feat(routing): repoint whynot npm lane to Forgejo

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

wiki/playbooks/whynot-design-npm-publish.md

@@ -1,11 +1,17 @@
 # whynot-design npm publish token
 
-Date: 2026-06-29
+Date: 2026-09-04
 Catalog: `whynot-design-npm-publish` (status `active`, `resolvable: true`)
 Owner: `railiance-platform` (OpenBao) · provisioning CCR-2026-0001 (commit 8f617fc)
 
-The `NPM_AUTH_TOKEN` that publishes `@whynot/design` to the coulomb Gitea npm registry
-(`https://gitea.coulomb.social/api/packages/coulomb/npm/`). ops-warden **does not hold
+> **Rotation required (2026-09-04).** The OIDC role and OpenBao read path are
+> healthy, but the stored credential failed a real Forgejo publish. Version
+> `@whynot/design@0.4.2` was published and integrity-verified through the
+> plan-authorized Forgejo admin recovery lane. Treat this dedicated lane as
+> unverified for writes until its package token is rotated and re-proven.
+
+The `NPM_AUTH_TOKEN` that publishes `@whynot/design` to the coulomb Forgejo npm registry
+(`https://forgejo.coulomb.social/api/packages/coulomb/npm/`). ops-warden **does not hold
 this token** — it is the access front door: `warden access` proxies the read from OpenBao
 **as the caller** and never persists, caches, or logs the value.
 
@@ -42,13 +48,20 @@ this token** — it is the access front door: `warden access` proxies the read f
    for this lane (SECRETS-WP-0003, decision e6381a56); ops-warden routes to it:
    ```bash
    secrets-engine route whynot-design-npm-publish --json          # pointer / readiness
+   secrets-engine exec --catalog whynot-design-npm-publish -- \
+     npm view @whynot/design@<version> version \
+       --registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
    secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
    ```
 
    **ops-warden transparent fallback** — same lane via the `warden access` proxy (fetches as
-   you, holds nothing). Field-verified flags (whynot-design, @whynot/design@0.4.0):
+   you, holds nothing). The project `.npmrc` must point both the `@whynot` scope and
+   token fragment at `forgejo.coulomb.social`:
    ```bash
    # --exec needs the env-var name. The zone-aware policy gate always runs first.
+   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN \
+     --exec -- npm view @whynot/design@<version> version \
+       --registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
    warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN \
      --exec -- npm publish
    warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN --fetch
@@ -63,9 +76,19 @@ this token** — it is the access front door: `warden access` proxies the read f
    `resolvable: true` means the lane is concrete and `--fetch` will run; a template lane
    reports `false`.
 
-4. **Publish is outward-facing and immutable.** `npm publish` is irreversible and public.
-   Even once the token resolves, hold for an explicit operator "yes, publish" — do not
-   auto-run it from an agent.
+4. **Publish is outward-facing and immutable.** Before publishing, confirm that
+   `package.json#publishConfig.registry` is exactly the Forgejo URL above, verify the
+   intended version and `npm pack --dry-run` contents, and obtain explicit operator
+   approval. `npm publish` is irreversible; do not auto-run it from an agent.
+
+5. **Record non-secret release evidence.** After the owner publishes, record only the
+   package coordinate (for example `@whynot/design@0.4.2`), registry URL, authenticated
+   install result, and release-content verification. Never record the token or npm
+   configuration generated for its delivery.
+
+   Forgejo advertises `npm view`, search, install, publish, unpublish, and dist-tag
+   support; it does not advertise `npm whoami`. Use the exact-version lookup above
+   rather than treating `npm whoami` failure as a credential failure.
 
 ---