feat: route Policy Nexus source credential

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

registry/routing/catalog.yaml

@@ -242,6 +242,42 @@ entries:
         - "Write it back: `bao kv put platform/workloads/coulomb/whynot-design/npm-publish NPM_AUTH_TOKEN=@file` (value from a mode-0600 file)."
         - "Verify capabilities-safe, then confirm publish works via `secrets-engine exec --catalog whynot-design-npm-publish -- npm whoami` (value used, not printed)."
 
+  - id: policy-nexus-forgejo-source-read
+    title: Policy Nexus Forgejo private-source repository read token
+    # Read-only at Forgejo, but disclosure grants estate-wide private source access.
+    # Agent callers therefore remain inside Warden's sanctioned transport boundary.
+    risk: high
+    workload_ref:
+      applicability: applicable
+      unknown_reason: "policy-nexus-actions has not published an authoritative workload identity declaration."
+    need_keywords: [policy-nexus, policy, nexus, forgejo, private, source, repository, read, token, actions, FORGEJO_SOURCE_TOKEN]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Forgejo Actions
+    warden_executes: false
+    wiki_ref: wiki/playbooks/policy-nexus-forgejo-source-read.md#worker-checklist
+    canon_ref: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
+    reviewed: "2026-09-01"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-09-01"
+      verified: source-read
+    auth_method: "bao login -method=oidc -path=netkingdom role=policy-nexus-forgejo-source-workload-kv-read"
+    path_template: "platform/workloads/policy-nexus/forgejo-source-read"
+    fetch_command: "bao kv get -field=FORGEJO_SOURCE_TOKEN platform/workloads/policy-nexus/forgejo-source-read"
+    policy_ref: "flex-auth check secret.read:policy-nexus"
+    exec_capable: true
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Mint a replacement PAT for the restricted policy-nexus-source identity with scope exactly read:repository; retain the predecessor until verification passes."
+        - "Use the attended railiance-platform bootstrap to update OpenBao and the coulomb/policy-nexus FORGEJO_SOURCE_TOKEN Actions secret without exposing the value."
+        - "Pass one exact-commit candidate workflow, then revoke the predecessor PAT and record bounded non-secret evidence in CCR-2026-0014."
+
   - id: flex-auth-policy-check
     title: Authorization decision — may this actor perform this action
     # Returns an authorization decision; no credential flows (WARDEN-WP-0032-T05).

tests/test_routing.py

@@ -153,6 +153,32 @@ def test_whynot_design_npm_lane_is_concrete_and_resolvable():
     assert "platform/workloads/coulomb/whynot-design/npm-publish" in e.fetch_command
 
 
+def test_policy_nexus_source_read_lane_is_exact_high_risk_and_resolvable():
+    catalog = load_catalog(_repo_catalog())
+    entry = catalog.get("policy-nexus-forgejo-source-read")
+    assert entry is not None and entry.is_active and entry.exec_capable
+    assert entry.resolvable is True
+    assert entry.risk == "high"
+    assert entry.owner_repo == "railiance-platform"
+    assert entry.fetch_command == (
+        "bao kv get -field=FORGEJO_SOURCE_TOKEN "
+        "platform/workloads/policy-nexus/forgejo-source-read"
+    )
+    assert entry.path_template == "platform/workloads/policy-nexus/forgejo-source-read"
+    assert entry.auth_method.endswith(
+        "role=policy-nexus-forgejo-source-workload-kv-read"
+    )
+    assert entry.delegation is not None and entry.delegation.mode == "native"
+
+
+def test_route_find_policy_nexus_source_read_prefers_concrete_lane():
+    catalog = load_catalog(_repo_catalog())
+    matches = catalog.find(
+        "policy nexus Forgejo private source repository read token Actions", limit=1
+    )
+    assert matches[0].id == "policy-nexus-forgejo-source-read"
+
+
 def test_generic_and_template_lanes_not_resolvable():
     catalog = load_catalog(_repo_catalog())
     # generic openbao lane has <FIELD>/<path_template>; login lane has <domain>.

