concrete high-risk catalog path is denied in the source policy.
 - [x] The live policy matches source and the server-backed audit passes.
-- [x] Agent boundary attachment is established from metadata (currently zero).
+- [x] A distinct AppRole attachment is established from live metadata.
 - [x] Result and generated-artifact follow-up are routed to ops-warden.
-- [ ] A distinct coding-agent identity actually attaches the boundary.
+- [x] A distinct coding-agent identity actually attaches the boundary.