codex 186fa99f58

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

fix(workplans): adopt ADR-007 derived identifiers for unregistered records

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

2026-08-25 20:16:12 +02:00

3.8 KiB

Raw Permalink Blame History

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
WARDEN-WP-0025	workplan	Forgejo admin PAT OpenBao lane (CCR-2026-0006)	infotech	ops-warden	finished	grok	custodian	high	25	2026-07-12	2026-07-13	70c11222-d8e7-5936-99f7-7d626a4a5deb

WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane

Trigger: the-custodian CCR request (msg 54125f84) — establish OpenBao custody for the Forgejo site-admin PAT at platform/workloads/forgejo/forgejo-admin. Drivers: ACTIVITY-WP-0020 weekly package prune and railiance-apps/platform tools still using /tmp/forgejo-tegwick-api-token or FORGEJO_ADMIN_TOKEN.

Boundary: ops-warden holds no PAT; workstation OIDC fetch mirrors railiance-backup-offsite-lane (CCR-2026-0004). Distinct from forgejo-mailer (SMTP via ESO). Phase 1: no cluster ExternalSecret.

Depends on: platform-operator approval of CCR-2026-0006; attended PAT mint.

Tasks

T1 — Draft CCR + policy metadata

id: WARDEN-WP-0025-T01
status: done
priority: high
state_hub_task_id: "2c288bf0-b39c-5f5b-ad25-eed3da826dc3"

CCR-2026-0006-forgejo-admin-api-token-lane.yaml (status: proposed)
openbao/policies/workload-kv-read-forgejo-admin.hcl
docs/workload-kv-access-lanes.md section

T2 — ops-warden catalog + playbook

id: WARDEN-WP-0025-T02
status: done
priority: high
state_hub_task_id: "01b81595-f9e5-5746-b0dd-2075189cb00e"

Catalog entry forgejo-admin-api-token (status: draft)
wiki/playbooks/forgejo-admin-api-token.md

T3 — Platform-operator approval + metadata apply

id: WARDEN-WP-0025-T03
status: done
priority: high
state_hub_task_id: "279b74d7-3240-5ca0-897d-b1ddffd23c4e"

CCR approved by platform-operator (bernd.worsch, 2026-07-12)
scripts/credential-change.py applier-dry-run CCR-2026-0006
Policy workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read applied on bao.coulomb.social
Non-secret delegated_metadata_apply evidence on CCR

T4 — Attended PAT provision + verification

id: WARDEN-WP-0025-T04
status: done
priority: high
state_hub_task_id: "4e21232c-62a1-5115-acce-edfbcfa84e48"

Mint PAT as Forgejo user tegwick (attended, 2026-07-12)
Stored at platform/workloads/forgejo/forgejo-admin, field API_TOKEN (initial provision used field Token; re-stored as API_TOKEN 2026-07-13 to match CCR/catalog/playbook fetch_command)
Positive fetch verified 2026-07-13 — bao kv get -field=API_TOKEN … returns non-empty; PAT valid against forgejo.coulomb.social (/api/v1/user → login=tegwick, is_admin=true)
Negative default-policy denial recorded on CCR
Promoted catalog forgejo-admin-api-token to active (resolvable: true)

T5 — Notify downstream consumers

id: WARDEN-WP-0025-T05
status: done
priority: medium
state_hub_task_id: "f8c7c70b-b9b6-5980-a25b-7f11033b81a2"

Ack the-custodian with CCR id + catalog id (no secret values) — msg 949e8ed1, 2026-07-13
Signal railiance-platform / activity-core / railiance-apps to wire load_token() OpenBao paths — msgs 5be8e500 / 9ed1af98 / 2e47b6e5, 2026-07-13

Acceptance

CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
warden route find "forgejo admin pat" → forgejo-admin-api-token
No PAT in Git, State Hub, workplans, logs, or chat
Workstation file drop retired as steady-state path after downstream wiring

3.8 KiB Raw Permalink Blame History