coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(mason): deliver and verify the forge read credential

Browse source 
Minted on a dedicated identity rather than a site admin. A PAT on
tegwick would have read every repository on the instance — wider than
the approved organisation-wide breadth and wider than the plan's stated
blast radius. Built as user state-hub-svc in team coulomb/state-hub-read
(read, all repositories, repo.code unit only), following the existing
issue-core-svc precedent. The ceiling is enforced by org membership, not
by a scope string, and clones are attributable to a named identity.

Delivered by warden desk --act paste_once_provision; ops-mason neither
minted nor pasted the value.

Verified: rapp-openbao, rapp-core-hub, rapp-issue-core and
rapp-policy-nexus all read — four of the nine that failed
STATE-WP-0083-T04. Push 403, admin API 403, /api/v1/user 403 (the scope
carries no read:user). Clone test used GIT_ASKPASS, so no credential
entered argv or a clone URL.

Records a deviation rather than glossing it: SCOPE.md puts secret values
out of scope, and that held for minting and delivery but not for
verification — the value was read back to fingerprint it and to run the
clone test, under the build-stage disclosure posture agreed 2026-08-27.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
This commit is contained in:
tegwick 2026-08-27 23:46:42 +02:00
parent 07681ff64d
commit 4c0ada21ca
2 changed files with 66 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/MASON-WP-0003-state-hub-forge-read-lane.md
View file

@ -149,12 +149,19 @@ live survey found `kubernetes/` auth enabled on this cluster — something §2's
disk-only survey could not see. No static `role_id`/`secret_id` is created, so
there is nothing to deliver or rotate.
ops-mason handled no secret value. The KV path does not exist yet and will not
until `paste_once_provision` writes the token; the policy grants read on it
either way. Two prerequisites remain before the lane carries traffic, both
outside this repo: ServiceAccount `state-hub/state-hub`
(`STATE-WP-0084-T02` — the role deliberately does not bind to `default`), and
the minted token.
**Credential delivered 2026-08-27.** Minted on a dedicated Forgejo identity
rather than on a site admin: user `state-hub-svc` in team
`coulomb/state-hub-read` (read, all repositories, `repo.code` unit only), PAT
scoped `read:repository`. Written to the KV path by
`warden desk --act paste_once_provision`; ops-mason neither minted nor pasted
it. Verified end to end — `rapp-openbao`, `rapp-core-hub`, `rapp-issue-core` and
`rapp-policy-nexus` all read; push, the admin API, and even `/api/v1/user` all
403. See `plans/state-hub-forge-derivation-read.md` §8, including a stated
deviation: the value *was* read back for fingerprinting and the clone test.
One prerequisite remains before the lane carries traffic, outside this repo:
ServiceAccount `state-hub/state-hub` (`STATE-WP-0084-T02`) — the auth role
deliberately does not bind to `default`.
## Register the lane in the routing catalog