From 171efa83fe58d82437bb17041dba0728aa559be0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 13 Jul 2026 01:47:52 +0200 Subject: [PATCH] Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04) PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin under field API_TOKEN (re-stored from initial Token field to match CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true). - catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13 - playbook: header active/resolvable, drop post-promotion caveat - workplan: T04 done Co-Authored-By: Claude Opus 4.8 --- registry/routing/catalog.yaml | 14 +++++++++++--- wiki/playbooks/forgejo-admin-api-token.md | 6 +++--- .../WARDEN-WP-0025-forgejo-admin-api-token-lane.md | 14 +++++++++----- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index 07ff46f..ca863b9 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -287,9 +287,17 @@ entries: warden_executes: false wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist canon_ref: railiance-platform/docs/workload-kv-access-lanes.md - reviewed: "2026-07-12" - status: draft - # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval. + reviewed: "2026-07-13" + status: active + resolvable: true + # CCR-2026-0006: approved by platform-operator 2026-07-12; policy + # workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read live on + # bao.coulomb.social; PAT attended-minted and stored under field API_TOKEN at + # platform/workloads/forgejo/forgejo-admin (v-latest). Verified 2026-07-13: documented + # fetch_command returns non-empty, PAT valid against forgejo.coulomb.social + # (/api/v1/user -> login=tegwick, is_admin=true); negative default-policy denial + # recorded on CCR. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is + # workstation/worker OIDC fetch only, no cluster ExternalSecret. auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)" path_template: "platform/workloads/forgejo/forgejo-admin" fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin" diff --git a/wiki/playbooks/forgejo-admin-api-token.md b/wiki/playbooks/forgejo-admin-api-token.md index daddf1f..01d4f9c 100644 --- a/wiki/playbooks/forgejo-admin-api-token.md +++ b/wiki/playbooks/forgejo-admin-api-token.md @@ -1,7 +1,7 @@ # Forgejo Admin API Token (PAT) -Date: 2026-07-12 -Catalog: `forgejo-admin-api-token` (status `draft`, `resolvable: false` until verified) +Date: 2026-07-12 (verified 2026-07-13) +Catalog: `forgejo-admin-api-token` (status `active`, `resolvable: true`) Owner: `railiance-platform` (CCR-2026-0006) Forgejo site-admin personal access token for operator and automation tooling. @@ -45,7 +45,7 @@ worker fetch only — no cluster ExternalSecret delivery. ) ``` -3. **Or proxy via warden access** (after catalog promotion): +3. **Or proxy via warden access** (catalog lane is `active`): ```bash warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN diff --git a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md index 0de3dc0..9a95c00 100644 --- a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md +++ b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md @@ -74,16 +74,20 @@ state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502" ```task id: WARDEN-WP-0025-T04 -status: progress +status: done priority: high state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd" ``` -- [ ] Mint PAT as Forgejo user `tegwick` (attended) -- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin` -- [ ] Positive fetch after OIDC login +- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12) +- [x] Stored at `platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN` + (initial provision used field `Token`; re-stored as `API_TOKEN` 2026-07-13 to + match CCR/catalog/playbook `fetch_command`) +- [x] Positive fetch verified 2026-07-13 — `bao kv get -field=API_TOKEN …` returns + non-empty; PAT valid against `forgejo.coulomb.social` (`/api/v1/user` → + `login=tegwick`, `is_admin=true`) - [x] Negative default-policy denial recorded on CCR -- [ ] Promote catalog to `active` after positive verify +- [x] Promoted catalog `forgejo-admin-api-token` to `active` (`resolvable: true`) ### T5 — Notify downstream consumers