Cut forgejo package prune over to OpenBao lane

workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Forgejo admin PAT OpenBao consumer cutover"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-07-25"
-updated: "2026-07-25"
+updated: "2026-07-26"
 related_repos:
   - activity-core
   - ops-warden
@@ -45,7 +45,7 @@ It must not:
 
 ```task
 id: RAILIANCE-WP-0013-T01
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "68131f3b-cb97-4aa9-abbb-cddb1e395703"
 ```
@@ -59,11 +59,16 @@ Record where the current Forgejo admin PAT is consumed and documented, including
 
 Done when the remaining `/tmp/forgejo-tegwick-api-token` dependency surface is explicit.
 
+2026-07-26: Confirmed the remaining legacy surface in
+`scripts/forgejo_package_prune.py` and `docs/forgejo-package-prune.md`; the
+approved lane reference already lived in `CCR-2026-0006` and
+`docs/workload-kv-access-lanes.md`.
+
 ## T02 - Implement the approved non-file fallback path
 
 ```task
 id: RAILIANCE-WP-0013-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f67a58e5-d780-4226-97a8-4c669b47e4a4"
 ```
@@ -75,11 +80,18 @@ path rather than the workstation file as the steady-state fallback.
 Done when the token loader prefers the approved lane and the old file drop is
 demoted to break-glass or removed if no longer needed.
 
+2026-07-26: `scripts/forgejo_package_prune.py` now resolves
+`platform/workloads/forgejo/forgejo-admin` field `API_TOKEN` through `bao kv get`
+when `FORGEJO_TOKEN` and `FORGEJO_ADMIN_TOKEN` are unset. Explicit
+`FORGEJO_TOKEN_FILE` / `FORGEJO_ADMIN_TOKEN_FILE` remain supported as attended
+break-glass handoffs, and `/tmp/forgejo-tegwick-api-token` only works when
+`FORGEJO_ALLOW_LEGACY_FILE_FALLBACK=1` is set.
+
 ## T03 - Update operator guidance and lane references
 
 ```task
 id: RAILIANCE-WP-0013-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ed5f791c-5beb-43bd-844b-4188b604bc3f"
 ```
@@ -90,11 +102,16 @@ catalog, and the final consumer behavior.
 Done when the package-prune runbook no longer presents the workstation file as
 the primary path.
 
+2026-07-26: Updated `docs/forgejo-package-prune.md` so the primary operator path
+is `warden plan` + `bao login` against `forgejo-admin-workload-kv-read`; the
+retired `/tmp` drop is now documented as legacy unwind only, with explicit
+break-glass env/file overrides kept for attended sessions.
+
 ## T04 - Verify prune workflow and close the inbox request
 
 ```task
 id: RAILIANCE-WP-0013-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "1fc2af0f-b4ff-4694-b072-23af0254377e"
 ```
@@ -106,3 +123,17 @@ coordination loop from `ops-warden`.
 
 Done when the replacement path is verified and the old unread message has a
 clear repo-local follow-up trail.
+
+2026-07-26: Added focused token-resolution coverage in
+`tests/test_forgejo_package_prune.py` for direct env, explicit file overrides,
+OpenBao fallback, legacy-file gating, and operator-facing failure text. This
+closes the `ops-warden` coordination loop triggered by message
+`5be8e500-ebf5-405b-9aec-c902353ae719`; the repo-local follow-up trail is now in
+this workplan, the prune runbook, and the loader implementation.
+
+## Acceptance
+
+- [x] `forgejo-package-prune` no longer defaults to `/tmp/forgejo-tegwick-api-token`
+- [x] The steady-state fallback path reads the approved OpenBao lane from `CCR-2026-0006`
+- [x] Operator docs present OpenBao / `warden` routing as the primary path
+- [x] Repo-local tests cover the new token-resolution behavior without reading secret values