ops-warden/wiki/playbooks/whynot-design-npm-publish.md

whynot-design npm publish token

Date: 2026-09-04 Catalog: whynot-design-npm-publish (status active, resolvable: true) Owner: railiance-platform (OpenBao) · provisioning CCR-2026-0001 (commit 8f617fc)

Rotation required (2026-09-04). The OIDC role and OpenBao read path are healthy, but the stored credential failed a real Forgejo publish. Version @whynot/design@0.4.2 was published and integrity-verified through the plan-authorized Forgejo admin recovery lane. Treat this dedicated lane as unverified for writes until its package token is rotated and re-proven.

The npm publish token for @whynot/design on the coulomb Forgejo npm registry (KV field NPM_AUTH_TOKEN, which is also the name the publish command reads it under) (https://forgejo.coulomb.social/api/packages/coulomb/npm/). ops-warden does not hold this token — it is the access front door: warden access proxies the read from OpenBao as the caller and never persists, caches, or logs the value.

---

Owner-confirmed lane (no placeholders)

Field	Value
OpenBao path	platform/workloads/coulomb/whynot-design/npm-publish
KV field	NPM_AUTH_TOKEN — the only field present at this path (attended enumeration 2026-09-10, railiance-platform docs/evidence/2026-09-10-npm-lane-field-resolution.json)
Injected env var	NPM_AUTH_TOKEN — same name as the KV field, which is what made the 2026-09-09 npm_token change look plausible
KV mount	platform
Read policy	workload-kv-read-whynot-design-npm-publish
OIDC login	bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read
Bound group	whynot-design
flex-auth ref	secret.read:whynot-design (if tenant policy requires pre-approval)
Runbook (owner)	railiance-platform/docs/workload-kv-access-lanes.md

The platform/workloads/whynot-design/whynot-design/npm-publish path from early in the provisioning thread is superseded — the live path is under the coulomb tenant.

A second, ungoverned location exists and is not this lane. secret/coulomb/whynot-design/npm/publish (v1, created 2026-07-03, never updated) sits outside this lane's exact-path policy and outside any CCR. It was found by metadata read only; its field names were not enumerated, its value was not read, and it was not deleted — a location holding real credential material is disposed of deliberately by its owner, not tidied away by whoever finds it. railiance-platform tracks it as RPF-WP-0035-T07, with an open hypothesis that the native secrets-engine exec front door below may be reading it rather than the governed path. If that proves true, this lane's acceptance evidence describes a path its consumer does not use. Do not route around the governed path on that suspicion; the question is with its owners.

---

Worker checklist

1. Authenticate as yourself (you need your own identity; ops-warden adds none):

   bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read
   

   Your token must carry the whynot-design group bound claim; a non-whynot identity is denied by policy (verified negative case).

2. Run via the owner-native front door (primary). secrets-engine owns the secret-exec for this lane (SECRETS-WP-0003, decision e6381a56); ops-warden routes to it:

   secrets-engine route whynot-design-npm-publish --json          # pointer / readiness
   secrets-engine exec --catalog whynot-design-npm-publish -- \
     npm view @whynot/design@<version> version \
       --registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
   secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
   

   ops-warden transparent fallback — same lane via the warden access proxy (fetches as you, holds nothing). The project .npmrc must point both the @whynot scope and token fragment at forgejo.coulomb.social:

   # --exec needs the env-var name. The zone-aware policy gate always runs first.
   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN \
     --exec -- npm view @whynot/design@<version> version \
       --registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN \
     --exec -- npm publish
   warden access whynot-design-npm-publish --field NPM_AUTH_TOKEN --fetch
   

   On either path the value transits to you (or the child env) and never enters ops-warden's memory, disk, or audit log.

3. Readiness gate (for automated callers). Before attempting --fetch, check the flag:

   warden route show whynot-design-npm-publish --json | jq .resolvable   # true
   

   resolvable: true means the lane is concrete and --fetch will run; a template lane reports false.

4. Publish is outward-facing and immutable. Before publishing, confirm that package.json#publishConfig.registry is exactly the Forgejo URL above, verify the intended version and npm pack --dry-run contents, and obtain explicit operator approval. npm publish is irreversible; do not auto-run it from an agent.

5. Record non-secret release evidence. After the owner publishes, record only the package coordinate (for example @whynot/design@0.4.2), registry URL, authenticated install result, and release-content verification. Never record the token or npm configuration generated for its delivery.

   Forgejo advertises npm view, search, install, publish, unpublish, and dist-tag support; it does not advertise npm whoami. Use the exact-version lookup above rather than treating npm whoami failure as a credential failure.

---

Scopes

This lane is the publish token only. A separate read/install token (for consumers of @whynot/design) is a distinct need and would be its own catalog id (whynot-design-npm-read) once railiance-platform provisions it — do not conflate them.

---

See also

• wiki/OperatorAccessAssist.md — the warden access front door + guardrails
• wiki/CredentialRouting.md — routing model
• railiance-platform/docs/workload-kv-access-lanes.md, workplans/RAILIANCE-WP-0006-workload-kv-access-lanes.md