ORGREF-WP-0002-T02: fresh runtime capture and per-entry consumer review
43 anonymous image pulls (confirmed working anonymously), 10 ArgoCD apps, CI tarball downloads in ~20 repos, PyPI reads, reuse-surface federation and ~8 code readers break on closure. Founder presence checks prepared for ArgoCD repository credentials and k3s node registry auth. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
parent
b10dd8afaf
commit
ba5ed2f707
4 changed files with 2048 additions and 92 deletions
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"schema_version": "0.1",
|
||||
"workplan": "ORGREF-WP-0002-T02",
|
||||
"runtime_capture": "runtime-2026-09-28.json",
|
||||
"runtime_capture": "runtime-2026-10-08.json",
|
||||
"scanned_repositories": 161,
|
||||
"local_remote_forms": {
|
||||
"other": 1,
|
||||
|
|
@ -11,19 +11,19 @@
|
|||
"api-client": 25,
|
||||
"build-tooling": 23,
|
||||
"ci-runner": 27,
|
||||
"cluster-gitops": 6,
|
||||
"cluster-image-pull": 40,
|
||||
"cluster-gitops": 10,
|
||||
"cluster-image-pull": 43,
|
||||
"code-reference": 24,
|
||||
"config-reference": 98,
|
||||
"config-reference": 99,
|
||||
"doc-link": 119,
|
||||
"other": 2,
|
||||
"package-consumer": 2,
|
||||
"raw-file-fetch": 68,
|
||||
"record-or-test": 103,
|
||||
"repo-gitops": 15,
|
||||
"repo-image-reference": 91
|
||||
"record-or-test": 104,
|
||||
"repo-gitops": 17,
|
||||
"repo-image-reference": 93
|
||||
},
|
||||
"anonymous_image_pulls": 40,
|
||||
"anonymous_image_pulls": 43,
|
||||
"consumers": [
|
||||
{
|
||||
"consumer": "argocd:activity-core",
|
||||
|
|
@ -49,6 +49,22 @@
|
|||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:informed-decision",
|
||||
"class": "cluster-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/informed-decision",
|
||||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:informed-decision-requester",
|
||||
"class": "cluster-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/railiance-platform",
|
||||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:openbao-secretstore",
|
||||
"class": "cluster-gitops",
|
||||
|
|
@ -65,6 +81,22 @@
|
|||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:secret-annotation-guard",
|
||||
"class": "cluster-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/railiance-platform",
|
||||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:state-hub-memo-dispatch",
|
||||
"class": "cluster-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/state-hub",
|
||||
"credential": "unknown (ArgoCD repo credentials not inspected)",
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "argocd:target-revenue",
|
||||
"class": "cluster-gitops",
|
||||
|
|
@ -130,7 +162,7 @@
|
|||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:audit-core/Job/audit-core-attest-chain-29841317",
|
||||
"consumer": "k3s:audit-core/Job/audit-core-attest-chain-29855717",
|
||||
"class": "cluster-image-pull",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/audit-core",
|
||||
|
|
@ -138,7 +170,7 @@
|
|||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:audit-core/Job/audit-core-attest-chain-29842757",
|
||||
"consumer": "k3s:audit-core/Job/audit-core-attest-chain-29857157",
|
||||
"class": "cluster-image-pull",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/audit-core",
|
||||
|
|
@ -209,6 +241,14 @@
|
|||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "UNRESOLVED"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:flex-auth/Deployment/flex-auth-informed-decision-lifecycle",
|
||||
"class": "cluster-image-pull",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/flex-auth",
|
||||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:flex-auth/Deployment/flex-auth-informed-decision-sitting",
|
||||
"class": "cluster-image-pull",
|
||||
|
|
@ -233,6 +273,14 @@
|
|||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:flex-auth/Deployment/flex-auth-ops-warden-fetch",
|
||||
"class": "cluster-image-pull",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/flex-auth",
|
||||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:flex-auth/Deployment/flex-auth-secrets-engine",
|
||||
"class": "cluster-image-pull",
|
||||
|
|
@ -345,6 +393,14 @@
|
|||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:state-hub/Deployment/state-hub-memo-dispatch",
|
||||
"class": "cluster-image-pull",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/state-hub-memo-dispatch",
|
||||
"credential": "anonymous (no imagePullSecrets)",
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
"consumer": "k3s:target-revenue/Deployment/target-revenue",
|
||||
"class": "cluster-image-pull",
|
||||
|
|
@ -3458,10 +3514,12 @@
|
|||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:113",
|
||||
"inventory/runtime-2026-09-28.json:114",
|
||||
"inventory/runtime-2026-10-08.json:176",
|
||||
"inventory/runtime-2026-10-08.json:177",
|
||||
"inventory/snapshot.json:13",
|
||||
"inventory/snapshot-before.json:13"
|
||||
],
|
||||
"location_count": 4,
|
||||
"location_count": 6,
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
|
|
@ -3470,9 +3528,10 @@
|
|||
"kind": "config-reference",
|
||||
"target": "coulomb/activity-core",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:84"
|
||||
"inventory/runtime-2026-09-28.json:84",
|
||||
"inventory/runtime-2026-10-08.json:132"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3486,6 +3545,17 @@
|
|||
"location_count": 1,
|
||||
"target_steward": "coulomb"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "config-reference",
|
||||
"kind": "config-reference",
|
||||
"target": "coulomb/informed-decision",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-10-08.json:146"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "config-reference",
|
||||
|
|
@ -3493,9 +3563,12 @@
|
|||
"target": "coulomb/railiance-platform",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:98",
|
||||
"inventory/runtime-2026-09-28.json:105"
|
||||
"inventory/runtime-2026-09-28.json:105",
|
||||
"inventory/runtime-2026-10-08.json:154",
|
||||
"inventory/runtime-2026-10-08.json:161",
|
||||
"inventory/runtime-2026-10-08.json:168"
|
||||
],
|
||||
"location_count": 2,
|
||||
"location_count": 5,
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
|
|
@ -3504,9 +3577,10 @@
|
|||
"kind": "config-reference",
|
||||
"target": "coulomb/reuse-surface",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1180"
|
||||
"inventory/runtime-2026-09-28.json:1180",
|
||||
"inventory/runtime-2026-10-08.json:1263"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3517,9 +3591,13 @@
|
|||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:142",
|
||||
"inventory/runtime-2026-09-28.json:1400",
|
||||
"inventory/runtime-2026-09-28.json:1410"
|
||||
"inventory/runtime-2026-09-28.json:1410",
|
||||
"inventory/runtime-2026-10-08.json:147",
|
||||
"inventory/runtime-2026-10-08.json:205",
|
||||
"inventory/runtime-2026-10-08.json:1483",
|
||||
"inventory/runtime-2026-10-08.json:1493"
|
||||
],
|
||||
"location_count": 3,
|
||||
"location_count": 7,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3528,9 +3606,10 @@
|
|||
"kind": "config-reference",
|
||||
"target": "coulomb/target-revenue",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1430"
|
||||
"inventory/runtime-2026-09-28.json:1430",
|
||||
"inventory/runtime-2026-10-08.json:1523"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "UNRESOLVED"
|
||||
},
|
||||
{
|
||||
|
|
@ -3577,7 +3656,19 @@
|
|||
"kind": "gitops-source",
|
||||
"target": "coulomb/activity-core",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:10"
|
||||
"inventory/runtime-2026-09-28.json:10",
|
||||
"inventory/runtime-2026-10-08.json:10"
|
||||
],
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/informed-decision",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-10-08.json:46"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "helixforge"
|
||||
|
|
@ -3592,20 +3683,37 @@
|
|||
"inventory/runtime-2026-09-28.json:22",
|
||||
"inventory/runtime-2026-09-28.json:34",
|
||||
"inventory/runtime-2026-09-28.json:46",
|
||||
"inventory/runtime-2026-09-28.json:58"
|
||||
"inventory/runtime-2026-09-28.json:58",
|
||||
"inventory/runtime-2026-10-08.json:22",
|
||||
"inventory/runtime-2026-10-08.json:34",
|
||||
"inventory/runtime-2026-10-08.json:58",
|
||||
"inventory/runtime-2026-10-08.json:70",
|
||||
"inventory/runtime-2026-10-08.json:82"
|
||||
],
|
||||
"location_count": 5,
|
||||
"location_count": 11,
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/state-hub",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-10-08.json:106"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-gitops",
|
||||
"kind": "gitops-source",
|
||||
"target": "coulomb/target-revenue",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:70"
|
||||
"inventory/runtime-2026-09-28.json:70",
|
||||
"inventory/runtime-2026-10-08.json:118"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "UNRESOLVED"
|
||||
},
|
||||
{
|
||||
|
|
@ -3616,9 +3724,12 @@
|
|||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:122",
|
||||
"inventory/runtime-2026-09-28.json:132",
|
||||
"inventory/runtime-2026-09-28.json:172"
|
||||
"inventory/runtime-2026-09-28.json:172",
|
||||
"inventory/runtime-2026-10-08.json:185",
|
||||
"inventory/runtime-2026-10-08.json:195",
|
||||
"inventory/runtime-2026-10-08.json:235"
|
||||
],
|
||||
"location_count": 3,
|
||||
"location_count": 6,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3627,9 +3738,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/approval-engine",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:252"
|
||||
"inventory/runtime-2026-09-28.json:252",
|
||||
"inventory/runtime-2026-10-08.json:315"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3641,9 +3753,13 @@
|
|||
"inventory/runtime-2026-09-28.json:303",
|
||||
"inventory/runtime-2026-09-28.json:313",
|
||||
"inventory/runtime-2026-09-28.json:323",
|
||||
"inventory/runtime-2026-09-28.json:338"
|
||||
"inventory/runtime-2026-09-28.json:338",
|
||||
"inventory/runtime-2026-10-08.json:366",
|
||||
"inventory/runtime-2026-10-08.json:376",
|
||||
"inventory/runtime-2026-10-08.json:386",
|
||||
"inventory/runtime-2026-10-08.json:401"
|
||||
],
|
||||
"location_count": 4,
|
||||
"location_count": 8,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3652,9 +3768,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/canned-prompts",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:363"
|
||||
"inventory/runtime-2026-09-28.json:363",
|
||||
"inventory/runtime-2026-10-08.json:426"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3665,20 +3782,34 @@
|
|||
"locations": [
|
||||
"GOAL.md:72",
|
||||
"inventory/runtime-2026-09-28.json:413",
|
||||
"inventory/runtime-2026-09-28.json:443"
|
||||
"inventory/runtime-2026-09-28.json:443",
|
||||
"inventory/runtime-2026-10-08.json:476",
|
||||
"inventory/runtime-2026-10-08.json:506"
|
||||
],
|
||||
"location_count": 3,
|
||||
"location_count": 5,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-image-reference",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/coulomb-social",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-10-08.json:536"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "coulomb"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-image-reference",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/email-connect",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:543"
|
||||
"inventory/runtime-2026-09-28.json:543",
|
||||
"inventory/runtime-2026-10-08.json:606"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "UNRESOLVED"
|
||||
},
|
||||
{
|
||||
|
|
@ -3692,9 +3823,13 @@
|
|||
"inventory/runtime-2026-09-28.json:658",
|
||||
"inventory/runtime-2026-09-28.json:668",
|
||||
"inventory/runtime-2026-09-28.json:678",
|
||||
"inventory/runtime-2026-09-28.json:688"
|
||||
"inventory/runtime-2026-09-28.json:688",
|
||||
"inventory/runtime-2026-10-08.json:701",
|
||||
"inventory/runtime-2026-10-08.json:711",
|
||||
"inventory/runtime-2026-10-08.json:721",
|
||||
"inventory/runtime-2026-10-08.json:731"
|
||||
],
|
||||
"location_count": 6,
|
||||
"location_count": 14,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3704,9 +3839,11 @@
|
|||
"target": "coulomb/hub-core",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:423",
|
||||
"inventory/runtime-2026-09-28.json:453"
|
||||
"inventory/runtime-2026-09-28.json:453",
|
||||
"inventory/runtime-2026-10-08.json:486",
|
||||
"inventory/runtime-2026-10-08.json:516"