tests/test_workload_join.py

@@ -13,7 +13,7 @@ def test_repo_catalog_uses_only_explicit_workload_references():
     report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
     assert report["ok"] is True
     assert len(report["resolved"]) == 3
-    assert len(report["unknown"]) == 17
+    assert len(report["unknown"]) == 18
     # 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are
     # provider/control-plane credentials, not workload delivery lanes.
     assert len(report["not_applicable"]) == 11

wiki/playbooks/policy-nexus-forgejo-source-read.md

@@ -0,0 +1,55 @@
+# Policy Nexus Forgejo source-read token
+
+Date: 2026-09-01
+Catalog: `policy-nexus-forgejo-source-read` (status `active`, `resolvable: true`)
+Owner: `railiance-platform` (OpenBao and credential lifecycle)
+
+This lane carries the dedicated Forgejo PAT used by Policy Nexus Actions to
+fetch exact archives from private owner repositories. The Forgejo identity is
+restricted to organization-wide repository-code read and the PAT scope is
+exactly `read:repository`. It has no repository write, package, organization
+administration, instance administration, cluster, or deployment authority.
+
+The authoritative lifecycle and evidence record is
+`railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml`.
+Warden is a governed conduit and never owns, persists, caches, or logs the PAT.
+
+## Owner-confirmed lane
+
+| Field | Value |
+| --- | --- |
+| OpenBao path | `platform/workloads/policy-nexus/forgejo-source-read` |
+| Primary field | `FORGEJO_SOURCE_TOKEN` |
+| Read policy | `workload-kv-read-policy-nexus-forgejo-source` |
+| OIDC role | `policy-nexus-forgejo-source-workload-kv-read` |
+| Forgejo identity | `policy-nexus-source` |
+| Forgejo team | `policy-nexus-source-readers` |
+| Actions consumer | `coulomb/policy-nexus` secret `FORGEJO_SOURCE_TOKEN` |
+
+## Worker checklist
+
+1. Authenticate as an approved operator through the exact OIDC role. Do not
+   substitute the Forgejo admin PAT or a broader OpenBao identity.
+
+2. Confirm the route before use:
+
+   ```bash
+   warden route show policy-nexus-forgejo-source-read --json | jq .resolvable
+   ```
+
+   The result must be `true`, and the rendered fetch must contain no placeholder.
+
+3. Agent callers must use a sanctioned high-risk transport. Pass the value only
+   to the bounded source-consuming child:
+
+   ```bash
+   warden access policy-nexus-forgejo-source-read \
+     --field FORGEJO_SOURCE_TOKEN --exec -- <reviewed-source-read-command>
+   ```
+
+   Do not use raw `--fetch`, place the value on argv, or write it to chat, Git,
+   State Hub, workflow logs, or a persistent temporary file.
+
+4. For rotation or compromise, follow CCR-2026-0014. A replacement is not active
+   until its scope and negative permissions are verified and one exact-commit
+   Policy Nexus candidate workflow succeeds; revoke the predecessor afterward.

workplans/WARDEN-WP-0034-attended-login-openbao-output.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Accept contained OpenBao login output only after helper persistence"
 domain: infotech
 repo: ops-warden
-status: active
+status: finished
 owner: codex
 topic_slug: attended-login-openbao-output
 created: "2026-09-01"
@@ -28,9 +28,13 @@ failure.
 
 ```task
 id: WARDEN-WP-0034-T02
-status: progress
+status: done
 priority: high
 ```
 
 Run the proxy regression suite, reinstall the CLI, and complete one governed
 OpenBao platform-admin operation with deterministic self-revocation.
+
+Completed 2026-09-01. The installed CLI completed the governed Policy Nexus
+Forgejo source bootstrap with all child output contained, then revoked and
+removed its isolated helper session.

workplans/WARDEN-WP-0035-policy-nexus-forgejo-source-read-route.md

@@ -0,0 +1,36 @@
+---
+id: WARDEN-WP-0035
+type: workplan
+title: "Register the Policy Nexus Forgejo source-read route"
+domain: infotech
+repo: ops-warden
+status: active
+owner: codex
+topic_slug: policy-nexus-forgejo-source-read
+created: "2026-09-01"
+updated: "2026-09-01"
+---
+
+## Register the exact high-risk lane
+
+```task
+id: WARDEN-WP-0035-T01
+status: done
+priority: high
+```
+
+Add the exact OpenBao path, field, OIDC role, owner pointer, and rotation
+boundary from railiance-platform CCR-2026-0014. The entry must be concrete and
+resolvable while remaining subject to Warden's high-risk agent read boundary.
+
+## Verify routing and governed use
+
+```task
+id: WARDEN-WP-0035-T02
+status: progress
+priority: high
+```
+
+Pass catalog, route-selection, proxy, and policy tests; reinstall the CLI; prove
+the installed route resolves and can hand the value only to a sanctioned child
+transport without printing or persisting it.