From 4fee839b1138c60642bd6e0210cf8bf541333747 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 1 Sep 2026 00:46:28 +0200 Subject: [PATCH] feat: route Policy Nexus source credential Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663 --- registry/routing/catalog.yaml | 36 ++++++++++++ tests/test_routing.py | 26 +++++++++ tests/test_workload_join.py | 2 +- .../policy-nexus-forgejo-source-read.md | 55 +++++++++++++++++++ ...N-WP-0034-attended-login-openbao-output.md | 8 ++- ...-policy-nexus-forgejo-source-read-route.md | 36 ++++++++++++ 6 files changed, 160 insertions(+), 3 deletions(-) create mode 100644 wiki/playbooks/policy-nexus-forgejo-source-read.md create mode 100644 workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index 09f690e..7b91b40 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -242,6 +242,42 @@ entries: - "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish NPM_AUTH_TOKEN=@file` (value from a mode-0600 file)." - "Verify capabilities-safe, then confirm publish works via `secrets-engine exec --catalog whynot-design-npm-publish -- npm whoami` (value used, not printed)." + - id: policy-nexus-forgejo-source-read + title: Policy Nexus Forgejo private-source repository read token + # Read-only at Forgejo, but disclosure grants estate-wide private source access. + # Agent callers therefore remain inside Warden's sanctioned transport boundary. + risk: high + workload_ref: + applicability: applicable + unknown_reason: "policy-nexus-actions has not published an authoritative workload identity declaration." + need_keywords: [policy-nexus, policy, nexus, forgejo, private, source, repository, read, token, actions, FORGEJO_SOURCE_TOKEN] + owner_repo: railiance-platform + subsystem: OpenBao + Forgejo Actions + warden_executes: false + wiki_ref: wiki/playbooks/policy-nexus-forgejo-source-read.md#worker-checklist + canon_ref: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml + reviewed: "2026-09-01" + status: active + delegation: + mode: native + intended_owner: railiance-platform + reviewed: "2026-09-01" + verified: source-read + auth_method: "bao login -method=oidc -path=netkingdom role=policy-nexus-forgejo-source-workload-kv-read" + path_template: "platform/workloads/policy-nexus/forgejo-source-read" + fetch_command: "bao kv get -field=FORGEJO_SOURCE_TOKEN platform/workloads/policy-nexus/forgejo-source-read" + policy_ref: "flex-auth check secret.read:policy-nexus" + exec_capable: true + lane: secret + rotation: + method: rotate + owner: railiance-platform + automatable: false + steps: + - "Mint a replacement PAT for the restricted policy-nexus-source identity with scope exactly read:repository; retain the predecessor until verification passes." + - "Use the attended railiance-platform bootstrap to update OpenBao and the coulomb/policy-nexus FORGEJO_SOURCE_TOKEN Actions secret without exposing the value." + - "Pass one exact-commit candidate workflow, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0014." + - id: flex-auth-policy-check title: Authorization decision — may this actor perform this action # Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05). diff --git a/tests/test_routing.py b/tests/test_routing.py index f280dda..1e5d691 100644 --- a/tests/test_routing.py +++ b/tests/test_routing.py @@ -153,6 +153,32 @@ def test_whynot_design_npm_lane_is_concrete_and_resolvable(): assert "platform/workloads/coulomb/whynot-design/npm-publish" in e.fetch_command +def test_policy_nexus_source_read_lane_is_exact_high_risk_and_resolvable(): + catalog = load_catalog(_repo_catalog()) + entry = catalog.get("policy-nexus-forgejo-source-read") + assert entry is not None and entry.is_active and entry.exec_capable + assert entry.resolvable is True + assert entry.risk == "high" + assert entry.owner_repo == "railiance-platform" + assert entry.fetch_command == ( + "bao kv get -field=FORGEJO_SOURCE_TOKEN " + "platform/workloads/policy-nexus/forgejo-source-read" + ) + assert entry.path_template == "platform/workloads/policy-nexus/forgejo-source-read" + assert entry.auth_method.endswith( + "role=policy-nexus-forgejo-source-workload-kv-read" + ) + assert entry.delegation is not None and entry.delegation.mode == "native" + + +def test_route_find_policy_nexus_source_read_prefers_concrete_lane(): + catalog = load_catalog(_repo_catalog()) + matches = catalog.find( + "policy nexus Forgejo private source repository read token Actions", limit=1 + ) + assert matches[0].id == "policy-nexus-forgejo-source-read" + + def test_generic_and_template_lanes_not_resolvable(): catalog = load_catalog(_repo_catalog()) # generic openbao lane has /; login lane has . diff --git a/tests/test_workload_join.py b/tests/test_workload_join.py index dab4df8..d87e5dd 100644 --- a/tests/test_workload_join.py +++ b/tests/test_workload_join.py @@ -13,7 +13,7 @@ def test_repo_catalog_uses_only_explicit_workload_references(): report = build(ROOT / "registry/routing/catalog.yaml", Path.home()) assert report["ok"] is