From 49ab152da69a018527d68b293e88a0bd3dc3a7f1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 1 Sep 2026 01:37:17 +0200 Subject: [PATCH] docs: record active source credential path Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663 --- ...tandards-publication-and-ci-source-auth.md | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md b/workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md index 8be37fd..b19675d 100644 --- a/workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md +++ b/workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md @@ -183,14 +183,24 @@ rulings plus five conflicts remain visible through `CUST-IN-0016`. Private-source CI support is implemented and tested. Credential routing found no acceptable existing read-only token, so `railiance-platform@361005c` opened `CCR-2026-0014`; State Hub message -`15d4ba0d-67d9-4765-b474-0004a1b398ad` requests platform review. Until that -credential is approved and installed, scheduled builds fail closed and the -documented local clean-source path remains the release mechanism. +`15d4ba0d-67d9-4765-b474-0004a1b398ad` requested platform review. The scheduled +build remained fail-closed while approval and installation were pending, with +the documented local clean-source path retained as the release mechanism. + +Follow-up completed 2026-09-01. `CCR-2026-0014` is active with an exact, +high-risk, resolvable Warden route. Forgejo Actions run 32 succeeded for Policy +Nexus commit `1e6720b9eeba819b42133afcdfb9693608cddb42`, fetched the complete +private-source inventory through the dedicated `read:repository` credential, +passed release verification, and published candidate OCI digest +`sha256:a3a2b7b8b9432535771b588b9c78c554924ec1adc6d5a9bbc1c35b28fea6b724`. +The scheduled candidate path is therefore operational; production promotion +remains a separate paired-digest decision. ## Residuals -- Secret provisioning and rotation remain with the credential owner surfaced - by `warden route`; no token value enters this repository or State Hub. +- Rotation remains with the credential owner surfaced by + `warden route show policy-nexus-forgejo-source-read`; no token value enters + this repository or State Hub. - `CUST-IN-0016` remains open for 26 other-owner metadata returns, two substantive Custodian reviews, and five owner conflict rows. The two internal constitutions are explicit local/excluded outcomes, not publication backlog.