coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

feat: route Policy Nexus source credential

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 00:46:28 +02:00
parent 8f01eefb1e
commit 4fee839b11
6 changed files with 160 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

55
wiki/playbooks/policy-nexus-forgejo-source-read.md Normal file
View file

@ -0,0 +1,55 @@
# Policy Nexus Forgejo source-read token
Date: 2026-09-01
Catalog: `policy-nexus-forgejo-source-read` (status `active`, `resolvable: true`)
Owner: `railiance-platform` (OpenBao and credential lifecycle)
This lane carries the dedicated Forgejo PAT used by Policy Nexus Actions to
fetch exact archives from private owner repositories. The Forgejo identity is
restricted to organization-wide repository-code read and the PAT scope is
exactly `read:repository`. It has no repository write, package, organization
administration, instance administration, cluster, or deployment authority.
The authoritative lifecycle and evidence record is
`railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml`.
Warden is a governed conduit and never owns, persists, caches, or logs the PAT.
## Owner-confirmed lane
| Field | Value |
| --- | --- |
| OpenBao path | `platform/workloads/policy-nexus/forgejo-source-read` |
| Primary field | `FORGEJO_SOURCE_TOKEN` |
| Read policy | `workload-kv-read-policy-nexus-forgejo-source` |
| OIDC role | `policy-nexus-forgejo-source-workload-kv-read` |
| Forgejo identity | `policy-nexus-source` |
| Forgejo team | `policy-nexus-source-readers` |
| Actions consumer | `coulomb/policy-nexus` secret `FORGEJO_SOURCE_TOKEN` |
## Worker checklist
1. Authenticate as an approved operator through the exact OIDC role. Do not
substitute the Forgejo admin PAT or a broader OpenBao identity.
2. Confirm the route before use:
```bash
warden route show policy-nexus-forgejo-source-read --json | jq .resolvable
```
The result must be `true`, and the rendered fetch must contain no placeholder.
3. Agent callers must use a sanctioned high-risk transport. Pass the value only
to the bounded source-consuming child:
```bash
warden access policy-nexus-forgejo-source-read \
--field FORGEJO_SOURCE_TOKEN --exec -- <reviewed-source-read-command>
```
Do not use raw `--fetch`, place the value on argv, or write it to chat, Git,
State Hub, workflow logs, or a persistent temporary file.
4. For rotation or compromise, follow CCR-2026-0014. A replacement is not active
until its scope and negative permissions are verified and one exact-commit
Policy Nexus candidate workflow succeeds; revoke the predecessor afterward.