Prepare the existing contained Forgejo API login and silent read check
This commit is contained in:
codex
parent
6d80894ef3
commit
556daf928e
5 changed files with 94 additions and 3 deletions
|
|
@ -36,6 +36,11 @@ changes were preserved. The two postimage files retain exact published sources.
|
|||
credentialed path remains unverified because the owner transport refused.
|
||||
- `measurements.json`: bounded samples, command counts and explicit unknowns.
|
||||
No cold-onboarding or comparative performance claim is made.
|
||||
- `attended-api-preparation.json`: exact existing-owner login/role and silent
|
||||
invocation of the existing Tea probe. Installed Warden source pins and shell
|
||||
syntax are checked; no new runner or credential-policy change is introduced.
|
||||
This prepares the founder-run attempt and does not prove interactive login,
|
||||
session revocation or authenticated API success.
|
||||
|
||||
T33/T37 remain in progress until the actual Forgejo paths are accepted.
|
||||
T42 still waits on decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c`; no source
|
||||
|
|
|
|||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"id": "key-cape-oidc-login",
|
||||
"domain": "forgejo-admin-workload-kv-read",
|
||||
"handoff": {
|
||||
"auth_method": "browser OIDC via key-cape / Keycloak at auth/netkingdom",
|
||||
"path_template": null,
|
||||
"fetch_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read",
|
||||
"policy_ref": null,
|
||||
"exec_capable": true
|
||||
},
|
||||
"next_action": "Run the attended login and reviewed operation only inside the contained envelope: `warden access <need> --exec -- <reviewed-command>`. The private helper is preflighted, all output is suppressed, and the session is revoked and removed afterward.",
|
||||
"advisory_exit_code": 0,
|
||||
"login_or_fetch_executed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"prepared": true,
|
||||
"executed": false,
|
||||
"api_success_proven": false,
|
||||
"command_recipe": "wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX)\nBAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > \"$1\" 2>/dev/null' sh \"$wp80_api_receipt_dir/report.json\"\npython3 -m json.tool \"$wp80_api_receipt_dir/report.json\"\n",
|
||||
"shell_syntax_check_exit_code": 0,
|
||||
"login_lane": "key-cape-oidc-login",
|
||||
"role": "forgejo-admin-workload-kv-read",
|
||||
"resolved_login_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read",
|
||||
"role_source": "/home/worsch/ops-warden/wiki/playbooks/forgejo-admin-api-token.md",
|
||||
"login_semantics_source": "Installed warden.proxy.proxy_attended_login_exec; captured login, silent child, self-revocation and helper removal",
|
||||
"login_role_current_runtime_verification": "Not yet executed; current role functionality and actual API reads remain unverified",
|
||||
"new_runner_created": false,
|
||||
"new_credential_policy_or_grant": false,
|
||||
"source_pins": [
|
||||
{
|
||||
"path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/cli.py",
|
||||
"sha256": "196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9",
|
||||
"matches_owner_checkout": true
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/proxy.py",
|
||||
"sha256": "69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da",
|
||||
"matches_owner_checkout": true
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py",
|
||||
"sha256": "2e56da76fbebd2601e07b2da3842aacc5236b67b969252265514d6b4a3af8ca8"
|
||||
}
|
||||
],
|
||||
"expected_receipt": {
|
||||
"passed": true,
|
||||
"whoami_exit_code": 0,
|
||||
"repository_read_exit_code": 0,
|
||||
"returned_identity_matches": true,
|
||||
"expected_repository_returned": true,
|
||||
"temporary_configuration_removed": true
|
||||
},
|
||||
"separate_outer_requirements": [
|
||||
"Contained OIDC login handed off to child",
|
||||
"Outer session self-revocation confirmed",
|
||||
"Outer helper cleanup confirmed"
|
||||
],
|
||||
"on_failure": "Keep the closed failure result. Empty report is not API evidence; do not broaden role or claim success."
|
||||
}
|
||||
|
|
@ -82,9 +82,34 @@ points at a retired Gitea host; that credential was not used against the current
|
|||
forge. No authenticated API result has been accepted.
|
||||
|
||||
`warden plan 'oidc login forgejo admin' --json` identifies the existing
|
||||
founder-required KeyCape OIDC/MFA login lane. That human login is still a
|
||||
prerequisite to resolve through the owner path. The recorded route plans and
|
||||
closed failure markers are in the [entrypoint evidence](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md).
|
||||
founder-required KeyCape OIDC/MFA login lane. Its existing role for reading this
|
||||
credential is `forgejo-admin-workload-kv-read`, documented by the credential
|
||||
owner. The founder can run the following in their own interactive terminal:
|
||||
|
||||
```sh
|
||||
wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX)
|
||||
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > "$1" 2>/dev/null' sh "$wp80_api_receipt_dir/report.json"
|
||||
python3 -m json.tool "$wp80_api_receipt_dir/report.json"
|
||||
```
|
||||
|
||||
This reuses Warden's contained login and existing credential route. The inner
|
||||
command emits only the reviewed probe's metadata JSON into a private receipt;
|
||||
both child streams stay silent to the outer login envelope. Warden revokes the
|
||||
temporary OpenBao session and removes its helper, while the probe removes its
|
||||
isolated Tea configuration. No API credential or login token is printed or
|
||||
retained in that receipt.
|
||||
|
||||
**Prepared, not executed:** this is the supported next attempt after the 403,
|
||||
not proof that the current role/login works. Retain the outer Warden outcome as
|
||||
well as the receipt. A missing/empty report means the API check has not produced
|
||||
evidence. A report with `passed: true` must include successful identity and
|
||||
repository reads; a revocation/cleanup failure remains a separate unresolved
|
||||
outcome even if those reads succeeded. Do not rerun a failed command unchanged
|
||||
or broaden the role to obtain a pass.
|
||||
|
||||
This read check does not activate the separate Forgejo sign-in rollout. The
|
||||
recorded route plans and closed failure markers are in the
|
||||
[entrypoint evidence](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md).
|
||||
|
||||
## Forgejo NetKingdom sign-in and repository privacy
|
||||
|
||||
|
|
|
|||
|
|
@ -607,6 +607,8 @@ Use an existing supported coding-agent access path and its stated build profile.
|
|||
|
||||
Baseline: existing SSH read and ordinary source publication work. The installed Tea default targets retired Gitea and was not reused. The current owner-routed API attempt returned OpenBao 403 before the isolated Tea probe received a credential; no API operation ran. The route plan identifies founder-required KeyCape OIDC/MFA caller login. [Evidence and current commands](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). This retained failure does not close T44.
|
||||
|
||||
Prepared the [exact founder-run contained login and API check](../docs/netkingdom-development.md#forgejo-git-and-api) using existing Warden role substitution, the existing owner credential route and installed Tea probe. No extra runner or policy grant. Installed Warden implementation matches the inspected owner source; the command's shell syntax is checked. Actual human login, successful API reads and session-revocation/cleanup evidence remain missing; T44 stays open.
|
||||
|
||||
## T45 - Publish the verified browser entrypoint in existing discovery
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue