id: CCR-2026-0014
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Policy Nexus Forgejo private-source read token lane
status: active
created: '2026-08-31'
updated: '2026-08-31'
requester:
  agent: codex
  reason: PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact archives
    from private owner repositories. Anonymous Forgejo API/archive reads return 404,
    while the existing Forgejo admin PAT carries package, repository-write, and admin
    authority that the publication workflow must not receive.
review:
  required: true
  required_approvers:
  - platform-operator
  - policy-nexus-owner
  comments:
  - at: '2026-08-31T20:51:17+00:00'
    reviewer: platform operator and Policy Nexus owner (chat approval)
    decision: approved
    comment: 'Approved 2026-08-31: dedicated restricted Forgejo service identity;
      PAT scope exactly read:repository; all-repository repo.code read team with all
      non-code units disabled; no package, repository-write, organization-admin, instance-admin,
      cluster, or deployment authority; attended secret custody plus positive and
      negative verification required.'
  - at: '2026-08-31T20:51:18+00:00'
    reviewer: platform operator and Policy Nexus owner (chat approval)
    decision: binding_confirmed
    comment: Confirmed reuse of the net-kingdom-admins OIDC group binding with only
      workload-kv-read-policy-nexus-forgejo-source attached and a 15-minute TTL.
target:
  domain: infotech
  tenant: coulomb
  workload: policy-nexus-actions
  environment: production
  purpose: Hold a dedicated Forgejo PAT with read:repository only and deliver it as
    the FORGEJO_SOURCE_TOKEN secret to the policy-nexus Actions workflow.
openbao:
  mount: platform
  kv_path: platform/workloads/policy-nexus/forgejo-source-read
  fields:
  - FORGEJO_SOURCE_TOKEN
  - API_USER
  - API_BASE_URL
  - TOKEN_SCOPES
  - GENERATED_AT
  policy_name: workload-kv-read-policy-nexus-forgejo-source
  policy_file: openbao/policies/workload-kv-read-policy-nexus-forgejo-source.hcl
  auth:
    method: oidc
    mount: netkingdom
    role: policy-nexus-forgejo-source-workload-kv-read
    allowed_redirect_uris:
    - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
    - http://localhost:8250/oidc/callback
    - http://127.0.0.1:8250/oidc/callback
    oidc_scopes:
    - openid
    - profile
    - email
    - groups
    user_claim: sub
    groups_claim: groups
    bound_claims:
      groups:
      - net-kingdom-admins
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-policy-nexus-forgejo-source
    ttl: 15m
access_frontdoor:
  type: ops-warden
  catalog_id: policy-nexus-forgejo-source-read
  selector: policy nexus Forgejo private source repository read token Actions
  readiness: ready
  resolvable: true
delivery:
  surface: forgejo-actions-secret
  bootstrap_command: warden access openbao-platform-admin-login --exec -- scripts/openbao-bootstrap-policy-nexus-source.sh
  target: Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
    Delivery is attended and must not expose the value in command output, process
    arguments, Git, State Hub, or workflow logs.
  forgejo_identity: policy-nexus-source
  forgejo_team: policy-nexus-source-readers
  forgejo_team_contract: Restricted service user; organization team permission read,
    includes_all_repositories true, can_create_org_repo false, repo.code read, every
    non-code unit none. PAT scope exactly read:repository.
risk:
  classification: high
  notes:
  - The PAT scope is exactly read:repository; no package, repository-write, organization-admin,
    user-write, cluster, or deployment authority.
  - REGISTRY_TOKEN remains a separate package-write credential and is never reused
    for source acquisition.
  - The workflow binds the authorization header to https://forgejo.coulomb.social
    and refuses cross-origin forwarding.
  - The existing Forgejo admin PAT is not an acceptable fallback.
verification:
  positive:
  - A scheduled or dispatched policy-nexus workflow resolves every declared private
    repository revision and exact archive, then publishes a candidate.
  - The token metadata reports read:repository and no broader scopes without printing
    the token value.
  negative:
  - The PAT cannot create, update, or delete repository content.
  - The PAT cannot write packages or administer users, organizations, hooks, runners,
    Actions secrets, or the Forgejo instance.
  - A default or unrelated OpenBao identity cannot read the KV data path.
  - Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
  activation_conditions:
  - Platform operator and Policy Nexus owner approve this CCR.
