coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORGREF-WP-0002-T02: first anonymous-consumer inventory

Browse source 
40 cluster workloads pull forge images without imagePullSecrets, 6 ArgoCD
applications read forge Git; local clones are SSH. Live credential checks and
per-entry review remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 16:37:33 +02:00
parent 64486863ab
commit f91cbca461
5 changed files with 8421 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8117
inventory/access-consumers-2026-10-08.json Normal file
View file

File diff suppressed because it is too large Load diff

46
inventory/access-consumers.md Normal file
View file

@ -0,0 +1,46 @@
# Anonymous forge consumers — ORGREF-WP-0002-T02
Machine-readable result: `access-consumers-2026-10-08.json`. Reproduce:
```bash
python3 tools/access_consumers.py --root /home/worsch \
--runtime inventory/runtime-2026-09-28.json \
--output inventory/access-consumers-2026-10-08.json
```
Read-only: 161 local working trees scanned, plus the 2026-09-28 runtime capture
(not a live read). Secrets, ArgoCD repository credentials and node registry
configuration were not inspected.
## What breaks when repositories and packages go private
| Class | Count | Reads | Will need |
| --- | --- | --- | --- |
| cluster-image-pull | 40 workloads in 21 namespaces | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`), which is unverified |
| cluster-gitops | 6 ArgoCD applications | Git sources on the forge | ArgoCD repository credentials (current state unverified) |
| ci-runner | 27 hits in workflow files | checkouts, reusable actions, registry | runner or job tokens for cross-repo reads |
| api-client | 25 hits | `/api/v1` calls (state-hub, railiance-*, ops-warden, issue-core, …) | per-service tokens; check which calls are anonymous today |
| raw-file-fetch | 68 hits, 63 in `reuse-surface` | raw files by URL | authenticated fetch, or move the published content to a public location |
| raw-file-fetch (campaign) | pr-hall-of-helix, fluid-telegram | Telegram fetching post images | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) |
| package-consumer | 2 (kaizen-agentic, whynot-design) | modules or packages from the forge | package-registry credentials |
Lower risk, review only: `repo-gitops` (15) and `repo-image-reference` (91) are
the same cluster consumers seen from their source repos. `code-reference` (24),
`config-reference` (98) and `build-tooling` (23) are mostly URLs and pushes that
need a per-entry look. `doc-link` (119) means links break for the public, not
consumers. `record-or-test` (103) is evidence and fixtures.
## Not anonymous
All 160 local clones use SSH with the founder's key (`forgejo-remote`). They keep
working as long as that account can read the repositories.
## Still open for T02
- Live verification: k3s node registry auth, ArgoCD repository credentials, and
a fresh runtime capture (the 2026-09-28 capture is the basis here).
- Per-entry review of `api-client`, `code-reference` and `ci-runner` hits, to
tell anonymous reads from authenticated writes.
- Consumers outside these working trees (external sites and links, other
people's clones) cannot be found by scanning; T08's anonymous probe after each
wave is the backstop.