From b11855f64cf0c0d5090be3f7afc487f3013f6cf6 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 21 Jul 2026 23:19:10 +0200
Subject: [PATCH] Document activity-core ESO read of forgejo-admin

Extend external-secrets-activity-core policy notes with forgejo-admin
paths used by activity-core actcore-forgejo-admin ExternalSecret
(ACTIVITY-WP-0023-T05).
---
 .../policies/external-secrets-activity-core.hcl    | 14 ++++++++++++++
 .../policies/workload-kv-read-forgejo-admin.hcl    |  6 +++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/openbao/policies/external-secrets-activity-core.hcl b/openbao/policies/external-secrets-activity-core.hcl
index 8e29ec9..7955037 100644
--- a/openbao/policies/external-secrets-activity-core.hcl
+++ b/openbao/policies/external-secrets-activity-core.hcl
@@ -3,6 +3,12 @@
 # Covers:
 #   - llm-connect provider secrets (OPENROUTER_API_KEY)
 #   - shared issue-core ingestion key for activity-core IssueSink emission
+#   - forgejo-admin PAT for weekly package prune (FORGEJO_TOKEN)
+#
+# Live ESO token on railiance01 currently attaches the finer-grained sibling
+# policies (workload-kv-read-issue-core-runtime + workload-kv-read-forgejo-admin)
+# via activity-core scripts/openbao-eso-token-apply.sh. This combined policy is
+# the documented target set for the openbao-activity-core ClusterSecretStore.
 
 path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
   capabilities = ["read"]
@@ -18,4 +24,12 @@ path "platform/data/workloads/issue-core/issue-core/issue-core-runtime" {
 
 path "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" {
   capabilities = ["read"]
+}
+
+path "platform/data/workloads/forgejo/forgejo-admin" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/forgejo/forgejo-admin" {
+  capabilities = ["read"]
 }
\ No newline at end of file
diff --git a/openbao/policies/workload-kv-read-forgejo-admin.hcl b/openbao/policies/workload-kv-read-forgejo-admin.hcl
index 3ca7adb..8351bc5 100644
--- a/openbao/policies/workload-kv-read-forgejo-admin.hcl
+++ b/openbao/policies/workload-kv-read-forgejo-admin.hcl
@@ -2,7 +2,11 @@
 #
 # Grants read access to the site-admin PAT used by workstation and activity-core
 # automation (package prune, org webhooks, operator bootstrap). Sibling to
-# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1.
+# forgejo-mailer (SMTP).
+#
+# Cluster delivery (ACTIVITY-WP-0023-T05): attached to the
+# openbao-activity-core ESO token so ExternalSecret actcore-forgejo-admin can
+# merge FORGEJO_TOKEN into actcore-runtime-secret.
 
 path "platform/data/workloads/forgejo/forgejo-admin" {
   capabilities = ["read"]