id: CCR-2026-0014
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Policy Nexus Forgejo private-source read token lane
status: in_flight
created: '2026-08-31'
updated: '2026-08-31'
requester:
  agent: codex
  reason: >-
    PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact
    archives from private owner repositories. Anonymous Forgejo API/archive
    reads return 404, while the existing Forgejo admin PAT carries package,
    repository-write, and admin authority that the publication workflow must
    not receive.
review:
  required: true
  required_approvers:
    - platform-operator
    - policy-nexus-owner
  comments: []
in_flight:
  missing_fields:
    - openbao.policy_file
    - openbao.auth
  blocking_reason: >-
    The platform owner must choose and verify the attended OpenBao-to-Forgejo
    Actions secret-delivery path before policy/auth metadata is generated.
  owner: railiance-platform
target:
  domain: infotech
  tenant: coulomb
  workload: policy-nexus-actions
  environment: production
  purpose: >-
    Hold a dedicated Forgejo PAT with read:repository only and deliver it as
    the FORGEJO_SOURCE_TOKEN secret to the policy-nexus Actions workflow.
openbao:
  mount: platform
  kv_path: platform/workloads/policy-nexus/forgejo-source-read
  fields:
    - FORGEJO_SOURCE_TOKEN
    - API_USER
    - API_BASE_URL
    - TOKEN_SCOPES
    - GENERATED_AT
  policy_name: workload-kv-read-policy-nexus-forgejo-source
access_frontdoor:
  type: ops-warden
  catalog_id: policy-nexus-forgejo-source-read
  selector: policy nexus Forgejo private source repository read token Actions
  readiness: pending-review
  resolvable: false
delivery:
  surface: forgejo-actions-secret
  target: >-
    Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
    Delivery is attended and must not expose the value in command output,
    process arguments, Git, State Hub, or workflow logs.
risk:
  classification: high
  notes:
    - The PAT scope is exactly read:repository; no package, repository-write,
      organization-admin, user-write, cluster, or deployment authority.
    - REGISTRY_TOKEN remains a separate package-write credential and is never
      reused for source acquisition.
    - The workflow binds the authorization header to
      https://forgejo.coulomb.social and refuses cross-origin forwarding.
    - The existing Forgejo admin PAT is not an acceptable fallback.
verification:
  positive:
    - >-
      A scheduled or dispatched policy-nexus workflow resolves every declared
      private repository revision and exact archive, then publishes a candidate.
    - >-
      The token metadata reports read:repository and no broader scopes without
      printing the token value.
  negative:
    - The PAT cannot create, update, or delete repository content.
    - The PAT cannot write packages or administer users, organizations, hooks,
      runners, Actions secrets, or the Forgejo instance.
    - A default or unrelated OpenBao identity cannot read the KV data path.
    - Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
  activation_conditions:
    - Platform operator and Policy Nexus owner approve this CCR.
    - A dedicated service identity and read:repository-only PAT are created in
      an attended Forgejo session.
    - The OpenBao policy/auth path and non-secret metadata are reviewed before
      apply.
    - The PAT is transferred directly into OpenBao and the repository Actions
      secret without logs, chat, Git, State Hub, or persistent temp files.
    - Positive and negative scope tests and one workflow run are recorded.
lifecycle:
  deactivate: >-
    Remove the repository Actions secret, revoke the Forgejo PAT, disable the
    OpenBao access path, and leave scheduled publication failing closed.
  rotate: >-
    Mint a replacement read:repository-only PAT, update OpenBao and the Actions
    secret through attended custody, pass one candidate build, then revoke the
    predecessor.
  compromised: >-
    Remove the Actions secret and revoke the PAT immediately, inspect private
    repository read activity, rotate through the approved lane, and record a
    bounded incident follow-up.
state_hub:
  workplan_id: PNEX-WP-0004
  task_id: PNEX-WP-0004-T03