feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Build and Publish Multi-Context Image / build-and-push (push) Successful in 27s

Nine repositories are invisible to derivation because central may not read
them. This adds the consuming half of the credential lane MASON-WP-0003 built.

The cluster has no agent injector and no secrets-store CSI driver, so the pod
authenticates to OpenBao with a projected ServiceAccount token (audience
`openbao`, not the API server) and reads the KV path itself. `forgeRead.*`
carries coordinates only; no credential is a chart value, an image layer, or a
Kubernetes Secret.

The credential reaches git through GIT_CONFIG_* setting http.extraHeader, not
through `-c` and not through userinfo in the clone URL — both of those put the
token in the process listing. It is redacted from ForgeDeriveError, which is
logged, stored in reset outcomes, and returned over the API.

Absent stays a supported state: with no credential, or with OpenBao
unreachable, resolution returns None and public derivation runs unchanged.
Raising would turn "nine repositories are unreadable" into "the pass failed",
which is what T01 exists to prevent.

Chart default is disabled. 717 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
tegwick 2026-08-27 23:12:57 +02:00
parent ab6438235e
commit 470ece82ed
8 changed files with 1334 additions and 7 deletions

View file

@ -0,0 +1,882 @@
{
"captured_at": "2026-08-27T14:00:07.862953+00:00",
"api_base": "http://127.0.0.1:8000",
"workplan": "STATE-WP-0070",
"retired_interfaces": [],
"weekly_review": {
"generated_at": "2026-08-27T14:00:09.212468Z",
"window_start": "2026-08-20T14:00:09.134254Z",
"window_end": "2026-08-27T14:00:09.134254Z",
"cadence": "weekly",
"activity_core_handoff": {
"activity_id": "statehub-legacy-interface-review",
"cadence": "weekly",
"source_endpoint": "/legacy-meter/weekly-review",
"state_owner": "state-hub",
"scheduler_owner": "activity-core"
},
"interfaces": [
{
"interface": {
"id": "8051fb40-66c9-4dc4-a413-13e8573e04a3",
"interface_key": "event_subject:org.statehub.workstream.completed",
"interface_kind": "event_subject",
"legacy_since": "2026-06-04T06:09:42.198193Z",
"replacement_ref": "org.statehub.workplan.completed",
"owner_component": "state-hub.events",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T06:09:42.198193Z",
"updated_at": "2026-06-04T06:09:42.198193Z"
},
"all_time": {
"calls": 247,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 247
},
"users": {
"unknown": 247
},
"components": {
"state-hub.events": 247
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-13T13:22:00.748140Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 45d (>= 30d required for 247 all-time call(s))"
},
{
"interface": {
"id": "cd9342fd-27e7-4a46-a1be-d41499e106a3",
"interface_key": "rest_api:DELETE /workstreams/{workstream_id}",
"interface_kind": "rest_api",
"legacy_since": "2026-06-06T17:28:13.052813Z",
"replacement_ref": "/workplans/{workplan_id}",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-06T17:28:13.052813Z",
"updated_at": "2026-06-06T17:28:13.052813Z"
},
"all_time": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-06-06T17:28:13.047529Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 81d (>= 7d required for 1 all-time call(s))"
},
{
"interface": {
"id": "d0294dce-7913-4268-94c3-1b2502aefb0f",
"interface_key": "rest_api:GET /sbom/",
"interface_kind": "rest_api",
"legacy_since": "2026-08-22T17:06:38.703608Z",
"replacement_ref": "sbom-nexus:/sbom/",
"owner_component": "state-hub.sbom-compat",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-08-22T17:06:38.703608Z",
"updated_at": "2026-08-22T17:23:43.730661Z"
},
"all_time": {
"calls": 4,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4
},
"users": {
"unknown": 4
},
"components": {
"unknown": 4
}
},
"window": {
"calls": 4,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4
},
"users": {
"unknown": 4
},
"components": {
"unknown": 4
}
},
"last_seen_at": "2026-08-22T17:23:46.146788Z",
"retirement_candidate": false,
"retirement_reason": "4 call(s) in review window"
},
{
"interface": {
"id": "2f77ac12-8c97-4974-a2f9-2996927982d1",
"interface_key": "rest_api:GET /sbom/report/licences/",
"interface_kind": "rest_api",
"legacy_since": "2026-08-22T17:06:41.978426Z",
"replacement_ref": "sbom-nexus:/sbom/",
"owner_component": "state-hub.sbom-compat",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-08-22T17:06:41.978426Z",
"updated_at": "2026-08-22T17:23:44.794796Z"
},
"all_time": {
"calls": 4,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4
},
"users": {
"unknown": 4
},
"components": {
"unknown": 4
}
},
"window": {
"calls": 4,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4
},
"users": {
"unknown": 4
},
"components": {
"unknown": 4
}
},
"last_seen_at": "2026-08-22T17:56:34.405129Z",
"retirement_candidate": false,
"retirement_reason": "4 call(s) in review window"
},
{
"interface": {
"id": "b627edf5-3302-4366-ba2e-547d32f634b5",
"interface_key": "rest_api:GET /sbom/snapshots/",
"interface_kind": "rest_api",
"legacy_since": "2026-08-22T17:06:37.057774Z",
"replacement_ref": "sbom-nexus:/sbom/",