  - A dedicated service identity and read:repository-only PAT are created in an attended
    Forgejo session.
  - The OpenBao policy/auth path and non-secret metadata are reviewed before apply.
  - The PAT is transferred directly into OpenBao and the repository Actions secret
    without logs, chat, Git, State Hub, or persistent temp files.
  - Positive and negative scope tests and one workflow run are recorded.
  evidence:
  - at: '2026-08-31T21:03:08+00:00'
    actor: codex attended operator
    kind: delegated_metadata_apply
    result: blocked
    details:
    - Approved metadata dry-run passed; two governed platform-admin OIDC attempts
      failed closed before command handoff; Warden revoked any possible session; no
      OpenBao mutation or secret provisioning occurred.
  - at: '2026-08-31T21:26:07+00:00'
    actor: codex attended operator
    kind: attended_oidc_handoff
    result: blocked
    details:
    - Canonical bootstrap command from railiance-platform commit 1b85a3e failed closed
      before child handoff; Warden revoked any possible session. OpenBao is initialized/unsealed
      and its public health endpoint returns 200; the KeyCape openbao-admin authorize
      path returns 302. No Forgejo identity, PAT, OpenBao secret value, Actions secret,
      or workflow run was created.
  - at: '2026-08-31T22:15:50+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:19:13+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:20:52+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:22:40+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:24:53+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:27:18+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:29:29+00:00'
    actor: attended operator via governed platform-admin lane
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as attended operator via governed platform-admin
      lane using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-policy-nexus-forgejo-source'
    - 'Auth role metadata write: auth/netkingdom/role/policy-nexus-forgejo-source-workload-kv-read'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-08-31T22:29:36+00:00'
    actor: attended operator via governed platform-admin lane
    kind: forgejo_source_bootstrap
    result: passed
    details:
    - Restricted user policy-nexus-source and all-repository repo.code-read team policy-nexus-source-readers
      verified; PAT policy-nexus-source-read-20260831T222932Z reports exactly read:repository;
      archive read passed; effective repository permission is read-only; Actions-secret
      read and instance-admin probes were denied; OpenBao and repository Actions secret
      were populated without value output; workflow dispatch run_id=3802.
  - at: '2026-08-31T23:28:57+00:00'
    actor: codex via verified Forgejo Actions
    kind: workflow_verification
    result: passed
    details:
    - Forgejo Actions run 32 succeeded for exact Policy Nexus commit 1e6720b9eeba819b42133afcdfb9693608cddb42
      after resolving the complete private-source inventory and publishing 65 documents.
    - Candidate OCI digest sha256:a3a2b7b8b9432535771b588b9c78c554924ec1adc6d5a9bbc1c35b28fea6b724;
      publication manifest 0af785af708b3698bb7af89aacf246be93031c69566180699c7dfaf1b3e549d3;
      source inventory 2ff18298f0bd8ce75ca3adcdf09323f136a8ff71a2d55a2e43556d55a0bbf250;
      source set 5f9e0bb9c19f95927c6bee96ad72f5446cb9a28f188effafe443446c5c07b0b0.
    - The run used the repository Actions secret and emitted no credential value.
  - at: '2026-08-31T23:29:23+00:00'
    actor: codex via installed ops-warden CLI
    kind: frontdoor_activation
    result: passed
    details:
    - Installed Warden catalog route policy-nexus-forgejo-source-read is active, exact,
      high-risk, and resolvable with no placeholders.
    - Warden route and plan select the exact OpenBao path and FORGEJO_SOURCE_TOKEN
      field; agent callers are limited to sanctioned exec, out, or wrap transports.
    - 'The complete ops-warden suite passed: 406 selected tests, including the generated
      high-risk data-path boundary.'
lifecycle:
  deactivate: Remove the repository Actions secret, revoke the Forgejo PAT, disable
    the OpenBao access path, and leave scheduled publication failing closed.
  rotate: Mint a replacement read:repository-only PAT, update OpenBao and the Actions
    secret through attended custody, pass one candidate build, then revoke the predecessor.
  compromised: Remove the Actions secret and revoke the PAT immediately, inspect private
    repository read activity, rotate through the approved lane, and record a bounded
    incident follow-up.
state_hub:
  workplan_id: PNEX-WP-0004
  task_id: PNEX-WP-0004-T03