|
||||
],
|
||||
"location_count": 2,
|
||||
"location_count": 4,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3715,9 +3852,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/identity-provisioner",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1250"
|
||||
"inventory/runtime-2026-09-28.json:1250",
|
||||
"inventory/runtime-2026-10-08.json:1333"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
|
|
@ -3726,9 +3864,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/informed-decision",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:719"
|
||||
"inventory/runtime-2026-09-28.json:719",
|
||||
"inventory/runtime-2026-10-08.json:802"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3737,9 +3876,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/issue-core",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:739"
|
||||
"inventory/runtime-2026-09-28.json:739",
|
||||
"inventory/runtime-2026-10-08.json:822"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3748,9 +3888,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/key-cape",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1260"
|
||||
"inventory/runtime-2026-09-28.json:1260",
|
||||
"inventory/runtime-2026-10-08.json:1343"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3759,9 +3900,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/policy-nexus",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:986"
|
||||
"inventory/runtime-2026-09-28.json:986",
|
||||
"inventory/runtime-2026-10-08.json:1069"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3771,9 +3913,11 @@
|
|||
"target": "coulomb/railiance-telemetry-ack",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1472",
|
||||
"inventory/runtime-2026-09-28.json:1482"
|
||||
"inventory/runtime-2026-09-28.json:1482",
|
||||
"inventory/runtime-2026-10-08.json:1565",
|
||||
"inventory/runtime-2026-10-08.json:1575"
|
||||
],
|
||||
"location_count": 2,
|
||||
"location_count": 4,
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
|
|
@ -3783,9 +3927,11 @@
|
|||
"target": "coulomb/rapp-qonto",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1133",
|
||||
"inventory/runtime-2026-09-28.json:1150"
|
||||
"inventory/runtime-2026-09-28.json:1150",
|
||||
"inventory/runtime-2026-10-08.json:1216",
|
||||
"inventory/runtime-2026-10-08.json:1233"
|
||||
],
|
||||
"location_count": 2,
|
||||
"location_count": 4,
|
||||
"target_steward": "railiance"
|
||||
},
|
||||
{
|
||||
|
|
@ -3794,9 +3940,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/repo-manager",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:433"
|
||||
"inventory/runtime-2026-09-28.json:433",
|
||||
"inventory/runtime-2026-10-08.json:496"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "helixforge"
|
||||
},
|
||||
{
|
||||
|
|
@ -3805,10 +3952,22 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/sbom-nexus",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1200"
|
||||
"inventory/runtime-2026-09-28.json:1200",
|
||||
"inventory/runtime-2026-10-08.json:1283"
|
||||
],
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "repo-image-reference",
|
||||
"kind": "image-pull",
|
||||
"target": "coulomb/state-hub-memo-dispatch",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-10-08.json:1503"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "netkingdom"
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
|
|
@ -3816,9 +3975,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/tenant-engine",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1524"
|
||||
"inventory/runtime-2026-09-28.json:1524",
|
||||
"inventory/runtime-2026-10-08.json:1617"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3827,9 +3987,10 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/user-engine",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1554"
|
||||
"inventory/runtime-2026-09-28.json:1554",
|
||||
"inventory/runtime-2026-10-08.json:1647"
|
||||
],
|
||||
"location_count": 1,
|
||||
"location_count": 2,
|
||||
"target_steward": "netkingdom"
|
||||
},
|
||||
{
|
||||
|
|
@ -3838,10 +3999,22 @@
|
|||
"kind": "image-pull",
|
||||
"target": "coulomb/vergabe-teilnahme",
