CUST-WP-0075: catalog entry core-hub-forgejo-source-read (CCR-2026-0031)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

registry/routing/catalog.yaml

@@ -390,6 +390,45 @@ entries:
         - "Use the attended railiance-platform bootstrap to update OpenBao and the coulomb/policy-nexus FORGEJO_SOURCE_TOKEN Actions secret without exposing the value."
         - "Pass one exact-commit candidate workflow, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0014."
 
+  - id: core-hub-forgejo-source-read
+    title: Core Hub repo-manager publisher Forgejo private-source repository read token
+    # Read-only at Forgejo, but disclosure grants estate-wide private source read for
+    # org coulomb. ESO is the only consumer (CCR-2026-0031): no operator fetch lane,
+    # so exec_capable stays false and Warden never proxies a read of this value.
+    risk: high
+    workload_ref:
+      applicability: applicable
+      rapp_id: rapp-core-hub
+      name: core-hub
+      deployable: repository-classification-publisher
+    fields: [FORGEJO_SOURCE_TOKEN, API_USER, API_BASE_URL, TOKEN_SCOPES, GENERATED_AT]   # CCR-2026-0031
+    need_keywords: [core-hub, core, hub, repo-manager, publisher, forgejo, private, source, repository, read, token, eso, external-secrets, FORGEJO_SOURCE_TOKEN]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + External Secrets + Forgejo
+    warden_executes: false
+    wiki_ref: wiki/playbooks/core-hub-forgejo-source-read.md#worker-checklist
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml
+    reviewed: "2026-10-03"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-10-03"
+      verified: source-read
+    auth_method: "Kubernetes auth (mount kubernetes) role=external-secrets-core-hub-forgejo-source, bound to external-secrets/external-secrets; ESO delivery only (ClusterSecretStore openbao-core-hub-forgejo-source → ExternalSecret core-hub/repo-manager-forgejo-source)"
+    path_template: "platform/workloads/core-hub/forgejo-source-read"
+    policy_ref: "workload-kv-read-core-hub-forgejo-source"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Every 180 days or on owner change: mint a replacement PAT for the restricted core-hub-source identity with scope exactly read:repository; retain the predecessor until verification passes."
+        - "Write the replacement to platform/workloads/core-hub/forgejo-source-read from stdin through the attended railiance-platform bootstrap, then let ESO refresh core-hub/repo-manager-forgejo-source (5m)."
+        - "Pass make verify-publisher in rapp-core-hub, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0031."
+
   - id: flex-auth-policy-check
     title: Authorization decision — may this actor perform this action
     # Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05).