From c9fef91f8ca0deaabea55507e7427d1fdfa35e82 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 3 Oct 2026 10:10:35 +0200 Subject: [PATCH] CCR-2026-0031: attended bootstrap passed (PAT read:repository only, probe/denials verified, OpenBao written and read back) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- ...026-0031-core-hub-forgejo-source-read.yaml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml b/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml index 23d96bf..6299614 100644 --- a/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml +++ b/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml @@ -173,6 +173,26 @@ verification: - 'Policy metadata write: sys/policies/acl/workload-kv-read-core-hub-forgejo-source' - 'Auth role metadata write: auth/kubernetes/role/external-secrets-core-hub-forgejo-source' - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-03T08:10:11+00:00' + actor: attended operator via governed platform-admin lane + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as attended operator via governed platform-admin + lane using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-core-hub-forgejo-source' + - 'Auth role metadata write: auth/kubernetes/role/external-secrets-core-hub-forgejo-source' + - No secret values were read, written, printed, or accepted in argv. + - at: '2026-10-03T08:10:16+00:00' + actor: attended operator via governed platform-admin lane + kind: forgejo_source_bootstrap + result: passed + details: + - Restricted user core-hub-source and all-repository repo.code-read team core-hub-source-readers + verified; PAT core-hub-source-read-20261003T081013Z reports exactly read:repository; + private probe coulomb/rapp-openbao branch and archive read passed; effective + permission read-only; Actions-secret and instance-admin probes denied; OpenBao + field written from stdin and read back without value output. lifecycle: deactivate: Delete ExternalSecret and Secret in core-hub, unset publisher.existingSecret, revoke the PAT, disable the auth role, and leave private sources failing closed.