coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish ACTIVITY-WP-0023: ESO FORGEJO_TOKEN and gap dispositions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 7s
Details

Browse source 
Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token
bootstrap so weekly prune credentials refresh without bootstrap inject.
Disposition issue-core path A and MarkiTect ROS as external owners;
close workplan finished.
This commit is contained in:
tegwick 2026-07-21 23:19:10 +02:00
parent d36adb0822
commit 21d46927f6
7 changed files with 147 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

50
workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Intent–scope gap closure and WP-0020/0021 operational follow-ups"
domain: infotech
repo: activity-core
status: active
status: finished
owner: codex
topic_slug: activity-core
created: "2026-07-21"
@ -144,7 +144,7 @@ runbook links it from the prune section.
```task
id: ACTIVITY-WP-0023-T05
status: todo
status: done
priority: medium
state_hub_task_id: "bf21fa27-a872-44a6-a87b-1fe69018d090"
```
@ -158,11 +158,19 @@ state_hub_task_id: "bf21fa27-a872-44a6-a87b-1fe69018d090"
**Done when:** ExternalSecret Ready=True and worker restarts still see a
working token without manual patch.
**Done 2026-07-21:**
- `scripts/openbao-eso-token-apply.sh` attaches
`workload-kv-read-issue-core-runtime` + `workload-kv-read-forgejo-admin`.
- ExternalSecret `actcore-forgejo-admin` → `FORGEJO_TOKEN` (API_TOKEN from
`platform/workloads/forgejo/forgejo-admin`); Ready=SecretSynced.
- Worker rollout after ESO merge: `FORGEJO_TOKEN_len=40`, Forgejo
`GET /api/v1/user` ok.
## Task: issue-core path A (optional rest sink)
```task
id: ACTIVITY-WP-0023-T06
status: todo
status: done
priority: low
state_hub_task_id: "7232d5a3-c7a8-4fdf-aaef-5daab0ea92b1"
```
@ -178,11 +186,17 @@ Non-blocking follow-up from ACTIVITY-WP-0021.
**Done when:** documented smoke 201 for one opt-in definition, or explicit
wontfix with issue-core owning the backend fix only.
**Done 2026-07-21 (external disposition):** reconfirmed from actcore-worker
`POST /issues/` → **503** forgejo-inbox. Global default remains **`state-hub`**
(WP-0022). Path A backend token is **issue-core-owned**; activity-core will not
flip rest until issue-core proves 201. Documented in
`docs/issue-core-emission-boundary.md`.
## Task: ROS MarkiTect completeness
```task
id: ACTIVITY-WP-0023-T07
status: todo
status: done
priority: medium
state_hub_task_id: "eeb4beb9-8184-4ae3-95cd-d27dc88e7973"
```
@ -197,6 +211,13 @@ state_hub_task_id: "eeb4beb9-8184-4ae3-95cd-d27dc88e7973"
**Done when:** one clean ROS hourly context snapshot without missing-template
or MarkiTect-missing errors for configured domains.
**Done 2026-07-21 (external disposition):** activity-core side complete
(template mount from WP-0021). Live state-hub image
`forgejo.coulomb.social/coulomb/state-hub:main-d8808bf` has **no**
`markitect_tool` module. Clean ROS digests require a **state-hub** image
roll that ships MarkiTect / `STATE_HUB_MARKITECT_CLI_PATH`. Owner: state-hub;
message filed. SCOPE G6 notes residual external.
## Task: Retire or quarantine TaskExecutorWorkflow
```task
@ -248,12 +269,12 @@ guessing hub topology.
## Success criteria
- [ ] G1 closed via WP-0022 + T01 doc alignment
- [ ] G2 has a proven Binky executor path or explicit external workplan
- [ ] G3 apply-without-protection is impossible
- [ ] G6–G8 operational follow-ups shipped or scheduled with owners
- [ ] G5/G9/G10 dispositioned
- [ ] `SCOPE.md` re-checked after close; no stale “rest default / WP-0006 gate”
- [x] G1 closed via WP-0022 + T01 doc alignment
- [x] G2 has a proven Binky executor path or explicit external workplan
- [x] G3 apply-without-protection is impossible
- [x] G6–G8 operational follow-ups shipped or scheduled with owners
- [x] G5/G9/G10 dispositioned
- [x] `SCOPE.md` re-checked after close; no stale “rest default / WP-0006 gate”
language
## References
@ -272,9 +293,12 @@ guessing hub topology.
| T02 | done | Consumer contract doc; Binky completion path documented (harness external) |
| T03 | done | apply=true hard-fails without non-empty live_images_file |
| T04 | done | `scripts/refresh_live_images.sh` + make target |
| T05 | todo | OpenBao ESO policy still 403 on forgejo-admin |
| T06 | todo | issue-core GITEA_BACKEND_TOKEN rotation (external) |
| T07 | todo | MarkiTect in state-hub image (external) |
| T05 | done | ESO `actcore-forgejo-admin` SecretSynced; worker restart keeps FORGEJO_TOKEN |
| T06 | done | Disposition: issue-core owns GITEA_BACKEND_TOKEN; rest stays opt-in; 503 reconfirmed |
| T07 | done | Disposition: state-hub image needs MarkiTect; templates already mounted |
| T08 | done | TaskExecutor stub disabled by default |
| T09 | done | review_required documented as metadata-only |
| T10 | done | Edge vs workstation evidence in runbook |
**Closeout 2026-07-21:** all tasks done; workplan `finished`. Residual external:
issue-core path A token, state-hub MarkiTect image.