From 609dacb2eebec9208a4d36ecd5fea977b79cde99 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 21 Oct 2026 00:54:37 +0200 Subject: [PATCH] workplan(REUSE-WP-0025): record approval of T03 reader fix, credential 2A and rollout Decision 81c8535a resolved: native boundary fix, dedicated read-only Forgejo machine user with read:repository PAT via OpenBao/ESO, and the platform/apps rollout. T03 stays waiting on execution. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 803894@bnt-lap001 Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3 --- .../REUSE-WP-0025-private-source-reader-boundary.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md index d84b29d..1a19065 100644 --- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md +++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md @@ -59,7 +59,8 @@ id: REUSE-WP-0025-T03 status: wait priority: high needs_human: true -intervention_note: "Owner approval of reader fix, credential binding and rollout (decision 81c8535a)" +intervention_note: "Approved (81c8535a): create reuse-surface-reader Forgejo bot + read:repository PAT into OpenBao/ESO; platform/apps rollout" +blocking_reason: "Execution of approved credential provisioning and platform/apps image rollout" state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb" decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d" ``` @@ -71,3 +72,13 @@ the fix plus the exact reader allowlist. Then run helper inside the hub environm with the owner-provided packets, verify all seven sources fresh, and hand a sanitized receipt to the custodian for registration and final 70-capability audit. No new PAT is delivered to the current baseline consumer. + +2026-10-21: decision 81c8535a resolved by Bernd — approved (1) the native +boundary fix, (2A) a dedicated Forgejo machine user (e.g. `reuse-surface-reader`) +with read access to exactly the seven consented repos and a `read:repository` +PAT on its own OpenBao KV path, delivered via ESO as +`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` and allowlisted to the 14 commit-pinned +URLs, and (3) the platform/apps rollout as described above. Remaining: create the +bot user and token (human/operator — agents do not handle the secret value), roll +out, run the helper, hand over the receipt. Follow-up: define how allowlist pins +are refreshed and re-approved when the source repos update their metadata.