"owner_component": "state-hub.sbom-compat",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-08-22T17:06:37.057774Z",
"updated_at": "2026-08-22T17:22:15.080213Z"
},
"all_time": {
"calls": 5,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 5
},
"users": {
"unknown": 5
},
"components": {
"unknown": 5
}
},
"window": {
"calls": 5,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 5
},
"users": {
"unknown": 5
},
"components": {
"unknown": 5
}
},
"last_seen_at": "2026-08-22T17:23:53.844021Z",
"retirement_candidate": false,
"retirement_reason": "5 call(s) in review window"
},
{
"interface": {
"id": "d03ee274-cd6f-4cd5-8f22-e4d298416299",
"interface_key": "rest_api:GET /sbom/snapshots/{snapshot_id}",
"interface_kind": "rest_api",
"legacy_since": "2026-08-22T17:23:45.969876Z",
"replacement_ref": "sbom-nexus:/sbom/",
"owner_component": "state-hub.sbom-compat",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-08-22T17:23:45.969876Z",
"updated_at": "2026-08-22T17:23:45.969876Z"
},
"all_time": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"window": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"last_seen_at": "2026-08-22T17:23:45.967492Z",
"retirement_candidate": false,
"retirement_reason": "1 call(s) in review window"
},
{
"interface": {
"id": "a6cb291e-8312-42f8-8a66-fde369482881",
"interface_key": "rest_api:GET /sbom/{repo_slug}",
"interface_kind": "rest_api",
"legacy_since": "2026-08-22T17:23:45.089542Z",
"replacement_ref": "sbom-nexus:/sbom/",
"owner_component": "state-hub.sbom-compat",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-08-22T17:23:45.089542Z",
"updated_at": "2026-08-22T17:23:45.089542Z"
},
"all_time": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"window": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"last_seen_at": "2026-08-22T17:23:45.670511Z",
"retirement_candidate": false,
"retirement_reason": "1 call(s) in review window"
},
{
"interface": {
"id": "3e4a3d0b-08fa-45c3-91e2-4f514a914b97",
"interface_key": "rest_api:GET /workstreams/",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T00:26:14.533764Z",
"replacement_ref": "/workplans/",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T00:26:14.533764Z",
"updated_at": "2026-06-04T00:26:14.533764Z"
},
"all_time": {
"calls": 830269,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 830269
},
"users": {
"unknown": 830269
},
"components": {
"unknown": 830269
}
},
"window": {
"calls": 24746,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 24746
},
"users": {
"unknown": 24746
},
"components": {
"unknown": 24746
}
},
"last_seen_at": "2026-08-21T13:50:37.994459Z",
"retirement_candidate": false,
"retirement_reason": "24746 call(s) in review window"
},
{
"interface": {
"id": "e4c140ec-7479-46f9-b185-4b533f19d639",
"interface_key": "rest_api:GET /workstreams/workplan-index",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T05:20:58.321869Z",
"replacement_ref": "/workplans/index",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T05:20:58.321869Z",
"updated_at": "2026-06-04T05:20:58.321869Z"
},
"all_time": {
"calls": 39,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 39
},
"users": {
"unknown": 39
},
"components": {
"unknown": 39
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-08T05:20:33.378203Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 50d (>= 7d required for 39 all-time call(s))"
},
{
"interface": {
"id": "3a00b19e-e7db-4403-98aa-a77c9ab61ecc",
"interface_key": "rest_api:GET /workstreams/{workstream_id}",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T00:25:59.014966Z",
"replacement_ref": "/workplans/{workplan_id}",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T00:25:59.014966Z",
"updated_at": "2026-06-04T00:25:59.014966Z"
},
"all_time": {
"calls": 3411470,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 3411470
},
"users": {
"unknown": 3411470
},
"components": {
"unknown": 3411470
}
},
"window": {
"calls": 111410,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 111410
},
"users": {
"unknown": 111410
},
"components": {
"unknown": 111410
}
},
"last_seen_at": "2026-08-21T13:50:32.103349Z",
"retirement_candidate": false,
"retirement_reason": "111410 call(s) in review window"
},
{
"interface": {
"id": "69e1a255-a8b9-4101-8a68-b1bed23abfda",
"interface_key": "rest_api:GET /workstreams/{workstream_id}/dependencies/",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T00:25:59.291135Z",
"replacement_ref": "/workplans/{workplan_id}/dependencies/",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T00:25:59.291135Z",
"updated_at": "2026-06-04T00:25:59.291135Z"
},
"all_time": {
"calls": 1643952,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1643952
},
"users": {
"unknown": 1643952
},
"components": {
"unknown": 1643952
}
},
"window": {
"calls": 52105,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 52105
},
"users": {
"unknown": 52105
},
"components": {
"unknown": 52105
}
},
"last_seen_at": "2026-08-21T13:50:30.082480Z",
"retirement_candidate": false,
"retirement_reason": "52105 call(s) in review window"
},
{
"interface": {
"id": "b1aae931-b51f-4a85-a723-865dd65f6132",
