Approve Policy Nexus source credential lane

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml

@@ -3,49 +3,74 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Policy Nexus Forgejo private-source read token lane
-status: in_flight
+status: approved
 created: '2026-08-31'
 updated: '2026-08-31'
 requester:
   agent: codex
-  reason: >-
+  reason: PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact archives
-    PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact
+    from private owner repositories. Anonymous Forgejo API/archive reads return 404,
-    archives from private owner repositories. Anonymous Forgejo API/archive
+    while the existing Forgejo admin PAT carries package, repository-write, and admin
-    reads return 404, while the existing Forgejo admin PAT carries package,
+    authority that the publication workflow must not receive.
-    repository-write, and admin authority that the publication workflow must
-    not receive.
 review:
   required: true
   required_approvers:
-    - platform-operator
+  - platform-operator
-    - policy-nexus-owner
+  - policy-nexus-owner
-  comments: []
+  comments:
-in_flight:
+  - at: '2026-08-31T20:51:17+00:00'
-  missing_fields:
+    reviewer: platform operator and Policy Nexus owner (chat approval)
-    - openbao.policy_file
+    decision: approved
-    - openbao.auth
+    comment: 'Approved 2026-08-31: dedicated restricted Forgejo service identity;
-  blocking_reason: >-
+      PAT scope exactly read:repository; all-repository repo.code read team with all
-    The platform owner must choose and verify the attended OpenBao-to-Forgejo
+      non-code units disabled; no package, repository-write, organization-admin, instance-admin,
-    Actions secret-delivery path before policy/auth metadata is generated.
+      cluster, or deployment authority; attended secret custody plus positive and
-  owner: railiance-platform
+      negative verification required.'
+  - at: '2026-08-31T20:51:18+00:00'
+    reviewer: platform operator and Policy Nexus owner (chat approval)
+    decision: binding_confirmed
+    comment: Confirmed reuse of the net-kingdom-admins OIDC group binding with only
+      workload-kv-read-policy-nexus-forgejo-source attached and a 15-minute TTL.
 target:
   domain: infotech
   tenant: coulomb
   workload: policy-nexus-actions
   environment: production
-  purpose: >-
+  purpose: Hold a dedicated Forgejo PAT with read:repository only and deliver it as
-    Hold a dedicated Forgejo PAT with read:repository only and deliver it as
     the FORGEJO_SOURCE_TOKEN secret to the policy-nexus Actions workflow.
 openbao:
   mount: platform
   kv_path: platform/workloads/policy-nexus/forgejo-source-read
   fields:
-    - FORGEJO_SOURCE_TOKEN
+  - FORGEJO_SOURCE_TOKEN
-    - API_USER
+  - API_USER
-    - API_BASE_URL
+  - API_BASE_URL
-    - TOKEN_SCOPES
+  - TOKEN_SCOPES
-    - GENERATED_AT
+  - GENERATED_AT
   policy_name: workload-kv-read-policy-nexus-forgejo-source
+  policy_file: openbao/policies/workload-kv-read-policy-nexus-forgejo-source.hcl
+  auth:
+    method: oidc
+    mount: netkingdom
+    role: policy-nexus-forgejo-source-workload-kv-read
+    allowed_redirect_uris:
+    - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
+    - http://localhost:8250/oidc/callback
+    - http://127.0.0.1:8250/oidc/callback
+    oidc_scopes:
+    - openid
+    - profile
+    - email
+    - groups
+    user_claim: sub
+    groups_claim: groups
+    bound_claims:
+      groups:
+      - net-kingdom-admins
+    bound_claims_confirmed: true
+    policies:
+    - workload-kv-read-policy-nexus-forgejo-source
+    ttl: 15m
 access_frontdoor:
   type: ops-warden
   catalog_id: policy-nexus-forgejo-source-read
@@ -54,55 +79,61 @@ access_frontdoor:
   resolvable: false
 delivery:
   surface: forgejo-actions-secret
-  target: >-
+  target: Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
-    Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
+    Delivery is attended and must not expose the value in command output, process
-    Delivery is attended and must not expose the value in command output,
+    arguments, Git, State Hub, or workflow logs.
-    process arguments, Git, State Hub, or workflow logs.
+  forgejo_identity: policy-nexus-source
+  forgejo_team: policy-nexus-source-readers
+  forgejo_team_contract: Restricted service user; organization team permission read,
+    includes_all_repositories true, can_create_org_repo false, repo.code read, every
+    non-code unit none. PAT scope exactly read:repository.
 risk:
   classification: high
   notes:
-    - The PAT scope is exactly read:repository; no package, repository-write,
+  - The PAT scope is exactly read:repository; no package, repository-write, organization-admin,
-      organization-admin, user-write, cluster, or deployment authority.
+    user-write, cluster, or deployment authority.
-    - REGISTRY_TOKEN remains a separate package-write credential and is never
