Activate Policy Nexus source credential lane

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Policy Nexus Forgejo private-source read token lane
-status: applied
+status: active
 created: '2026-08-31'
 updated: '2026-08-31'
 requester:
@@ -75,8 +75,8 @@ access_frontdoor:
   type: ops-warden
   catalog_id: policy-nexus-forgejo-source-read
   selector: policy nexus Forgejo private source repository read token Actions
-  readiness: pending-review
-  resolvable: false
+  readiness: ready
+  resolvable: true
 delivery:
   surface: forgejo-actions-secret
   bootstrap_command: warden access openbao-platform-admin-login --exec -- scripts/openbao-bootstrap-policy-nexus-source.sh
@@ -147,6 +147,99 @@ verification:
     - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
     - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
     - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:19:13+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:20:52+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:22:40+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:24:53+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:27:18+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:29:29+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
+    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-08-31T22:29:36+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: forgejo_source_bootstrap
+    result: passed
+    details:
+    - Restricted user policy-nexus-source and all-repository repo.code-read team policy-nexus-source-readers
+      verified; PAT policy-nexus-source-read-20260831T222932Z reports exactly read:repository;
+      archive read passed; effective repository permission is read-only; Actions-secret
+      read and instance-admin probes were denied; OpenBao and repository Actions secret
+      were populated without value output; workflow dispatch run_id=3802.
+  - at: '2026-08-31T23:28:57+00:00'
+    actor: codex via verified Forgejo Actions
+    kind: workflow_verification
+    result: passed
+    details:
+    - Forgejo Actions run 32 succeeded for exact Policy Nexus commit 1e6720b9eeba819b42133afcdfb9693608cddb42
+      after resolving the complete private-source inventory and publishing 65 documents.
+    - Candidate OCI digest sha256:a3a2b7b8b9432535771b588b9c78c554924ec1adc6d5a9bbc1c35b28fea6b724;
+      publication manifest 0af785af708b3698bb7af89aacf246be93031c69566180699c7dfaf1b3e549d3;
+      source inventory 2ff18298f0bd8ce75ca3adcdf09323f136a8ff71a2d55a2e43556d55a0bbf250;
+      source set 5f9e0bb9c19f95927c6bee96ad72f5446cb9a28f188effafe443446c5c07b0b0.
+    - The run used the repository Actions secret and emitted no credential value.
+  - at: '2026-08-31T23:29:23+00:00'
+    actor: codex via installed ops-warden CLI
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - Installed Warden catalog route policy-nexus-forgejo-source-read is active, exact,
+      high-risk, and resolvable with no placeholders.
+    - Warden route and plan select the exact OpenBao path and FORGEJO_SOURCE_TOKEN
+      field; agent callers are limited to sanctioned exec, out, or wrap transports.
+    - 'The complete ops-warden suite passed: 406 selected tests, including the generated
+      high-risk data-path boundary.'
 lifecycle:
   deactivate: Remove the repository Actions secret, revoke the Forgejo PAT, disable
     the OpenBao access path, and leave scheduled publication failing closed.