|
||||
"locations": [
|
||||
"inventory/runtime-2026-09-28.json:1619"
|
||||
"inventory/runtime-2026-09-28.json:1619",
|
||||
"inventory/runtime-2026-10-08.json:1712"
|
||||
],
|
||||
"location_count": 2,
|
||||
"target_steward": "UNRESOLVED"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-forgejo-org-refactor",
|
||||
"class": "record-or-test",
|
||||
"kind": "record",
|
||||
"target": "coulomb/x",
|
||||
"locations": [
|
||||
"tests/test_access_consumers.py:35"
|
||||
],
|
||||
"location_count": 1,
|
||||
"target_steward": "UNRESOLVED"
|
||||
"target_steward": "unassigned"
|
||||
},
|
||||
{
|
||||
"consumer": "repo:prj-helixforge-factory",
|
||||
|
|
|
|||
|
|
@ -3,44 +3,102 @@
|
|||
Machine-readable result: `access-consumers-2026-10-08.json`. Reproduce:
|
||||
|
||||
```bash
|
||||
python3 tools/runtime_inventory.py --output inventory/runtime-2026-10-08.json
|
||||
python3 tools/access_consumers.py --root /home/worsch \
|
||||
--runtime inventory/runtime-2026-09-28.json \
|
||||
--runtime inventory/runtime-2026-10-08.json \
|
||||
--output inventory/access-consumers-2026-10-08.json
|
||||
```
|
||||
|
||||
Read-only: 161 local working trees scanned, plus the 2026-09-28 runtime capture
|
||||
(not a live read). Secrets, ArgoCD repository credentials and node registry
|
||||
configuration were not inspected.
|
||||
Read-only: 161 local working trees scanned, plus a fresh runtime capture
|
||||
(`runtime-2026-10-08.json`: 135 controllers, 10 Applications, 7 AppProjects).
|
||||
Secrets and node registry configuration were not inspected.
|
||||
|
||||
## What breaks when repositories and packages go private
|
||||
|
||||
| Class | Count | Reads | Will need |
|
||||
| --- | --- | --- | --- |
|
||||
| cluster-image-pull | 40 workloads in 21 namespaces | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`), which is unverified |
|
||||
| cluster-gitops | 6 ArgoCD applications | Git sources on the forge | ArgoCD repository credentials (current state unverified) |
|
||||
| ci-runner | 27 hits in workflow files | checkouts, reusable actions, registry | runner or job tokens for cross-repo reads |
|
||||
| api-client | 25 hits | `/api/v1` calls (state-hub, railiance-*, ops-warden, issue-core, …) | per-service tokens; check which calls are anonymous today |
|
||||
| raw-file-fetch | 68 hits, 63 in `reuse-surface` | raw files by URL | authenticated fetch, or move the published content to a public location |
|
||||
| raw-file-fetch (campaign) | pr-hall-of-helix, fluid-telegram | Telegram fetching post images | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) |
|
||||
| package-consumer | 2 (kaizen-agentic, whynot-design) | modules or packages from the forge | package-registry credentials |
|
||||
| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`, unverified). Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 |
|
||||
| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials. `argocd-cm` defines none; Secret-based credentials unverified |
|
||||
| ci-runner | about 20 repos | own-source tarballs and cross-repo tarballs, anonymously (below) | job token for the own repository, a scoped read token across repositories |
|
||||
| package index | kaizen-agentic, vergabe-teilnahme | PyPI `simple/` index without credentials | package-read token |
|
||||
| federation | reuse-surface | about 60 capability indexes by raw URL | read identity, or a published index location |
|
||||
| code readers | about 8 files, below | clones, API and raw reads without token handling | owner review; re-point to an authenticated path |
|
||||
| campaign images | pr-hall-of-helix, fluid-telegram | Telegram fetching post images by raw URL | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) |
|
||||
|
||||
Lower risk, review only: `repo-gitops` (15) and `repo-image-reference` (91) are
|
||||
the same cluster consumers seen from their source repos. `code-reference` (24),
|
||||
`config-reference` (98) and `build-tooling` (23) are mostly URLs and pushes that
|
||||
need a per-entry look. `doc-link` (119) means links break for the public, not
|
||||
consumers. `record-or-test` (103) is evidence and fixtures.
