# Core Hub Forgejo source-read token

Date: 2026-10-03
Catalog: `core-hub-forgejo-source-read` (status `active`, `exec_capable: false`, `resolvable: false`)
Owner: `railiance-platform` (OpenBao and credential lifecycle)

This lane carries the dedicated Forgejo PAT that the Core Hub repo-manager
publisher (`rapp-core-hub`, deployable `repository-classification-publisher`)
uses to read private sources of the repository registry. The Forgejo identity
`core-hub-source` is restricted to organization-wide repository-code read in org
`coulomb`, and the PAT scope is exactly `read:repository`. It has no repository
write, package, organization administration, instance administration, Actions,
cluster, or deployment authority.

The authoritative lifecycle and evidence record is
`railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml`
(design: `railiance-platform/docs/credential-lane-designs/core-hub-forgejo-source-read.md`).
It is distinct from `policy-nexus-forgejo-source-read` (CCR-2026-0014); neither
identity nor token is reused across the two lanes.

## Owner-confirmed lane

| Field | Value |
| --- | --- |
| OpenBao path | `platform/workloads/core-hub/forgejo-source-read` |
| Fields | `FORGEJO_SOURCE_TOKEN`, `API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` |
| Read policy | `workload-kv-read-core-hub-forgejo-source` |
| Auth | Kubernetes auth role `external-secrets-core-hub-forgejo-source` (bound to `external-secrets/external-secrets`) |
| Delivery | ClusterSecretStore `openbao-core-hub-forgejo-source` → ExternalSecret `core-hub/repo-manager-forgejo-source` → Secret key `token` |
| Forgejo identity | `core-hub-source` |
| Forgejo team | `core-hub-source-readers` |

## Worker checklist

1. There is no operator or agent fetch lane. External Secrets is the only reader,
   so `warden access core-hub-forgejo-source-read --fetch/--exec` is not offered
   and the fetch-policy pin does not list this lane. Do not request one; if a
   legitimate operator read need appears, it goes through a new CCR first.

2. Check delivery health without reading values: ExternalSecret
   `core-hub/repo-manager-forgejo-source` Ready, and `make verify-publisher` in
   `rapp-core-hub`. Verify OpenBao allow/deny with `bao token capabilities`, never
   `bao kv get` (see `catalog-lane-promotion.md`).

3. For rotation (every 180 days or on owner change), deactivation, or compromise,
   follow the CCR-2026-0031 lifecycle; `warden rotate-guide core-hub-forgejo-source-read`
   prints the rotation steps. A replacement is not active until `make
   verify-publisher` passes; revoke the predecessor afterward.

4. Never place the value in argv, chat, Git, State Hub, logs, or a persistent
   temporary file. Never substitute the Forgejo admin PAT, a personal token, or
   the policy-nexus-source token.