+  - REGISTRY_TOKEN remains a separate package-write credential and is never reused
-      reused for source acquisition.
+    for source acquisition.
-    - The workflow binds the authorization header to
+  - The workflow binds the authorization header to https://forgejo.coulomb.social
-      https://forgejo.coulomb.social and refuses cross-origin forwarding.
+    and refuses cross-origin forwarding.
-    - The existing Forgejo admin PAT is not an acceptable fallback.
+  - The existing Forgejo admin PAT is not an acceptable fallback.
 verification:
   positive:
-    - >-
+  - A scheduled or dispatched policy-nexus workflow resolves every declared private
-      A scheduled or dispatched policy-nexus workflow resolves every declared
+    repository revision and exact archive, then publishes a candidate.
-      private repository revision and exact archive, then publishes a candidate.
+  - The token metadata reports read:repository and no broader scopes without printing
-    - >-
+    the token value.
-      The token metadata reports read:repository and no broader scopes without
-      printing the token value.
   negative:
-    - The PAT cannot create, update, or delete repository content.
+  - The PAT cannot create, update, or delete repository content.
-    - The PAT cannot write packages or administer users, organizations, hooks,
+  - The PAT cannot write packages or administer users, organizations, hooks, runners,
-      runners, Actions secrets, or the Forgejo instance.
+    Actions secrets, or the Forgejo instance.
-    - A default or unrelated OpenBao identity cannot read the KV data path.
+  - A default or unrelated OpenBao identity cannot read the KV data path.
-    - Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
+  - Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
   activation_conditions:
-    - Platform operator and Policy Nexus owner approve this CCR.
+  - Platform operator and Policy Nexus owner approve this CCR.
-    - A dedicated service identity and read:repository-only PAT are created in
+  - A dedicated service identity and read:repository-only PAT are created in an attended
-      an attended Forgejo session.
+    Forgejo session.
-    - The OpenBao policy/auth path and non-secret metadata are reviewed before
+  - The OpenBao policy/auth path and non-secret metadata are reviewed before apply.
-      apply.
+  - The PAT is transferred directly into OpenBao and the repository Actions secret
-    - The PAT is transferred directly into OpenBao and the repository Actions
+    without logs, chat, Git, State Hub, or persistent temp files.
-      secret without logs, chat, Git, State Hub, or persistent temp files.
+  - Positive and negative scope tests and one workflow run are recorded.
-    - Positive and negative scope tests and one workflow run are recorded.
+  evidence:
+  - at: '2026-08-31T21:03:08+00:00'
+    actor: codex attended operator
+    kind: delegated_metadata_apply
+    result: blocked
+    details:
+    - Approved metadata dry-run passed; two governed platform-admin OIDC attempts
+      failed closed before command handoff; Warden revoked any possible session; no
+      OpenBao mutation or secret provisioning occurred.
 lifecycle:
-  deactivate: >-
+  deactivate: Remove the repository Actions secret, revoke the Forgejo PAT, disable
-    Remove the repository Actions secret, revoke the Forgejo PAT, disable the
+    the OpenBao access path, and leave scheduled publication failing closed.
-    OpenBao access path, and leave scheduled publication failing closed.
+  rotate: Mint a replacement read:repository-only PAT, update OpenBao and the Actions
-  rotate: >-
+    secret through attended custody, pass one candidate build, then revoke the predecessor.
-    Mint a replacement read:repository-only PAT, update OpenBao and the Actions
+  compromised: Remove the Actions secret and revoke the PAT immediately, inspect private
-    secret through attended custody, pass one candidate build, then revoke the
+    repository read activity, rotate through the approved lane, and record a bounded
-    predecessor.
+    incident follow-up.
-  compromised: >-
-    Remove the Actions secret and revoke the PAT immediately, inspect private
-    repository read activity, rotate through the approved lane, and record a
-    bounded incident follow-up.
 state_hub:
   workplan_id: PNEX-WP-0004
   task_id: PNEX-WP-0004-T03

openbao/policies/agent-high-risk-boundary.hcl

@@ -100,3 +100,10 @@ path "auth/token/lookup-self" {
 path "auth/token/revoke-self" {
   capabilities = ["update"]
 }
+path "platform/data/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["deny"]
+}
+
+path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["deny"]
+}

openbao/policies/workload-kv-read-policy-nexus-forgejo-source.hcl

@@ -0,0 +1,7 @@
+path "platform/data/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
+  capabilities = ["read"]
+}