|
||||
Lower risk: `repo-gitops` and `repo-image-reference` are the cluster consumers
|
||||
seen from their source repos. `doc-link` means links break for the public, not
|
||||
consumers. `record-or-test` is evidence and fixtures.
|
||||
|
||||
## Per-entry review, 2026-10-08
|
||||
|
||||
**CI: anonymous source tarballs (breaks).** Workflows download their own source
|
||||
with plain `curl`/`wget` from `/${GITHUB_REPOSITORY}/archive/<sha>.tar.gz`, with no
|
||||
credentials: access-engine, activity-core, core-hub, coulomb-social, email-connect,
|
||||
glas-harness, hub-core, issue-core, kaizen-agentic, key-cape, net-kingdom,
|
||||
railiance-platform, reuse-surface, sbom-nexus, state-hub, tenant-engine,
|
||||
the-custodian, user-engine, vergabe-teilnahme. Cross-repo fetches as well:
|
||||
core-hub → hub-core, glas-harness → sand-boxer, state-hub → extra repos.
|
||||
Work-record workflows (binky-control, repo-seed, runbook-tutorials) call the
|
||||
forge base URL too. Fix: send the job token (`Authorization: token
|
||||
${{ github.token }}`) for the job's own repository, and a scoped read token for
|
||||
cross-repo fetches. Registry pushes in the same workflows are already
|
||||
authenticated.
|
||||
|
||||
**Package indexes: anonymous reads (breaks).** PyPI `simple/` used without
|
||||
credentials: kaizen-agentic install docs, and vergabe-teilnahme `pyproject.toml` /
|
||||
`uv.lock` (issue-core 0.2.1). npm consumers (whynot-design, markitect
|
||||
testdrive-jsui) already send `NPM_AUTH_TOKEN`.
|
||||
|
||||
**Federation: reuse-surface (breaks).** `registry/federation/sources.yaml` fetches
|
||||
about 60 capability indexes by raw URL, anonymously.
|
||||
|
||||
**Code readers with no token handling found.** activity-core
|
||||
`release_transport.py` (https clone of activity-core and railiance-platform),
|
||||
`owner_return_eligibility.py` (forge API) and `run_artifacts.py`; sbom-nexus
|
||||
`source_fetch.py`; repo-manager `source_ref.py`; frontend-patterns
|
||||
`reference_consume.py`; state-hub `scripts/verify_image_pin.py`. Each owner
|
||||
confirms and re-points it. Token-aware already: state-hub `forge_projection.py`,
|
||||
railiance-platform `forgejo_package_prune.py` and its provisioning scripts.
|
||||
activity-core context resolvers are partly token-aware. Smoke probes of `/v2/`
|
||||
(core-hub, ops-hub) only check reachability.
|
||||
|
||||
**Not consumers.** Runbooks, docs and evidence that mention URLs;
|
||||
`gitea.coulomb.social` references (frozen legacy host); kaizen-agentic project
|
||||
URLs and whynot-design's SSH `repository` field.
|
||||
|
||||
## Not anonymous
|
||||
|
||||
All 160 local clones use SSH with the founder's key (`forgejo-remote`). They keep
|
||||
working as long as that account can read the repositories.
