ops-warden/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
WARDEN-WP-0037	workplan	Repoint the whynot-design npm lane to Forgejo	infotech	ops-warden	active	codex	whynot-design-forgejo-npm-lane	2026-09-04	2026-09-04	42a097db-1c24-558e-a724-030bb2b4443e

Verify the existing credential against Forgejo

id: WARDEN-WP-0037-T01
status: done
priority: high
state_hub_task_id: "afc4d325-1c6d-5c25-aaf7-2118aa8f86c6"

Use only the governed execution transport to test the existing publish identity against the canonical Forgejo npm endpoint. Do not print or persist the token.

2026-09-04: warden plan classified the exact verification as autonomous and selected this lane. A contained login using the documented whynot-design-workload-kv-read role proved read on the exact OpenBao data path, and the governed child proved the secret is present. A real 0.4.2 publish through that credential then failed. No value was printed or persisted and each contained session self-revoked. The lane therefore needs token rotation, not an OpenBao policy repair.

Repoint the catalog and playbook

id: WARDEN-WP-0037-T02
status: done
priority: high
state_hub_task_id: "7ceb2f74-496c-54e8-bf5a-3c49f994ff23"

Replace the retired Gitea endpoint and discovery language with Forgejo while preserving the established OpenBao path, field, and least-privilege boundary. This delivers the npm facet of routed intake 01a06e07-f2f9-7586-9745-b359eb0025b6; its inter-hub SSH facet remains separate.

Completed 2026-09-04. The catalog title, discovery keywords, rotation guidance, and worker playbook now name the canonical Forgejo registry at https://forgejo.coulomb.social/api/packages/coulomb/npm/. The OpenBao path, field, owner, native-exec pointer, and high-risk boundary are unchanged. A regression assertion prevents the retired Gitea discovery term and guidance from returning.

Prove routing and publication

id: WARDEN-WP-0037-T03
status: wait
priority: high
needs_human: true
intervention_note: "Rotate the dedicated Forgejo package token, then prove a fresh publish and exact npm view through this lane."
state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"

Pass catalog and routing tests, verify the checkout route, and record the exact Forgejo package release proven through the lane.

2026-09-04: repo-local verification is complete: the checkout route ranks whynot-design-npm-publish first for a Forgejo npm publish need, reports the canonical Forgejo title and verification command, all focused routing/access/proxy tests pass (145 passed).

The sibling repo's @whynot/design@0.4.2 release (105 files; IR designVersion 0.4.2; five visual tests pass) was published through the plan-authorized forgejo-admin-api-token one-time recovery lane. An authenticated exact-version lookup proved that Forgejo's remote integrity matches the local dry-run. T03 waits only on rotating the dedicated package token and proving the next fresh version through whynot-design-npm-publish; the package migration itself is complete.