From fc814bd094521791f1e82606ebada77c0f561062 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 26 Aug 2026 21:25:55 +0200 Subject: [PATCH] feat(workplan): open STATE-WP-0084 for private-repository derivation Takes the three tasks split out of ops-mason/MASON-WP-0003: mount the forge read credential, teach derive_from_forge() to use it, and re-run the fleet reset over the nine repositories that failed in STATE-WP-0083-T04. T01 (report unreadable as unreadable, never as retirement work) is promoted ahead of the credential work: it does not depend on it, it closes the empty-clone path that nearly retired vergabe-teilnahme, and MASON-WP-0003-T01's breadth recommendation is contingent on it. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166 --- ...084-forge-read-for-private-repositories.md | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 workplans/STATE-WP-0084-forge-read-for-private-repositories.md diff --git a/workplans/STATE-WP-0084-forge-read-for-private-repositories.md b/workplans/STATE-WP-0084-forge-read-for-private-repositories.md new file mode 100644 index 0000000..8b14e68 --- /dev/null +++ b/workplans/STATE-WP-0084-forge-read-for-private-repositories.md @@ -0,0 +1,142 @@ +--- +id: STATE-WP-0084 +type: workplan +title: "Derive private repositories, and report unreadable as unreadable" +domain: infotech +repo: state-hub +status: proposed +owner: codex +topic_slug: infotech +created: "2026-08-26" +updated: "2026-08-26" +related: + - CUST-ADR-012 + - STATE-WP-0083 + - MASON-WP-0003 +--- + +# Derive private repositories, and report unreadable as unreadable + +## Goal + +Consume the forge read credential that `ops-mason/MASON-WP-0003` builds, so +derivation covers private repositories — and make a repository central cannot +read report as *unreadable* rather than as an error or, worse, as a repository +whose records no longer derive. + +## Why this exists + +`STATE-WP-0083-T04` reset 121 repositories on 2026-08-26. Nine failed +identically: + +```text +fatal: could not read Username for 'https://forgejo.coulomb.social' +``` + +`rapp-core-hub`, `rapp-issue-core`, `rapp-openbao`, `rapp-policy-nexus` and five +others are invisible to derivation entirely. `ADR-012`'s premise — the forge is +the projection source — holds only for repositories central can read, and +nothing in the current design says so. + +## Split from MASON-WP-0003 + +The credential lane itself (OpenBao policy, AppRole, KV path, and the +`warden route find` catalog entry) is `ops-mason`'s to build: that repository +exists to build "AppRoles, policies, and KV secret paths so ops-warden always +has something real to route to". Deployment plumbing and derivation code are +this repository's. + +T01 does **not** depend on the credential and should land first. T02 and T03 +wait on `MASON-WP-0003-T02`. + +## Distinguish "cannot read" from "does not exist" + +```task +id: STATE-WP-0084-T01 +status: todo +priority: high +``` + +A repository the hub is not permitted to read must be reported as unreadable — +a named condition — not as a generic clone error and never as an empty +derivation. + +Today the reset treats a failed clone as an error, which is correct only by +accident: if a clone ever returned empty instead of failing, every record in +that repository would be proposed for retirement. That is the failure that +nearly retired `vergabe-teilnahme`, and it must be impossible here by +construction rather than by luck. + +An empty clone result and an unreadable repository must both be incapable of +producing retirement work. Retirement proposals require a *successful* read +that positively lacks the record. + +This also carries the decision in `MASON-WP-0003-T01`: a per-repository grant +is only safe to choose if a missing grant surfaces as a named condition. Until +this lands, the narrow option fails silently. + +Acceptance: an unreadable repository is reported as unreadable; a clone that +succeeds but returns nothing produces no retirement proposals; both cases are +covered by tests that fail if the retirement path is reachable from either. + +## Deliver the credential to the pod + +```task +id: STATE-WP-0084-T02 +status: wait +priority: medium +``` + +Blocked on `MASON-WP-0003-T02`. + +Make the credential available to the `state-hub` deployment as a Kubernetes +Secret, mounted or injected, referenced by the chart the same way +`state-hub-env` already is. + +It must not be baked into the image and must not be committed to the chart. +Rotation must not require a chart change or a redeploy. + +Acceptance: the pod can read the credential; nothing in the repository contains +it; rotating the token does not require a redeploy. + +## Teach the derivation to use it + +```task +id: STATE-WP-0084-T03 +status: wait +priority: medium +``` + +Blocked on T02. + +`derive_from_forge()` clones anonymously. It should use the credential when +present and continue working without it — a hub with no token must still derive +public repositories rather than failing wholesale. + +Credentials must never reach the clone URL in a way that lands in logs or +process listings: use a credential helper or an HTTP header, not an embedded +userinfo URL. + +Acceptance: private repositories derive; a hub without the credential still +derives public ones; no credential appears in logs, process listings, or +recorded clone URLs. + +## Confirm the nine + +```task +id: STATE-WP-0084-T04 +status: wait +priority: medium +``` + +Blocked on T03. + +Re-run the fleet reset and confirm the nine repositories derive rather than +error. Expect a real diff for each — quite possibly a large one, since none has +ever been reconciled against its files. + +Treat the first diff for each as review material, not as work to apply. Every +repository examined this way for the first time has produced findings. + +Acceptance: fleet errors fall from nine to zero; each newly readable repository +has its first diff reviewed before anything is applied.