id: CCR-2026-0046
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Reuse Surface exact seven private-source repository reader
status: approved
created: '2026-10-15'
updated: '2026-10-15'
requester:
  agent: platform-reader-owner delegated preparation worker
  reason: CUST-WP-0081 hosted63/70; founder metadata consent excludes credential provisioning.
    Prepare separate seven-source reader.
review:
  required: true
  required_approvers:
  - platform-operator
  - railiance-forge-owner
  - reuse-surface-owner
  - railiance-apps-owner
  comments: []
target:
  domain: infotech
  tenant: reuse
  workload: reuse-surface
  environment: production
  purpose: Native acquisition of seven owner-consented pinned capability indexes.
    Entire private repository code becomes readable by this dedicated reader; publication
    remains only approved metadata.
openbao:
  mount: platform
  kv_path: platform/workloads/reuse/reuse-surface/forgejo-source-read
  fields:
  - FORGEJO_SOURCE_TOKEN
  - API_USER
  - API_BASE_URL
  - TOKEN_SCOPES
  - GENERATED_AT
  - CCR_ID
  policy_name: workload-kv-read-reuse-surface-runtime-eso
  policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: reuse-surface-runtime-eso
    bound_claims:
      service_account_names:
      - reuse-surface-eso
      service_account_namespaces:
      - reuse
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-reuse-surface-runtime-eso
    ttl: 15m
    audience: openbao
access_frontdoor:
  type: external-secrets
  catalog_id: reuse-surface-forgejo-source-read
  readiness: pending-review
  resolvable: false
delivery:
  surface: external-secrets
  bootstrap_command: warden access openbao-platform-admin-login --exec -- python3
    scripts/provision-reuse-surface-forgejo-source.py --approval <approved-revision-receipt>
    --receipt <0600-durable-receipt>
  provisioning_script: scripts/provision-reuse-surface-forgejo-source.py
  target: Existing namespace-limited store openbao-reuse. Apps owner adds only proposed
    data item into ExternalSecret reuse/reuse-surface-runtime. Shared target reuse-surface-env
    remains intact.
  forgejo_identity: reuse-surface-source
  forgejo_team: reuse-surface-source-readers
  repositories:
  - coulomb/rapp-openbao
  - coulomb/rapp-policy-nexus
  - coulomb/rapp-postgres
  - coulomb/rapp-sbom-nexus
  - coulomb/rapp-telemetry
  - coulomb/rapp-tenant-engine
  - coulomb/rapp-user-engine
  token_scopes:
  - read:repository
  consumer_gate: Reader must not be delivered until reuse-surface owner supplies verified
    image digest containing BOTH authenticated redirect rejection/HTTPS enforcement
    AND runtime-controlled exact URL allowlist checked before credential lookup. Apps
    owner must deploy REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST mapping the reader environment
    to exactly fourteen consented pinned index/entry URLs and inventory existing authenticated
    sources for migration. Current image and redirect-only fix are not approved. Native
    owner helper must verify all seven pinned indexes and entry hashes after rollout.
risk:
  classification: high
  cost_estimate_eur: 0
  notes:
  - Repository grants disclose entire source of these seven repositories to hub; PAT
    cannot restrict access to index files.
  - No all-repositories membership, unrelated private grants, admin privileges or
    repository writes.
  - Existing ESO role expands by one exact data-read path; writer OIDC caller remains
    unchanged and denied new path.
  - Current consumer accepts arbitrary authenticated source URLs and redirects, allowing
    bearer disclosure. Delivery barred until full reviewed redirect/HTTPS and runtime-controlled
    exact URL allowlist patch image plus config is verified.
  - PAT has no server-side expiry; rotate quarterly and immediately upon incident.
  - Bootstrap writes only exact new identity/team/PAT/KV. Policy apply, ESO delivery,
    consumer rollout and registrations require their separate reviewed owner steps.
  - R1 pagination defect preserved; R2 pages until empty with duplicate/count/bound
    checks. Deployed-version live complete-grant inventory remains required; code
    review is not live scope proof.
  - Quarterly rotation is a proposed manual requirement, not deployed expiry enforcement;
    due-date owner task/receipt and separate exact-token recovery approval must be
    established before activation.
verification:
  positive:
  - All seven repositories private; exact team/code-read flags, one dedicated team
    member, exact seven memberships, effective permissions read and exactly one read:repository
    PAT.
  - Each consented index digest matches from authenticated Forgejo read; final hosted
    native owner helper verifies pinned entry hashes as well.
  - OpenBao stdin CAS=0 field write readback matches without printing or persisting
    value.
  - ESO binding and namespace condition surveyed and confirmed; native fixed consumer
    image verified before delivery; final hosted70/70 exactly once.
  negative:
  - Known excluded private rapp-core-hub reader request denied (403/404); administrative
    endpoint and Actions secrets denied.
  - No additional private effective repositories or teams; no write probing that could
    itself cause a change.
  - Scoped writer and default OpenBao identities denied new data path; ESO role denied
    unrelated siblings and wrong SA/namespace/audience login refused.
  - Missing/anonymous native authentication refused with no privileged fallback.
  activation_conditions:
  - Independent platform/Forgejo/reuse/apps owner reviews of exact artifacts and founder
    CCR provisioning disposition recorded; no approval inferred from metadata consent.
  - Confirm existing ESO Kubernetes binding before any delegated metadata apply.
  - Consumer security patch image digest verified and apps rollout artifacts reviewed/approved
    before delivery.
  - Durable bounded bootstrap and positive/negative receipts pass; owner native fetch
    proof passes all seven pinned sources.
  - Separate scoped writer registration batch followed by fresh hosted70/70 completion
    audit.
  evidence: []
lifecycle:
  deactivate: Separate explicitly approved silent scripts/revoke-reuse-surface-forgejo-source.py
    validates reviewed single PAT ID/name, admin PATCH only dedicated user to fresh
    process-memory password, Basic-auth DELETE exact token, then reconciles complete
    inventory absence. Admin PAT/Sudo alone cannot delete. KV/shared runtime Secret
    preserved. Apps/platform owners remove only new ESO item/policy stanza through
    their reviewed path; preserve writer/webhook/public registrations. Recovery helper
    approval is separate from mint/bootstrap approval.
  rotate: Attended owner revokes old identified PAT then governed bootstrap remints
    and verifies; never overwrite differing/orphan KV through bootstrap. Explicit
    scoped CAS update plan required for rotation.
  compromised: Revoke all dedicated service-user PATs, remove delivery data item,
    roll fixed consumer with owners, retain failed sanitized evidence; investigate
    all seven private source exposure. Do not rotate unrelated credentials without
    separate scope.
revision: 2