"interface_key": "rest_api:PATCH /workstreams/{workstream_id}",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T06:09:41.901035Z",
"replacement_ref": "/workplans/{workplan_id}",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T06:09:41.901035Z",
"updated_at": "2026-06-04T06:09:41.901035Z"
},
"all_time": {
"calls": 584,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 584
},
"users": {
"unknown": 584
},
"components": {
"unknown": 584
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-08-16T16:33:34.045078Z",
"retirement_candidate": false,
"retirement_reason": "quiet 10d of 30d required for 584 all-time call(s)"
},
{
"interface": {
"id": "ed6451c9-d2cc-4486-9afe-d3852782cabc",
"interface_key": "rest_api:POST /workstreams/",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T07:40:24.168535Z",
"replacement_ref": "/workplans/",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T07:40:24.168535Z",
"updated_at": "2026-06-04T07:40:24.168535Z"
},
"all_time": {
"calls": 811,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 811
},
"users": {
"unknown": 811
},
"components": {
"unknown": 811
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-08-16T01:03:41.093965Z",
"retirement_candidate": false,
"retirement_reason": "quiet 11d of 30d required for 811 all-time call(s)"
},
{
"interface": {
"id": "281fd706-b192-4194-8055-2d8733c115f9",
"interface_key": "rest_api:POST /workstreams/{workstream_id}/dependencies/",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T22:57:37.149207Z",
"replacement_ref": "/workplans/{workplan_id}/dependencies/",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T22:57:37.149207Z",
"updated_at": "2026-06-04T22:57:37.149207Z"
},
"all_time": {
"calls": 4975,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4975
},
"users": {
"unknown": 4975
},
"components": {
"unknown": 4975
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-07T20:31:35.389791Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 50d (>= 30d required for 4975 all-time call(s))"
}
],
"retirement_candidates": [
{
"interface": {
"id": "8051fb40-66c9-4dc4-a413-13e8573e04a3",
"interface_key": "event_subject:org.statehub.workstream.completed",
"interface_kind": "event_subject",
"legacy_since": "2026-06-04T06:09:42.198193Z",
"replacement_ref": "org.statehub.workplan.completed",
"owner_component": "state-hub.events",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T06:09:42.198193Z",
"updated_at": "2026-06-04T06:09:42.198193Z"
},
"all_time": {
"calls": 247,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 247
},
"users": {
"unknown": 247
},
"components": {
"state-hub.events": 247
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-13T13:22:00.748140Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 45d (>= 30d required for 247 all-time call(s))"
},
{
"interface": {
"id": "cd9342fd-27e7-4a46-a1be-d41499e106a3",
"interface_key": "rest_api:DELETE /workstreams/{workstream_id}",
"interface_kind": "rest_api",
"legacy_since": "2026-06-06T17:28:13.052813Z",
"replacement_ref": "/workplans/{workplan_id}",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-06T17:28:13.052813Z",
"updated_at": "2026-06-06T17:28:13.052813Z"
},
"all_time": {
"calls": 1,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 1
},
"users": {
"unknown": 1
},
"components": {
"unknown": 1
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-06-06T17:28:13.047529Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 81d (>= 7d required for 1 all-time call(s))"
},
{
"interface": {
"id": "e4c140ec-7479-46f9-b185-4b533f19d639",
"interface_key": "rest_api:GET /workstreams/workplan-index",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T05:20:58.321869Z",
"replacement_ref": "/workplans/index",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T05:20:58.321869Z",
"updated_at": "2026-06-04T05:20:58.321869Z"
},
"all_time": {
"calls": 39,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 39
},
"users": {
"unknown": 39
},
"components": {
"unknown": 39
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-08T05:20:33.378203Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 50d (>= 7d required for 39 all-time call(s))"
},
{
"interface": {
"id": "281fd706-b192-4194-8055-2d8733c115f9",
"interface_key": "rest_api:POST /workstreams/{workstream_id}/dependencies/",
"interface_kind": "rest_api",
"legacy_since": "2026-06-04T22:57:37.149207Z",
"replacement_ref": "/workplans/{workplan_id}/dependencies/",
"owner_component": "state-hub.api",
"status": "legacy",
"replacement_verified": true,
"manual_hold": false,
"hold_reason": null,
"notes": null,
"retired_at": null,
"created_at": "2026-06-04T22:57:37.149207Z",
"updated_at": "2026-06-04T22:57:37.149207Z"
},
"all_time": {
"calls": 4975,
"tenant_count": 1,
"user_count": 1,
"component_count": 1,
"tenants": {
"unknown": 4975
},
"users": {
"unknown": 4975
},
"components": {
"unknown": 4975
}
},
"window": {
"calls": 0,
"tenant_count": 0,
"user_count": 0,
"component_count": 0,
"tenants": {},
"users": {},
"components": {}
},
"last_seen_at": "2026-07-07T20:31:35.389791Z",
"retirement_candidate": true,
"retirement_reason": "no usage in review window; quiet 50d (>= 30d required for 4975 all-time call(s))"
}
]
},
"days": 7
}