# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0005.
id: reuse-surface-hub-write-token
kind: kv
org: coulomb
repo: reuse-surface
stage: prod
description: >-
  Production federation-hub write bearer and Forgejo webhook HMAC. ESO remains
  the workload delivery path; native exec is a separate exact-path AppRole.

mount: platform
path: workloads/reuse/reuse-surface/runtime-secrets
mount_management: existing
fields:
  - REUSE_SURFACE_TOKEN
  - REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET

consumers:
  - name: reuse-surface-runtime
    auth: kubernetes
    claim: serviceaccount:external-secrets/external-secrets
    purpose: sync reuse-surface-env through the namespace-limited ESO store
  - name: forgejo-coulomb-org-webhook
    auth: shared-hmac
    claim: forgejo-org:coulomb
    purpose: share the webhook HMAC with the reuse-surface receiver
  - name: secrets-engine-operator-exec
    auth: approle
    claim: catalog:reuse-surface-hub-write-token
    purpose: approved hub tooling in a child process and non-secret verification

workload_delivery:
  - mode: external-secrets
    owner: railiance-platform + reuse-surface + railiance-apps

delivery_modes: [exec-env, read-check]
delivery_auth:
  method: approle
  management: engine
  policy_name: se-prod-reuse-surface-hub-write-token
  role_name: se-prod-reuse-surface-hub-write-token
  token_ttl: 15m
  token_max_ttl: 30m
  secret_id_ttl: 15m
  secret_id_num_uses: 1
  token_num_uses: 8

approval:
  model: ccr
  decision_ref: CCR-2026-0005
  notes: >-
    CCR-2026-0005 approves the existing workload lane. A live native AppRole
    apply remains gated by SECRETS-WP-0006-T05 review and operator approval.

verification:
  positive: approved delivery AppRole can read both declared fields without printing them
  negative: unrelated token is denied on platform/data/workloads/reuse/reuse-surface/runtime-secrets

risk:
  classification: high
  notes: hub writes affect the production federation index and the HMAC has two coordinated consumers

rotation:
  owner: railiance-platform + reuse-surface + railiance-apps
  expectation: >-
    Patch OpenBao, force ESO refresh, roll reuse-surface, and reconfigure the
    Forgejo org webhook whenever its HMAC changes.
  ttl: rotate-on-compromise

deactivation:
  owner: railiance-platform + reuse-surface
  expectation: >-
    Disable the front door, detach ESO access, and remove the materialized
    Secret only after confirming decommission or break-glass posture.

audit:
  evidence: CCR id, actor, exact path, field names, ESO refresh timestamp, request ids, and pass/fail only