feat(catalog): agent-harness forgejo deploy + binky mail AppRole lanes

Register agent-harness-forgejo-deploy and agent-harness-binky-mail-approle
with playbook pointers; provisioned 2026-07-17 (metadata only).

registry/routing/catalog.yaml

@@ -421,6 +421,65 @@ entries:
         - "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/."
         - "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation."
 
+  - id: agent-harness-forgejo-deploy
+    title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
+    need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Forgejo + agent-harness
+    warden_executes: false
+    wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
+    canon_ref: binky-control/integrations/executor-worker-secrets.md
+    reviewed: "2026-07-17"
+    status: active
+    risk: high
+    # Provisioned 2026-07-17 on railiance01: ed25519 keypair on host, OpenBao copy at
+    # platform/workloads/agent-harness/forgejo-deploy-key, write deploy key on
+    # coulomb/executor-sandbox (title agent-harness-railiance01). Git push verified.
+    auth_method: "caller's own OpenBao token (policy workload-kv-read-agent-harness-forgejo) or host-local key at ~/.local/agent-harness/ssh/forgejo-deploy"
+    path_template: "platform/workloads/agent-harness/forgejo-deploy-key"
+    fetch_command: "bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key"
+    policy_ref: "flex-auth check secret.read:agent-harness-forgejo"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: re-establish
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/ (mode 600); do not paste the private key into chat or Git."
+        - "`bao kv put platform/workloads/agent-harness/forgejo-deploy-key SSH_PRIVATE_KEY=@file SSH_PUBLIC_KEY=@file` then register the public key as a write deploy key on coulomb/executor-sandbox (and binky-control at cutover); remove the old deploy key."
+        - "Verify `ssh -p 30022 -i <key> -T git@forgejo.coulomb.social` authenticates as the deploy key; test push to executor-sandbox only."
+
+  - id: agent-harness-binky-mail-approle
+    title: agent-harness AppRole for non-interactive Binky company-email IMAP read
+    need_keywords: [agent-harness, approle, binky, mail, imap, EXECUTOR_APPROLE_DIR, unattended]
+    owner_repo: railiance-platform
+    subsystem: OpenBao AppRole + agent-harness + email-connect
+    warden_executes: false
+    wiki_ref: wiki/playbooks/agent-harness-secrets.md#lane-3-mail-approle
+    canon_ref: binky-control/integrations/executor-worker-secrets.md
+    reviewed: "2026-07-17"
+    status: active
+    risk: high
+    # Provisioned 2026-07-17: role agent-harness-binky-mail bound to existing policy
+    # workload-kv-read-binky-company-email-imap; role_id/secret_id delivered to
+    # railiance01 ~/.local/agent-harness/approle-binky-mail (0600). Positive IMAP field
+    # lengths verified; negative forgejo-admin deny verified. token_ttl=15m max=30m
+    # token_num_uses=8. Human OIDC role unchanged.
+    auth_method: "AppRole login role=agent-harness-binky-mail (role_id+secret_id on worker host via EXECUTOR_APPROLE_DIR)"
+    path_template: "tenants/binky/company-email/imap"
+    fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID  # then bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "bao write -f auth/approle/role/agent-harness-binky-mail/secret-id → new secret_id; deliver mode-0600 to railiance01 EXECUTOR_APPROLE_DIR; shred old secret_id file."
+        - "Optionally re-mint IMAP password (see binky-company-email-imap) if the mailbox credential itself rotated."
+        - "Verify AppRole login + field presence (lengths only); confirm default/other policies still deny sibling paths."
+
   # --- draft: owner path not yet shipped; hidden from default lookup ---
 
   - id: object-storage-sts

wiki/playbooks/agent-harness-secrets.md

@@ -0,0 +1,51 @@
+# agent-harness secret lanes
+
+Canon: `binky-control/integrations/executor-worker-secrets.md`.
+OpenBao paths / policies: `railiance-platform/docs/workload-kv-access-lanes.md`.
+
+**Never paste secret values into chat, Git, hub events, or this wiki.**
+
+## Lane 1 — LLM provider (reuse)
+
+Catalog: `openrouter-llm-connect`. No new secret. Harness reuses the
+activity-core llm-connect provider key path.
+
+## Lane 2 — Forgejo deploy key
+
+Catalog: `agent-harness-forgejo-deploy`
+
+| Item | Value |
+| --- | --- |
+| Host path (private key) | `~/.local/agent-harness/ssh/forgejo-deploy` on railiance01 |
+| OpenBao path | `platform/workloads/agent-harness/forgejo-deploy-key` |
+| Fields | `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY` |
+| Policy | `workload-kv-read-agent-harness-forgejo` |
+| SSH alias | `forgejo-agent-harness` (port 30022) |
+| Repos (write deploy key) | `coulomb/executor-sandbox` first; add `binky-control` at cutover |
+
+### Worker checklist
+
+1. Confirm private key mode `600` under `~/.local/agent-harness/ssh/`.
+2. `ssh -p 30022 -i ~/.local/agent-harness/ssh/forgejo-deploy -T git@forgejo.coulomb.social`  
+   expects deploy-key success message (no shell).
+3. Push only to granted repos (sandbox until cutover).
+
+## Lane 3 — Mail AppRole
+
+Catalog: `agent-harness-binky-mail-approle`
+
+| Item | Value |
+| --- | --- |
+| AppRole | `agent-harness-binky-mail` |
+| Token policy | `workload-kv-read-binky-company-email-imap` (existing; no widen) |
+| Host dir | `~/.local/agent-harness/approle-binky-mail/` (`role_id`, `secret_id`, mode 600) |
+| Env | `EXECUTOR_APPROLE_DIR` (see `~/.local/agent-harness/env`) |
+| Secret path | `tenants/binky/company-email/imap` |
+
+### Worker checklist
+
+1. `source ~/.local/agent-harness/env`
+2. Login with role_id/secret_id → short-lived token (ttl 15m).
+3. `bao kv get -field=IMAP_USERNAME|IMAP_PASSWORD …` — use only in process env;
+   never print.
+4. Negative: same token must **not** read unrelated KV (e.g. forgejo-admin).