True assert len(report["resolved"]) == 3 - assert len(report["unknown"]) == 17 + assert len(report["unknown"]) == 18 # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are # provider/control-plane credentials, not workload delivery lanes. assert len(report["not_applicable"]) == 11 diff --git a/wiki/playbooks/policy-nexus-forgejo-source-read.md b/wiki/playbooks/policy-nexus-forgejo-source-read.md new file mode 100644 index 0000000..6e704c7 --- /dev/null +++ b/wiki/playbooks/policy-nexus-forgejo-source-read.md @@ -0,0 +1,55 @@ +# Policy Nexus Forgejo source-read token + +Date: 2026-09-01 +Catalog: `policy-nexus-forgejo-source-read` (status `active`, `resolvable: true`) +Owner: `railiance-platform` (OpenBao and credential lifecycle) + +This lane carries the dedicated Forgejo PAT used by Policy Nexus Actions to +fetch exact archives from private owner repositories. The Forgejo identity is +restricted to organization-wide repository-code read and the PAT scope is +exactly `read:repository`. It has no repository write, package, organization +administration, instance administration, cluster, or deployment authority. + +The authoritative lifecycle and evidence record is +`railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml`. +Warden is a governed conduit and never owns, persists, caches, or logs the PAT. + +## Owner-confirmed lane + +| Field | Value | +| --- | --- | +| OpenBao path | `platform/workloads/policy-nexus/forgejo-source-read` | +| Primary field | `FORGEJO_SOURCE_TOKEN` | +| Read policy | `workload-kv-read-policy-nexus-forgejo-source` | +| OIDC role | `policy-nexus-forgejo-source-workload-kv-read` | +| Forgejo identity | `policy-nexus-source` | +| Forgejo team | `policy-nexus-source-readers` | +| Actions consumer | `coulomb/policy-nexus` secret `FORGEJO_SOURCE_TOKEN` | + +## Worker checklist + +1. Authenticate as an approved operator through the exact OIDC role. Do not + substitute the Forgejo admin PAT or a broader OpenBao identity. + +2. Confirm the route before use: + + ```bash + warden route show policy-nexus-forgejo-source-read --json | jq .resolvable + ``` + + The result must be `true`, and the rendered fetch must contain no placeholder. + +3. Agent callers must use a sanctioned high-risk transport. Pass the value only + to the bounded source-consuming child: + + ```bash + warden access policy-nexus-forgejo-source-read \ + --field FORGEJO_SOURCE_TOKEN --exec -- + ``` + + Do not use raw `--fetch`, place the value on argv, or write it to chat, Git, + State Hub, workflow logs, or a persistent temporary file. + +4. For rotation or compromise, follow CCR-2026-0014. A replacement is not active + until its scope and negative permissions are verified and one exact-commit + Policy Nexus candidate workflow succeeds; revoke the predecessor afterward. diff --git a/workplans/WARDEN-WP-0034-attended-login-openbao-output.md b/workplans/WARDEN-WP-0034-attended-login-openbao-output.md index 0b616b8..8dee644 100644 --- a/workplans/WARDEN-WP-0034-attended-login-openbao-output.md +++ b/workplans/WARDEN-WP-0034-attended-login-openbao-output.md @@ -4,7 +4,7 @@ type: workplan title: "Accept contained OpenBao login output only after helper persistence" domain: infotech repo: ops-warden -status: active +status: finished owner: codex topic_slug: attended-login-openbao-output created: "2026-09-01" @@ -28,9 +28,13 @@ failure. ```task id: WARDEN-WP-0034-T02 -status: progress +status: done priority: high ``` Run the proxy regression suite, reinstall the CLI, and complete one governed OpenBao platform-admin operation with deterministic self-revocation. + +Completed 2026-09-01. The installed CLI completed the governed Policy Nexus +Forgejo source bootstrap with all child output contained, then revoked and +removed its isolated helper session. diff --git a/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md b/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md new file mode 100644 index 0000000..79e4e0d --- /dev/null +++ b/workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md @@ -0,0 +1,36 @@ +--- +id: WARDEN-WP-0035 +type: workplan +title: "Register the Policy Nexus Forgejo source-read route" +domain: infotech +repo: ops-warden +status: active +owner: codex +topic_slug: policy-nexus-forgejo-source-read +created: "2026-09-01" +updated: "2026-09-01" +--- + +## Register the exact high-risk lane + +```task +id: WARDEN-WP-0035-T01 +status: done +priority: high +``` + +Add the exact OpenBao path, field, OIDC role, owner pointer, and rotation +boundary from railiance-platform CCR-2026-0014. The entry must be concrete and +resolvable while remaining subject to Warden's high-risk agent read boundary. + +## Verify routing and governed use + +```task +id: WARDEN-WP-0035-T02 +status: progress +priority: high +``` + +Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove +the installed route resolves and can hand the value only to a sanctioned child +transport without printing or persisting it.