|
||||
|
||||
## Founder checks (presence only, no secret values)
|
||||
|
||||
Agents do not read Secrets, so run these in your own terminal and paste the output.
|
||||
|
||||
1. ArgoCD repository credentials, by name, type and URL only:
|
||||
|
||||
```bash
|
||||
kubectl -n argocd get secrets \
|
||||
-l 'argocd.argoproj.io/secret-type in (repository,repo-creds)' \
|
||||
-o go-template='{{range .items}}{{.metadata.name}} {{index .metadata.labels "argocd.argoproj.io/secret-type"}} {{if .data.url}}{{.data.url | base64decode}}{{end}}{{"\n"}}{{end}}'
|
||||
```
|
||||
|
||||
2. k3s registry configuration on railiance01, as key names with every value
|
||||
stripped:
|
||||
|
||||
```bash
|
||||
ssh railiance01 'sudo test -f /etc/rancher/k3s/registries.yaml \
|
||||
&& sudo sed -nE "s/^([[:space:]]*[A-Za-z0-9_.\"-]+:).*/\1/p" /etc/rancher/k3s/registries.yaml \
|
||||
|| echo absent'
|
||||
```
|
||||
|
||||
`absent`, or no `auth:` under the forge host, means all 43 pulls depend on
|
||||
anonymous registry access today.
|
||||
|
||||
## Still open for T02
|
||||
|
||||
- Live verification: k3s node registry auth, ArgoCD repository credentials, and
|
||||
a fresh runtime capture (the 2026-09-28 capture is the basis here).
|
||||
- Per-entry review of `api-client`, `code-reference` and `ci-runner` hits, to
|
||||
tell anonymous reads from authenticated writes.
|
||||
- The two founder checks above.
|
||||
- Owners confirm the code readers listed under "no token handling found".
|
||||
- Consumers outside these working trees (external sites and links, other
|
||||
people's clones) cannot be found by scanning; T08's anonymous probe after each
|
||||
wave is the backstop.
|
||||
|
|
|
|||
1720
inventory/runtime-2026-10-08.json
Normal file
1720
inventory/runtime-2026-10-08.json
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -146,12 +146,17 @@ Output a machine-readable `inventory/access-consumers-<date>.json` plus a
|
|||
summary listing, per consumer class, the owner and the proposed credential
|
||||
kind. Uncertain entries are flagged, not dropped.
|
||||
|
||||
2026-10-08: first pass done. `tools/access_consumers.py` produced
|
||||
`inventory/access-consumers-2026-10-08.json`, summarised in
|
||||
`inventory/access-consumers.md`. Headline: 40 cluster workloads pull forge images
|
||||
with no `imagePullSecrets`; 6 ArgoCD applications read forge Git; local clones
|
||||
are SSH and unaffected. Open: live check of node registry auth and ArgoCD
|
||||
credentials, and a per-entry review of api-client, code and CI hits.
|
||||
2026-10-08: inventory done except two founder checks. `tools/access_consumers.py`
|
||||
over 161 working trees and a fresh runtime capture (`inventory/runtime-2026-10-08.json`)
|
||||
produced `inventory/access-consumers-2026-10-08.json`, reviewed in
|
||||
`inventory/access-consumers.md`. Breaks on closure: 43 workloads pulling forge
|
||||
images without `imagePullSecrets` (anonymous registry pulls confirmed working);
|
||||
10 ArgoCD applications over 5 repos; CI in about 20 repos downloading source
|
||||
tarballs anonymously; PyPI index reads; reuse-surface federation (about 60 raw
|
||||
indexes); about 8 code readers without token handling; campaign images. Local
|
||||
clones are SSH and unaffected. Open: founder presence checks for ArgoCD
|
||||
repository credentials and k3s node registry auth (commands in the summary),
|
||||
and owner confirmation of the code readers.
|
||||
|
||||
```task
|
||||
id: ORGREF-WP-0002-T03
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue