# Draft pointer for ops-warden. Not installed. Not activated.
# MASON-WP-0013-T04. warden_executes is false. Do not copy this file into
# the ops-warden catalog until ops-warden reviews it.
id: reuse-surface-forgejo-source-read
title: Reuse-surface exact seven private repository reader
status: draft
owner_repo: railiance-platform
subsystem: OpenBao KV via existing reuse-surface ESO identity
warden_executes: false
risk: high
need_keywords:
  - reuse-surface
  - forgejo
  - forgejo-source-read
  - private-reader
path_template: platform/workloads/reuse/reuse-surface/forgejo-source-read
policy_ref: workload-kv-read-reuse-surface-runtime-eso
auth_method: Kubernetes auth role reuse-surface-runtime-eso, ServiceAccount reuse/reuse-surface-eso, audience openbao
canon_ref: CCR-2026-0046
reviewed: "2026-10-22"
activation: not-activated
notes: >
  Proposal only. The field name is FORGEJO_SOURCE_TOKEN. This file stores
  no value. Runtime rotation remains RPF-WP-0058-T05.