From 6d49061bfc79e8d933800ce7f11a04b2235a8f0f Mon Sep 17 00:00:00 2001
From: custodian-sync <custodian-sync@railiance.local>
Date: Sat, 25 Jul 2026 10:42:31 +0200
Subject: [PATCH] chore(consistency): renormalize lifecycle state [auto]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updated by fix-consistency on 2026-07-25:
  - workplan status: ready → active
---
 ...-0013-forgejo-admin-pat-openbao-cutover.md | 108 ++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md

diff --git a/workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md b/workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md
new file mode 100644
index 0000000..aa3bb99
--- /dev/null
+++ b/workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md
@@ -0,0 +1,108 @@
+---
+id: RAILIANCE-WP-0013
+type: workplan
+title: "Forgejo admin PAT OpenBao consumer cutover"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-07-25"
+updated: "2026-07-25"
+related_repos:
+  - activity-core
+  - ops-warden
+state_hub_workstream_id: "38fa254d-cd56-498a-8385-f9673ec005ac"
+---
+
+# RAILIANCE-WP-0013 - Forgejo admin PAT OpenBao consumer cutover
+
+## Goal
+
+Cut the Forgejo package-prune consumer over from workstation-local PAT handling
+to the approved OpenBao lane recorded in `CCR-2026-0006`.
+
+The immediate trigger is the unread `ops-warden` coordination message from
+July 12, 2026 requesting that `tools/cmd/forgejo-package-prune` stop depending
+on `/tmp/forgejo-tegwick-api-token` as the steady-state fallback when
+`FORGEJO_ADMIN_TOKEN` is unset.
+
+## Boundaries
+
+This workplan may:
+
+- update the Forgejo package-prune token resolution path
+- update package-prune runbooks and operator handoff docs
+- coordinate the consumer contract with the approved credential lane
+
+It must not:
+
+- move platform secret-governance ownership out of `railiance-platform`
+- paste token values into Git, State Hub, chat, shell history, or logs
+- break the existing prune workflow before the replacement path is verified
+
+## T01 - Inventory current consumer and fallback paths
+
+```task
+id: RAILIANCE-WP-0013-T01
+status: todo
+priority: medium
+state_hub_task_id: "68131f3b-cb97-4aa9-abbb-cddb1e395703"
+```
+
+Record where the current Forgejo admin PAT is consumed and documented, including:
+
+- `scripts/forgejo_package_prune.py`
+- `tools/cmd/forgejo-package-prune`
+- `docs/forgejo-package-prune.md`
+- any activity-core automation handoff that still assumes workstation file drops
+
+Done when the remaining `/tmp/forgejo-tegwick-api-token` dependency surface is explicit.
+
+## T02 - Implement the approved non-file fallback path
+
+```task
+id: RAILIANCE-WP-0013-T02
+status: todo
+priority: high
+state_hub_task_id: "f67a58e5-d780-4226-97a8-4c669b47e4a4"
+```
+
+Change the package-prune consumer so that, when `FORGEJO_TOKEN` and
+`FORGEJO_ADMIN_TOKEN` are unset, it uses the approved OpenBao-backed access
+path rather than the workstation file as the steady-state fallback.
+
+Done when the token loader prefers the approved lane and the old file drop is
+demoted to break-glass or removed if no longer needed.
+
+## T03 - Update operator guidance and lane references
+
+```task
+id: RAILIANCE-WP-0013-T03
+status: todo
+priority: medium
+state_hub_task_id: "ed5f791c-5beb-43bd-844b-4188b604bc3f"
+```
+
+Refresh the operator docs so they align with `CCR-2026-0006`, the routing
+catalog, and the final consumer behavior.
+
+Done when the package-prune runbook no longer presents the workstation file as
+the primary path.
+
+## T04 - Verify prune workflow and close the inbox request
+
+```task
+id: RAILIANCE-WP-0013-T04
+status: wait
+priority: medium
+state_hub_task_id: "1fc2af0f-b4ff-4694-b072-23af0254377e"
+```
+
+Blocked on T01-T03.
+
+Verify the consumer cutover with a non-secret dry-run and close the originating
+coordination loop from `ops-warden`.
+
+Done when the replacement path is verified and the old unread message has a
+clear repo-local follow-up trail.