a570bc2f5b
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
83 lines
5.1 KiB
Markdown
83 lines
5.1 KiB
Markdown
# Seven private-source reader preparation
|
|
|
|
This bundle is prepared under platform's INTENT custody/Q1 remit. Nothing here
|
|
records founder credential approval or another owner's review. The existing
|
|
all-repository core-hub provisioner is precedent only and is never executed.
|
|
|
|
The exact bounded command, after approved CCR, independent reviews and binding
|
|
confirmation, is:
|
|
|
|
```sh
|
|
warden access openbao-platform-admin-login --exec -- python3 scripts/provision-reuse-surface-forgejo-source.py --approval /absolute/path/approved-artifact-receipt.json --receipt /absolute/path/durable-0600-receipt.jsonl
|
|
```
|
|
|
|
An approval receipt must contain `ccr_id: CCR-2026-0046`, `decision: approved`,
|
|
nonempty `supervisor` and `decision_ref`, and `approved_artifacts` mapping exactly
|
|
these four relative paths to SHA256 digests of their approved bytes:
|
|
|
|
- credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml
|
|
- scripts/provision-reuse-surface-forgejo-source.py
|
|
- docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json
|
|
- openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
|
|
|
|
CCR itself must be approved; preparation hashes do not satisfy that gate. This
|
|
local check binds revisions and relies on attended platform lane/supervisor
|
|
custody for authenticity; it is not a signed approval authority or an autopilot
|
|
grant. Metadata apply is separately governed by existing credential-change CLI.
|
|
Bootstrap never applies policy or changes cluster delivery.
|
|
|
|
`apps-externalsecret-data-item.draft.yaml` is a proposed insertion for apps owner,
|
|
not a deployable manifest or an apps review. Existing ESO role reads only one new
|
|
exact data path; caller writer policy is unchanged. Claim confirmation remains
|
|
false until live owner survey. Consumer delivery must wait for the FULL reviewed
|
|
image fixing redirects/HTTPS and runtime-controlled exact source URL allowlist,
|
|
with fourteen consented pinned URLs in REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST.
|
|
|
|
Failure recovery: inspect sanitized journal and authoritative identity/team/PAT/
|
|
KV state quietly. A missing observation is not proof a request did not apply.
|
|
The script refuses orphan PAT/KV state rather than reminting. Revoke only an
|
|
identified dedicated PAT through Forgejo owner's attended recovery; if mint
|
|
response lost, locate its exact recorded attempt-name prefix before revocation.
|
|
Never delete unrelated token or shared runtime Secret. Rotation/recovery of an
|
|
existing KV version requires a separately scoped CAS update plan; this create-only
|
|
bootstrap does not overwrite or automatically rollback ambiguous writes.
|
|
|
|
Known execution gates: provisional IDs must be rechecked against current primary;
|
|
Forgejo owner must confirm the API contracts (team organization username, complete
|
|
sudo user inventory and token_last_eight metadata) on the deployed server; missing
|
|
or differing metadata fails closed. Excluded-private rapp-core-hub must still be
|
|
private. Native verification is a separate consumer-owned proof, not this API
|
|
bootstrap's index-only custody check. New reader provisioning/production approval,
|
|
apps config delta, fixed-image digest, live ESO survey and final70 audit all pending.
|
|
|
|
Revision2 refines the same CCR after a confirmed server-capped pagination defect.
|
|
R1 patch and failed review evidence remain retained; no new scored trial is claimed.
|
|
All list requests now continue until an observed empty page, reject duplicate IDs,
|
|
and reconcile supplied total counts. Forgejo v11.0.3 source confirms user/repos
|
|
includes effective direct/team grants. Stable ID sort is requested for that list.
|
|
Version compatibility and live proof still precede apply.
|
|
|
|
Forgejo11.0.3 token DELETE requires Basic authentication, unlike token inventory GET.
|
|
Admin PAT/Sudo alone is not a valid recovery implementation. The separate reviewed
|
|
recovery must reset only this dedicated user password to fresh process-memory bytes,
|
|
Basic-auth DELETE only the reviewed token ID, and verify absence. Recovery
|
|
helper approval and manual rotation due-date task remain activation gates; no
|
|
deployed quarterly expiry enforcement is claimed.
|
|
|
|
|
|
The separately reviewed executable credential rollback is:
|
|
|
|
```sh
|
|
warden access openbao-platform-admin-login --exec -- python3 scripts/revoke-reuse-surface-forgejo-source.py --approval /absolute/path/approved-exact-token-recovery.json --receipt /absolute/path/durable-0600-recovery.jsonl
|
|
```
|
|
|
|
Its independent approval record names `action: revoke_exact_pat`, the CCR,
|
|
`decision: approved`, supervisor and decision_ref, `target: {id: <reviewed id>,
|
|
name: <exact recorded attempt name>}`, and SHA256s in `approved_artifacts` for
|
|
exactly recovery helper, bootstrap helper, CCR and bootstrap contract. This
|
|
receipt also relies on attended supervisor custody; it is not signed authority.
|
|
Different inventory stops before password mutation. Password stays in memory;
|
|
DELETE uses Basic authorization captured only by the quiet client. Uncertain
|
|
DELETE is followed only by read-only absence reconciliation, never another
|
|
DELETE or mint. KV is deliberately preserved, so rotation needs its separate CAS
|
|
plan. Credential rollback and apps delivery cleanup have independent receipts.
|