codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
139 lines
4.7 KiB
Markdown
139 lines
4.7 KiB
Markdown
---
|
|
id: RPF-WP-0007
|
|
type: workplan
|
|
title: "Forgejo admin PAT OpenBao consumer cutover"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-25"
|
|
updated: "2026-07-26"
|
|
related_repos:
|
|
- activity-core
|
|
- ops-warden
|
|
state_hub_workstream_id: "f4fd52ba-4e84-52e7-a8d7-667b72d3cc1b"
|
|
---
|
|
|
|
# RPF-WP-0007 - Forgejo admin PAT OpenBao consumer cutover
|
|
|
|
## Goal
|
|
|
|
Cut the Forgejo package-prune consumer over from workstation-local PAT handling
|
|
to the approved OpenBao lane recorded in `CCR-2026-0006`.
|
|
|
|
The immediate trigger is the unread `ops-warden` coordination message from
|
|
July 12, 2026 requesting that `tools/cmd/forgejo-package-prune` stop depending
|
|
on `/tmp/forgejo-tegwick-api-token` as the steady-state fallback when
|
|
`FORGEJO_ADMIN_TOKEN` is unset.
|
|
|
|
## Boundaries
|
|
|
|
This workplan may:
|
|
|
|
- update the Forgejo package-prune token resolution path
|
|
- update package-prune runbooks and operator handoff docs
|
|
- coordinate the consumer contract with the approved credential lane
|
|
|
|
It must not:
|
|
|
|
- move platform secret-governance ownership out of `railiance-platform`
|
|
- paste token values into Git, State Hub, chat, shell history, or logs
|
|
- break the existing prune workflow before the replacement path is verified
|
|
|
|
## T01 - Inventory current consumer and fallback paths
|
|
|
|
```task
|
|
id: RPF-WP-0007-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "3e8ee5f4-cdca-5803-8a15-86156faf5673"
|
|
```
|
|
|
|
Record where the current Forgejo admin PAT is consumed and documented, including:
|
|
|
|
- `scripts/forgejo_package_prune.py`
|
|
- `tools/cmd/forgejo-package-prune`
|
|
- `docs/forgejo-package-prune.md`
|
|
- any activity-core automation handoff that still assumes workstation file drops
|
|
|
|
Done when the remaining `/tmp/forgejo-tegwick-api-token` dependency surface is explicit.
|
|
|
|
2026-07-26: Confirmed the remaining legacy surface in
|
|
`scripts/forgejo_package_prune.py` and `docs/forgejo-package-prune.md`; the
|
|
approved lane reference already lived in `CCR-2026-0006` and
|
|
`docs/workload-kv-access-lanes.md`.
|
|
|
|
## T02 - Implement the approved non-file fallback path
|
|
|
|
```task
|
|
id: RPF-WP-0007-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2684056f-39a9-503a-91df-36f287fe4654"
|
|
```
|
|
|
|
Change the package-prune consumer so that, when `FORGEJO_TOKEN` and
|
|
`FORGEJO_ADMIN_TOKEN` are unset, it uses the approved OpenBao-backed access
|
|
path rather than the workstation file as the steady-state fallback.
|
|
|
|
Done when the token loader prefers the approved lane and the old file drop is
|
|
demoted to break-glass or removed if no longer needed.
|
|
|
|
2026-07-26: `scripts/forgejo_package_prune.py` now resolves
|
|
`platform/workloads/forgejo/forgejo-admin` field `API_TOKEN` through `bao kv get`
|
|
when `FORGEJO_TOKEN` and `FORGEJO_ADMIN_TOKEN` are unset. Explicit
|
|
`FORGEJO_TOKEN_FILE` / `FORGEJO_ADMIN_TOKEN_FILE` remain supported as attended
|
|
break-glass handoffs, and `/tmp/forgejo-tegwick-api-token` only works when
|
|
`FORGEJO_ALLOW_LEGACY_FILE_FALLBACK=1` is set.
|
|
|
|
## T03 - Update operator guidance and lane references
|
|
|
|
```task
|
|
id: RPF-WP-0007-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "34ecd9c9-486f-5509-bb74-6836d3515100"
|
|
```
|
|
|
|
Refresh the operator docs so they align with `CCR-2026-0006`, the routing
|
|
catalog, and the final consumer behavior.
|
|
|
|
Done when the package-prune runbook no longer presents the workstation file as
|
|
the primary path.
|
|
|
|
2026-07-26: Updated `docs/forgejo-package-prune.md` so the primary operator path
|
|
is `warden plan` + `bao login` against `forgejo-admin-workload-kv-read`; the
|
|
retired `/tmp` drop is now documented as legacy unwind only, with explicit
|
|
break-glass env/file overrides kept for attended sessions.
|
|
|
|
## T04 - Verify prune workflow and close the inbox request
|
|
|
|
```task
|
|
id: RPF-WP-0007-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "90355dee-66dd-593f-9444-a42ff15f2398"
|
|
```
|
|
|
|
Blocked on T01-T03.
|
|
|
|
Verify the consumer cutover with a non-secret dry-run and close the originating
|
|
coordination loop from `ops-warden`.
|
|
|
|
Done when the replacement path is verified and the old unread message has a
|
|
clear repo-local follow-up trail.
|
|
|
|
2026-07-26: Added focused token-resolution coverage in
|
|
`tests/test_forgejo_package_prune.py` for direct env, explicit file overrides,
|
|
OpenBao fallback, legacy-file gating, and operator-facing failure text. This
|
|
closes the `ops-warden` coordination loop triggered by message
|
|
`5be8e500-ebf5-405b-9aec-c902353ae719`; the repo-local follow-up trail is now in
|
|
this workplan, the prune runbook, and the loader implementation.
|
|
|
|
## Acceptance
|
|
|
|
- [x] `forgejo-package-prune` no longer defaults to `/tmp/forgejo-tegwick-api-token`
|
|
- [x] The steady-state fallback path reads the approved OpenBao lane from `CCR-2026-0006`
|
|
- [x] Operator docs present OpenBao / `warden` routing as the primary path
|
|
- [x] Repo-local tests cover the new token-resolution behavior without reading secret values
|