coulomb/reuse-surface
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

workplan(REUSE-WP-0025): record approval of T03 reader fix, credential 2A and rollout
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
ci / validate-registry (push) Failing after 1m19s
Details

Browse source 
Decision 81c8535a resolved: native boundary fix, dedicated read-only
Forgejo machine user with read:repository PAT via OpenBao/ESO, and the
platform/apps rollout. T03 stays waiting on execution.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
This commit is contained in:
tegwick 2026-10-21 00:54:37 +02:00
parent be7e11ff1b
commit 609dacb2ee
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/REUSE-WP-0025-private-source-reader-boundary.md
View file

@ -59,7 +59,8 @@ id: REUSE-WP-0025-T03
status: wait
priority: high
needs_human: true
intervention_note: "Owner approval of reader fix, credential binding and rollout (decision 81c8535a)"
intervention_note: "Approved (81c8535a): create reuse-surface-reader Forgejo bot + read:repository PAT into OpenBao/ESO; platform/apps rollout"
blocking_reason: "Execution of approved credential provisioning and platform/apps image rollout"
state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
```
@ -71,3 +72,13 @@ the fix plus the exact reader allowlist. Then run helper inside the hub environm
with the owner-provided packets, verify all seven sources fresh, and hand a
sanitized receipt to the custodian for registration and final 70-capability audit.
No new PAT is delivered to the current baseline consumer.
2026-10-21: decision 81c8535a resolved by Bernd — approved (1) the native
boundary fix, (2A) a dedicated Forgejo machine user (e.g. `reuse-surface-reader`)
with read access to exactly the seven consented repos and a `read:repository`
PAT on its own OpenBao KV path, delivered via ESO as
`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` and allowlisted to the 14 commit-pinned
URLs, and (3) the platform/apps rollout as described above. Remaining: create the
bot user and token (human/operator — agents do not handle the secret value), roll
out, run the helper, hand over the receipt. Follow-up: define how allowlist pins
are refreshed and re-approved when the source repos update their metadata.