coulomb/prj-state-hub-retirement
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

T07: a third registry service — npm — behind a high-risk credential lane

Browse source 
The file sweep found the OCI registry and the PyPI index. Sweeping ops-warden's
routing catalog found what files could not: gitea.coulomb.social also serves an
npm registry at /api/packages/coulomb/npm/, and the catalog lane
whynot-design-npm-publish (risk: high, production-exercised) vends the token that
publishes @whynot/design to it.

After 2026-08-31 that lane routes to a registry that does not exist, and it does
not fail safe — an operator following it gets a working token for a dead endpoint
and debugs the token.

CI runners remain unswept; railiance-forge/tools/gitea-runner-status.sh suggests
gitea-registered Actions runners exist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 09:10:34 +02:00
parent 9f4caa1c09
commit 8a54c27cd9
1 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

35
workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
View file

@ -312,9 +312,38 @@ permits `sourceRepos: https://gitea.coulomb.social/coulomb/*.git`. railiance01
has no ArgoCD `applications` resource type, so this appears inert — but it is a has no ArgoCD `applications` resource type, so this appears inert — but it is a
bootstrap file and should be confirmed rather than assumed. bootstrap file and should be confirmed rather than assumed.
**Not swept:** CI runners and any credential lane authenticating *to* gitea. ### Credential-lane sweep, 2026-08-20 — a *third* registry service
`ops-warden`'s catalog carries `forgejo-admin-api-token`; whether a
gitea-specific equivalent exists was not checked. Checking ops-warden's routing catalog found what the file sweep could not: the
host serves **three** package services, not two.
`gitea.coulomb.social/api/packages/coulomb/npm/` is an **npm registry**, and
ops-warden's catalog lane `whynot-design-npm-publish` — `risk: high`,
production-exercised (WP-0018 published `@whynot/design@0.4.0` through it) —
vends the `NPM_AUTH_TOKEN` that publishes to it.
So the complete CoulombCore package surface is:
| Service | Endpoint | Known consumers |
| --- | --- | --- |
| OCI container registry | `gitea.coulomb.social/coulomb/…` | `reuse-surface` (live Deployment) |
| PyPI index | `…/api/packages/coulomb/pypi` | `kaizen-agentic` (never migrated), `issue-core` (legacy half) |
| **npm registry** | `…/api/packages/coulomb/npm/` | `@whynot/design` via ops-warden lane `whynot-design-npm-publish` |
**Consequence for the credential lane:** after 2026-08-31 that lane routes to a
registry that does not exist. It does not fail safe — an operator following it
gets a token for a dead endpoint and debugs the token. `forgejo-admin-api-token`
already exists as the forgejo-side equivalent and its keywords include
`forgejo-npm`, so the destination is plausibly in place; ops-warden must confirm
rather than assume, and cannot repoint the lane before the packages are on
forgejo — the same publish-before-repoint rule as `KAIZEN-WP-0010`.
Routed to ops-warden (lane owner for the catalog entry; `railiance-platform`
owns the credential itself).
**Still not swept:** CI runners. `railiance-forge/tools/gitea-runner-status.sh`
suggests gitea-registered Actions runners exist; whether any repo's pipelines
depend on them was not established.
`forgejo.coulomb.social` is already on railiance01, so the work is retag, push, `forgejo.coulomb.social` is already on railiance01, so the work is retag, push,
update manifest. Routed to `railiance-platform`; ownership of the `reuse-surface` update manifest. Routed to `railiance-platform`; ownership of the `reuse-surface`