---
id: RAILIANCE-WP-0013
type: workplan
title: "Forgejo admin PAT OpenBao consumer cutover"
domain: financials
repo: railiance-platform
status: active
owner: codex
topic_slug: railiance
created: "2026-07-25"
updated: "2026-07-25"
related_repos:
  - activity-core
  - ops-warden
state_hub_workstream_id: "38fa254d-cd56-498a-8385-f9673ec005ac"
---

# RAILIANCE-WP-0013 - Forgejo admin PAT OpenBao consumer cutover

## Goal

Cut the Forgejo package-prune consumer over from workstation-local PAT handling
to the approved OpenBao lane recorded in `CCR-2026-0006`.

The immediate trigger is the unread `ops-warden` coordination message from
July 12, 2026 requesting that `tools/cmd/forgejo-package-prune` stop depending
on `/tmp/forgejo-tegwick-api-token` as the steady-state fallback when
`FORGEJO_ADMIN_TOKEN` is unset.

## Boundaries

This workplan may:

- update the Forgejo package-prune token resolution path
- update package-prune runbooks and operator handoff docs
- coordinate the consumer contract with the approved credential lane

It must not:

- move platform secret-governance ownership out of `railiance-platform`
- paste token values into Git, State Hub, chat, shell history, or logs
- break the existing prune workflow before the replacement path is verified

## T01 - Inventory current consumer and fallback paths

```task
id: RAILIANCE-WP-0013-T01
status: todo
priority: medium
state_hub_task_id: "68131f3b-cb97-4aa9-abbb-cddb1e395703"
```

Record where the current Forgejo admin PAT is consumed and documented, including:

- `scripts/forgejo_package_prune.py`
- `tools/cmd/forgejo-package-prune`
- `docs/forgejo-package-prune.md`
- any activity-core automation handoff that still assumes workstation file drops

Done when the remaining `/tmp/forgejo-tegwick-api-token` dependency surface is explicit.

## T02 - Implement the approved non-file fallback path

```task
id: RAILIANCE-WP-0013-T02
status: todo
priority: high
state_hub_task_id: "f67a58e5-d780-4226-97a8-4c669b47e4a4"
```

Change the package-prune consumer so that, when `FORGEJO_TOKEN` and
`FORGEJO_ADMIN_TOKEN` are unset, it uses the approved OpenBao-backed access
path rather than the workstation file as the steady-state fallback.

Done when the token loader prefers the approved lane and the old file drop is
demoted to break-glass or removed if no longer needed.

## T03 - Update operator guidance and lane references

```task
id: RAILIANCE-WP-0013-T03
status: todo
priority: medium
state_hub_task_id: "ed5f791c-5beb-43bd-844b-4188b604bc3f"
```

Refresh the operator docs so they align with `CCR-2026-0006`, the routing
catalog, and the final consumer behavior.

Done when the package-prune runbook no longer presents the workstation file as
the primary path.

## T04 - Verify prune workflow and close the inbox request

```task
id: RAILIANCE-WP-0013-T04
status: wait
priority: medium
state_hub_task_id: "1fc2af0f-b4ff-4694-b072-23af0254377e"
```

Blocked on T01-T03.

Verify the consumer cutover with a non-secret dry-run and close the originating
coordination loop from `ops-warden`.

Done when the replacement path is verified and the old unread message has a
clear repo-local follow-up trail.