coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: record active source credential path

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 01:37:17 +02:00
parent 1e6720b9ee
commit 49ab152da6
1 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md
View file

@ -183,14 +183,24 @@ rulings plus five conflicts remain visible through `CUST-IN-0016`.
Private-source CI support is implemented and tested. Credential routing found
no acceptable existing read-only token, so `railiance-platform@361005c` opened
`CCR-2026-0014`; State Hub message
`15d4ba0d-67d9-4765-b474-0004a1b398ad` requests platform review. Until that
credential is approved and installed, scheduled builds fail closed and the
documented local clean-source path remains the release mechanism.
`15d4ba0d-67d9-4765-b474-0004a1b398ad` requested platform review. The scheduled
build remained fail-closed while approval and installation were pending, with
the documented local clean-source path retained as the release mechanism.
Follow-up completed 2026-09-01. `CCR-2026-0014` is active with an exact,
high-risk, resolvable Warden route. Forgejo Actions run 32 succeeded for Policy
Nexus commit `1e6720b9eeba819b42133afcdfb9693608cddb42`, fetched the complete
private-source inventory through the dedicated `read:repository` credential,
passed release verification, and published candidate OCI digest
`sha256:a3a2b7b8b9432535771b588b9c78c554924ec1adc6d5a9bbc1c35b28fea6b724`.
The scheduled candidate path is therefore operational; production promotion
remains a separate paired-digest decision.
## Residuals
- Secret provisioning and rotation remain with the credential owner surfaced
by `warden route`; no token value enters this repository or State Hub.
- Rotation remains with the credential owner surfaced by
`warden route show policy-nexus-forgejo-source-read`; no token value enters
this repository or State Hub.
- `CUST-IN-0016` remains open for 26 other-owner metadata returns, two
substantive Custodian reviews, and five owner conflict rows. The two internal
constitutions are explicit local/excluded outcomes, not publication backlog.