railiance-platform/workplans/RAILIANCE-WP-0013-forgejo-admin-pat-openbao-cutover.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related_repos	state_hub_workstream_id
RAILIANCE-WP-0013	workplan	Forgejo admin PAT OpenBao consumer cutover	financials	railiance-platform	active	codex	railiance	2026-07-25	2026-07-25	activity-core ops-warden	38fa254d-cd56-498a-8385-f9673ec005ac

RAILIANCE-WP-0013 - Forgejo admin PAT OpenBao consumer cutover

Goal

Cut the Forgejo package-prune consumer over from workstation-local PAT handling to the approved OpenBao lane recorded in CCR-2026-0006.

The immediate trigger is the unread ops-warden coordination message from July 12, 2026 requesting that tools/cmd/forgejo-package-prune stop depending on /tmp/forgejo-tegwick-api-token as the steady-state fallback when FORGEJO_ADMIN_TOKEN is unset.

Boundaries

This workplan may:

• update the Forgejo package-prune token resolution path
• update package-prune runbooks and operator handoff docs
• coordinate the consumer contract with the approved credential lane

It must not:

• move platform secret-governance ownership out of railiance-platform
• paste token values into Git, State Hub, chat, shell history, or logs
• break the existing prune workflow before the replacement path is verified

T01 - Inventory current consumer and fallback paths

id: RAILIANCE-WP-0013-T01
status: todo
priority: medium
state_hub_task_id: "68131f3b-cb97-4aa9-abbb-cddb1e395703"

Record where the current Forgejo admin PAT is consumed and documented, including:

• scripts/forgejo_package_prune.py
• tools/cmd/forgejo-package-prune
• docs/forgejo-package-prune.md
• any activity-core automation handoff that still assumes workstation file drops

Done when the remaining /tmp/forgejo-tegwick-api-token dependency surface is explicit.

T02 - Implement the approved non-file fallback path

id: RAILIANCE-WP-0013-T02
status: todo
priority: high
state_hub_task_id: "f67a58e5-d780-4226-97a8-4c669b47e4a4"

Change the package-prune consumer so that, when FORGEJO_TOKEN and FORGEJO_ADMIN_TOKEN are unset, it uses the approved OpenBao-backed access path rather than the workstation file as the steady-state fallback.

Done when the token loader prefers the approved lane and the old file drop is demoted to break-glass or removed if no longer needed.

T03 - Update operator guidance and lane references

id: RAILIANCE-WP-0013-T03
status: todo
priority: medium
state_hub_task_id: "ed5f791c-5beb-43bd-844b-4188b604bc3f"

Refresh the operator docs so they align with CCR-2026-0006, the routing catalog, and the final consumer behavior.

Done when the package-prune runbook no longer presents the workstation file as the primary path.

T04 - Verify prune workflow and close the inbox request

id: RAILIANCE-WP-0013-T04
status: wait
priority: medium
state_hub_task_id: "1fc2af0f-b4ff-4694-b072-23af0254377e"

Blocked on T01-T03.

Verify the consumer cutover with a non-secret dry-run and close the originating coordination loop from ops-warden.

Done when the replacement path is verified and the old unread message has a clear repo-local follow-up trail.