From 963a4f8234f1aeb85101412f7b0a3ca8d57dc0c7 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 3 Oct 2026 10:21:20 +0200 Subject: [PATCH] CCR-2026-0031: positive verification via verify-publisher (errors 9 -> 2, private-source reads work) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- .../CCR-2026-0031-core-hub-forgejo-source-read.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml b/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml index 6299614..dbf5027 100644 --- a/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml +++ b/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml @@ -193,6 +193,15 @@ verification: private probe coulomb/rapp-openbao branch and archive read passed; effective permission read-only; Actions-secret and instance-admin probes denied; OpenBao field written from stdin and read back without value output. + - at: '2026-10-03T08:21:20+00:00' + actor: the-custodian (founder-run deploy, core-hub revision 29) + kind: positive_verification + result: passed + details: + - 'make verify-publisher after core-hub rev 29 (2026-10-03): private-source 404s + gone; accepted 121/123 (was 114), errors 2 (was 9). Remaining 2 are repo-manager + registry identity mismatches (identity-canon, flex-auth rename to access-engine), + not credential faults. 123/0 acceptance tracked with repo-manager.' lifecycle: deactivate: Delete ExternalSecret and Secret in core-hub, unset publisher.existingSecret, revoke the PAT, disable the auth role, and leave private sources failing closed.