3.7 KiB
Forgejo authenticated route acceptance
Existing work: FORGE-WP-0006-T02, RMGR-WP-0021-T03 and CUST-WP-0080-T03. This is one contained login plus the prepared operation, added to the existing attended window. It requests no new credential, policy scope or publication.
Status: prepared. The exact shared suite passed 27 checks on the pinned isolated
image; five boundary tests pass and native read-only preflight passes under a
private HOME. Evidence: docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json.
The first failed rehearsal and correction remain recorded; no live API test has run.
Proposal: docs/changes/CUST-WP-0080/forge-routes-proposal.json, stable trial
FORGE6-ROUTES-001. Every runtime source file is bound by digest. A changed source
refuses before credential fetch. The current API route failed before child
handoff and OpenBao capability discovery denied access; repeating that fetch
without an attended login does not advance acceptance.
The command uses the existing forgejo-admin-workload-kv-read OIDC role. The
founder supplies their own browser/MFA interaction. Warden contains the OpenBao
session, injects the existing PAT only into the silent child, then revokes the
login session. No login-only session or token paste is needed. Warden's current
plan identifies key-cape-oidc-login as founder_required; the governing rule is
canon/standards/build-mode-change-authorization_v0.1.md (orange lane).
Run from the founder's workstation terminal after the rehearsal receipt is verified:
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
WARDEN_AGENT_ID=custodian-codex \
warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- \
python3 /home/worsch/the-custodian/docs/changes/CUST-WP-0080/run_forge_routes.py \
--proposal /home/worsch/the-custodian/docs/changes/CUST-WP-0080/forge-routes-proposal.json \
--receipt /home/worsch/the-custodian/docs/evidence/2026-10-13-netkingdom-security/forge-routes-live.json
The child creates one uniquely named private repository, checks hook inheritance, anonymous denial, real HTTPS clean/secret pushes, API clean/secret writes, and clean/secret-bearing merge messages. Ref and quarantine readbacks distinguish actual enforcement from a generic HTTP failure. The synthetic key has no account or authorization anywhere. No workflows or external jobs are created. The child deletes only its newly created repository after checking its numeric ID, owner, private flag, name and ownership description. Existing repositories are untouched. Estimated new infrastructure cost: EUR 0. Allow about five minutes after login; the operation is serialized and each network call is bounded.
The abort owner is railiance-forge. On failure, inspect only the sanitized
forge-routes-live.json and .transport.json receipts. Never repeat the operation
because a terminal observation timed out. If a known created repository needs
cleanup, use the same contained command with --cleanup-only appended. It checks
the recorded numeric identity again. If creation returned ambiguously before an
ID was recorded, stop for identity reconciliation; cleanup never guesses by name.
Readback must show result: verified, all checks true, and deletion confirmed.
The containing login must also report session revocation. A successful child
receipt with unconfirmed revocation is not complete attended-session acceptance.
No raw child output, PAT, response body or log content belongs in the handoff.
This proves the specified deployed HTTP/API routes only. Browser/SSO journeys, the external-submodule repository, import/mirror, historical/LFS/log/artifact coverage, CI independence and private finding response remain required work.