docs: request policy nexus source-read token

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml

@@ -0,0 +1,108 @@
+id: CCR-2026-0014
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Policy Nexus Forgejo private-source read token lane
+status: in_flight
+created: '2026-08-31'
+updated: '2026-08-31'
+requester:
+  agent: codex
+  reason: >-
+    PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact
+    archives from private owner repositories. Anonymous Forgejo API/archive
+    reads return 404, while the existing Forgejo admin PAT carries package,
+    repository-write, and admin authority that the publication workflow must
+    not receive.
+review:
+  required: true
+  required_approvers:
+    - platform-operator
+    - policy-nexus-owner
+  comments: []
+in_flight:
+  missing_fields:
+    - openbao.policy_file
+    - openbao.auth
+  blocking_reason: >-
+    The platform owner must choose and verify the attended OpenBao-to-Forgejo
+    Actions secret-delivery path before policy/auth metadata is generated.
+  owner: railiance-platform
+target:
+  domain: infotech
+  tenant: coulomb
+  workload: policy-nexus-actions
+  environment: production
+  purpose: >-
+    Hold a dedicated Forgejo PAT with read:repository only and deliver it as
+    the FORGEJO_SOURCE_TOKEN secret to the policy-nexus Actions workflow.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/policy-nexus/forgejo-source-read
+  fields:
+    - FORGEJO_SOURCE_TOKEN
+    - API_USER
+    - API_BASE_URL
+    - TOKEN_SCOPES
+    - GENERATED_AT
+  policy_name: workload-kv-read-policy-nexus-forgejo-source
+access_frontdoor:
+  type: ops-warden
+  catalog_id: policy-nexus-forgejo-source-read
+  selector: policy nexus Forgejo private source repository read token Actions
+  readiness: pending-review
+  resolvable: false
+delivery:
+  surface: forgejo-actions-secret
+  target: >-
+    Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
+    Delivery is attended and must not expose the value in command output,
+    process arguments, Git, State Hub, or workflow logs.
+risk:
+  classification: high
+  notes:
+    - The PAT scope is exactly read:repository; no package, repository-write,
+      organization-admin, user-write, cluster, or deployment authority.
+    - REGISTRY_TOKEN remains a separate package-write credential and is never
+      reused for source acquisition.
+    - The workflow binds the authorization header to
+      https://forgejo.coulomb.social and refuses cross-origin forwarding.
+    - The existing Forgejo admin PAT is not an acceptable fallback.
+verification:
+  positive:
+    - >-
+      A scheduled or dispatched policy-nexus workflow resolves every declared
+      private repository revision and exact archive, then publishes a candidate.
+    - >-
+      The token metadata reports read:repository and no broader scopes without
+      printing the token value.
+  negative:
+    - The PAT cannot create, update, or delete repository content.
+    - The PAT cannot write packages or administer users, organizations, hooks,
+      runners, Actions secrets, or the Forgejo instance.
+    - A default or unrelated OpenBao identity cannot read the KV data path.
+    - Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
+  activation_conditions:
+    - Platform operator and Policy Nexus owner approve this CCR.
+    - A dedicated service identity and read:repository-only PAT are created in
+      an attended Forgejo session.
+    - The OpenBao policy/auth path and non-secret metadata are reviewed before
+      apply.
+    - The PAT is transferred directly into OpenBao and the repository Actions
+      secret without logs, chat, Git, State Hub, or persistent temp files.
+    - Positive and negative scope tests and one workflow run are recorded.
+lifecycle:
+  deactivate: >-
+    Remove the repository Actions secret, revoke the Forgejo PAT, disable the
+    OpenBao access path, and leave scheduled publication failing closed.
+  rotate: >-
+    Mint a replacement read:repository-only PAT, update OpenBao and the Actions
+    secret through attended custody, pass one candidate build, then revoke the
+    predecessor.
+  compromised: >-
+    Remove the Actions secret and revoke the PAT immediately, inspect private
+    repository read activity, rotate through the approved lane, and record a
+    bounded incident follow-up.
+state_hub:
+  workplan_id: PNEX-WP-0004
+  task_id: PNEX-WP-0004-T03