coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix access inventory evidence and reconcile closure coordination

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11beb-4eef-7fc1-94a7-597130a01ae9
This commit is contained in:
tegwick 2026-10-09 00:23:04 +02:00
parent 490a89dca6
commit 57ad4abefc
9 changed files with 342 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

49
inventory/access-consumers.md
View file

@ -23,7 +23,7 @@ Secrets and node registry configuration were not inspected.
| package index | kaizen-agentic, vergabe-teilnahme | PyPI `simple/` index without credentials | package-read token |
| federation | reuse-surface | about 60 capability indexes by raw URL | read identity, or a published index location |
| code readers | about 8 files, below | clones, API and raw reads without token handling | owner review; re-point to an authenticated path |
| campaign images | pr-hall-of-helix, fluid-telegram | Telegram fetching post images by raw URL | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) |
| campaign images | pr-hall-of-helix, fluid-telegram | Telegram fetching post images by raw URL | adapter fetches privately and uploads to Telegram (accepted policy; FT-WP-0001-T14) |
Lower risk: `repo-gitops` and `repo-image-reference` are the cluster consumers
seen from their source repos. `doc-link` means links break for the public, not
@ -71,29 +71,15 @@ URLs and whynot-design's SSH `repository` field.
All 160 local clones use SSH with the founder's key (`forgejo-remote`). They keep
working as long as that account can read the repositories.
## Founder checks (presence only, no secret values)
## Historical founder checks
Agents do not read Secrets, so run these in your own terminal and paste the output.
1. ArgoCD repository credentials, by name, type and URL only:
```bash
kubectl -n argocd get secrets \
-l 'argocd.argoproj.io/secret-type in (repository,repo-creds)' \
-o go-template='{{range .items}}{{.metadata.name}} {{index .metadata.labels "argocd.argoproj.io/secret-type"}} {{if .data.url}}{{.data.url | base64decode}}{{end}}{{"\n"}}{{end}}'
```
2. k3s registry configuration on railiance01, as key names with every value
stripped:
```bash
ssh railiance01 'sudo test -f /etc/rancher/k3s/registries.yaml \
&& sudo sed -nE "s/^([[:space:]]*[A-Za-z0-9_.\"-]+:).*/\1/p" /etc/rancher/k3s/registries.yaml \
|| echo absent'
```
`absent`, or no `auth:` under the forge host, means all 43 pulls depend on
anonymous registry access today.
The October 8 results below are preserved as dated owner evidence. The original
inline Secret template and registry-value-stripping commands are withdrawn:
the estate forbids standalone go-template/jsonpath against real Secrets, and
text stripping is not a reliable boundary for registry credentials. Do not
repeat them. Obtain a current sanitized receipt from the platform/node owner;
Secret annotation checks use the output-suppressing platform maintenance helper
specified in the-custodian's agent environment orientation, section 6.
### Results, 2026-10-08 (run by the founder)
@ -114,3 +100,20 @@ Agents do not read Secrets, so run these in your own terminal and paste the outp
- Consumers outside these working trees (external sites and links, other
people's clones) cannot be found by scanning; T08's anonymous probe after each
wave is the backstop.
## Collector corrections — 2026-10-09
The retained October 8 JSON uses schema 0.1. Its `anonymous_image_pulls` field
was an inference from absent pod pull-secret names; only the separate founder
node-auth check supports the anonymous-access conclusion for that snapshot.
Do not reuse this inference for another cluster or capture.
Schema 0.2 reports `image_pulls_without_named_credentials`, with access marked
unknown until node/service-account credential evidence exists. It preserves
forge hostnames, so legacy references stay separate, and classifies package
API indexes as package consumers with null repository targets (package namespace
is not repository identity). `scan_exclusions` and `scan_error_count` expose
coverage limits; the coordinator is omitted to avoid self-referential output.
Sensitive/encrypted, binary and symlinked paths are not read. The source scan is
deterministic for unchanged inputs, but no claim of full consumer completeness
or deployment state follows from matching outputs.