feat(routing): propose state-hub-forge-derivation-read lane (draft)

warden route find "state hub read private repository" returned nothing,
which is why the need had to be reasoned out from first principles
instead of looked up.

Pointer-only (warden_executes: false): ops-mason builds the AppRole,
policy, and KV path under MASON-WP-0003; the forge owner mints the
value; paste_once_provision delivers it. ops-warden routes and executes
nothing.

Graded high on breadth, not on write authority — the token is read-only
but organisation-wide, so a leak reads every private repository.
Approved at that breadth 2026-08-26 (ops-mason plan §6).

status: draft until MASON-WP-0003-T02 has created the structure and the
negative capability check passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166

registry/routing/catalog.yaml

@@ -574,6 +574,44 @@ entries:
         - "Verify capabilities-safe on the data path (`bao token capabilities`); run a restore drill against a re-encrypted artifact."
         - "After rotation, clear EXPOSED taint: remove custom_metadata exposed_at/exposed_version (see `warden taint railiance-backup-offsite-lane`)."
 
+  - id: state-hub-forge-derivation-read
+    title: Forgejo read-only token for State Hub projection derivation
+    # Organisation-wide repository read: if the value leaks, every private
+    # repository is readable. Read-only, no write, no admin, no persistence —
+    # but the breadth is the grade (approved knowingly 2026-08-26).
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "The state-hub deployment has no authoritative workload identity declaration yet; the AppRole is the identity until it does."
+    need_keywords: [state-hub, statehub, forge, forgejo, derivation, derive, projection, private, repository, clone, FORGE_READ_TOKEN, ADR-012, work-records, unreadable]
+    owner_repo: ops-mason
+    subsystem: OpenBao + Forgejo
+    warden_executes: false
+    wiki_ref: wiki/playbooks/state-hub-forge-derivation-read.md#worker-checklist
+    canon_ref: ops-mason/plans/state-hub-forge-derivation-read.md
+    reviewed: "2026-08-26"
+    status: draft
+    delegation:
+      mode: native
+      intended_owner: ops-mason
+      blocked_on: "Entry proposed ahead of the build (MASON-WP-0003-T03). Promote to active once MASON-WP-0003-T02 has created the policy, AppRole, and KV path and the negative capability check passes."
+      reviewed: "2026-08-26"
+      verified: unverified
+    # ops-warden routes this and executes nothing: it issues SSH certificates
+    # only and owns no secret store. ops-mason builds the structure; the forge
+    # owner mints the value; paste_once_provision delivers it.
+    auth_method: "AppRole login (state-hub-forge-derivation) from the in-cluster state-hub workload"
+    path_template: "platform/workloads/state-hub/forge-derivation (field FORGE_READ_TOKEN)"
+    rotation:
+      method: rotate
+      owner: ops-mason
+      automatable: false
+      steps:
+        - "Mint a replacement read-only token in Forgejo — repository read, organisation-wide, no other scope."
+        - "Deliver it to platform/workloads/state-hub/forge-derivation, field FORGE_READ_TOKEN, via paste_once_provision. ops-mason does not handle the value."
+        - "Revoke the previous token in Forgejo."
+        - "Confirm a derivation pass still reads a known private repository; rotation must not require a chart change or a redeploy."
+
   - id: forgejo-admin-api-token
     title: Forgejo operator/admin API token (PAT)
     need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, forgejo-npm]