coulomb/state-hub
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: advance remaining state hub workplans
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
This commit is contained in:
tegwick 2026-08-31 12:14:33 +02:00
parent 306a6e0ce8
commit 142c94287e
6 changed files with 241 additions and 337 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/STATE-WP-0084-forge-read-for-private-repositories.md
View file

@ -4,11 +4,17 @@ type: workplan
title: "Derive private repositories, and report unreadable as unreadable"
domain: infotech
repo: state-hub
status: active
status: finished
owner: codex
topic_slug: infotech
created: "2026-08-26"
updated: "2026-08-26"
updated: "2026-08-31"
quality_dod: DoD-Ok
quality_dod_at: "2026-08-31"
quality_dod_by: codex
quality_dod_note: >-
Credential delivery, safe consumer behavior, nine-repository reviewed apply,
and nine-noop repeat verification are evidenced without storing a secret.
related:
- CUST-ADR-012
- STATE-WP-0083
@ -112,7 +118,7 @@ covered by tests that fail if the retirement path is reachable from either.
```task
id: STATE-WP-0084-T02
status: progress
status: done
priority: medium
state_hub_task_id: "d8d41a89-1ebc-5118-bb73-cf8d8c114e16"
```
@ -155,11 +161,18 @@ path (`paste_once_provision`, outside both repositories), and a deploy with
`forgeRead.enabled=true` plus the real address and path in
`deploy/railiance/apps/helm/state-hub-values.yaml`.
**Done 2026-08-31.** The live `railliance01` release has
`forgeRead.enabled: true`; the API pod runs as ServiceAccount `state-hub` with
the projected OpenBao token and coordinate-only configuration. A non-secret
in-pod resolution check returned `available`. The Forge token remains outside
Git and is re-read through the five-minute cache, so rotation needs no chart
change or pod redeploy.
## Teach the derivation to use it
```task
id: STATE-WP-0084-T03
status: progress
status: done
priority: medium
state_hub_task_id: "b22b24d9-7ed3-533c-bda7-3130693cf4d2"
```
@ -215,11 +228,16 @@ are silent when wrong: token-in-argv and token-in-exception. 43 pass in
Remains `progress` because the acceptance clause "private repositories derive"
cannot be observed until T02 supplies a credential; T04 confirms it.
**Done 2026-08-31.** A transaction-rolled-back review successfully derived all
nine private `rapp-*` repositories at exact Forge commits. No repository was
unreadable or errored, and no retirement was proposed. The anonymous/public
path remains covered by the existing absent-credential tests.
## Confirm the nine
```task
id: STATE-WP-0084-T04
status: wait
status: done
priority: medium
state_hub_task_id: "33c09a78-5974-57c6-bb7f-ad73082046bb"
```
@ -235,3 +253,9 @@ repository examined this way for the first time has produced findings.
Acceptance: fleet errors fall from nine to zero; each newly readable repository
has its first diff reviewed before anything is applied.
**Done 2026-08-31.** The first review returned seven bounded source/status
updates and two no-ops, with zero creations, retirements, refusals, or errors.
Those exact commits were applied through the guarded per-repository API with
retirement disabled. The repeated review returned nine no-ops and zero errors.
Evidence: `docs/evidence/STATE-WP-0084-private-forge-cutover-2026-08-31.md`.