tegwick 171efa83fe

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Has been cancelled

Details

Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04)

PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin
under field API_TOKEN (re-stored from initial Token field to match
CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid
against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true).

- catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13
- playbook: header active/resolvable, drop post-promotion caveat
- workplan: T04 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 01:47:52 +02:00

3.7 KiB

Raw Blame History

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
WARDEN-WP-0025	workplan	Forgejo admin PAT OpenBao lane (CCR-2026-0006)	infotech	ops-warden	active	grok	custodian	high	25	2026-07-12	2026-07-12	5bd18d0b-88bf-4791-a940-ff62b836e6d7

WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane

Trigger: the-custodian CCR request (msg 54125f84) — establish OpenBao custody for the Forgejo site-admin PAT at platform/workloads/forgejo/forgejo-admin. Drivers: ACTIVITY-WP-0020 weekly package prune and railiance-apps/platform tools still using /tmp/forgejo-tegwick-api-token or FORGEJO_ADMIN_TOKEN.

Boundary: ops-warden holds no PAT; workstation OIDC fetch mirrors railiance-backup-offsite-lane (CCR-2026-0004). Distinct from forgejo-mailer (SMTP via ESO). Phase 1: no cluster ExternalSecret.

Depends on: platform-operator approval of CCR-2026-0006; attended PAT mint.

Tasks

T1 — Draft CCR + policy metadata

id: WARDEN-WP-0025-T01
status: done
priority: high
state_hub_task_id: "6faf5138-fbf9-4380-a2d7-3765f02c64ec"

CCR-2026-0006-forgejo-admin-api-token-lane.yaml (status: proposed)
openbao/policies/workload-kv-read-forgejo-admin.hcl
docs/workload-kv-access-lanes.md section

T2 — ops-warden catalog + playbook

id: WARDEN-WP-0025-T02
status: done
priority: high
state_hub_task_id: "fdb42d37-2978-4b84-9547-b0046773b3a3"

Catalog entry forgejo-admin-api-token (status: draft)
wiki/playbooks/forgejo-admin-api-token.md

T3 — Platform-operator approval + metadata apply

id: WARDEN-WP-0025-T03
status: done
priority: high
state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"

CCR approved by platform-operator (bernd.worsch, 2026-07-12)
scripts/credential-change.py applier-dry-run CCR-2026-0006
Policy workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read applied on bao.coulomb.social
Non-secret delegated_metadata_apply evidence on CCR

T4 — Attended PAT provision + verification

id: WARDEN-WP-0025-T04
status: done
priority: high
state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"

Mint PAT as Forgejo user tegwick (attended, 2026-07-12)
Stored at platform/workloads/forgejo/forgejo-admin, field API_TOKEN (initial provision used field Token; re-stored as API_TOKEN 2026-07-13 to match CCR/catalog/playbook fetch_command)
Positive fetch verified 2026-07-13 — bao kv get -field=API_TOKEN … returns non-empty; PAT valid against forgejo.coulomb.social (/api/v1/user → login=tegwick, is_admin=true)
Negative default-policy denial recorded on CCR
Promoted catalog forgejo-admin-api-token to active (resolvable: true)

T5 — Notify downstream consumers

id: WARDEN-WP-0025-T05
status: wait
priority: medium
state_hub_task_id: "24a6e98f-759c-43ce-a1dc-230b08b9d85c"

Ack the-custodian with CCR id + catalog id (no secret values)
Signal railiance-platform / activity-core / railiance-apps to wire load_token() OpenBao paths

Acceptance

CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
warden route find "forgejo admin pat" → forgejo-admin-api-token
No PAT in Git, State Hub, workplans, logs, or chat
Workstation file drop retired as steady-state path after downstream wiring

3.7 KiB Raw Blame History