docs(ci): record Infisical Token Auth runner lessons #275

Merged

pdurlej merged 1 commit from codex/docs/runner-contract-infisical-lessons into main

2026-05-14 09:44:22 +02:00

codex commented

2026-05-14 09:23:05 +02:00

Collaborator

Canary status: missing - docs-only Lite PR; operator merge after spot-check.

Canary Context Pack

Product story

The Infisical Token Auth recovery burned too much time because the runner token expired silently and the failure looked like an ACL/method problem. This PR records the operational lesson where future agents will look first.

What changed

Added docs/ci/runner-contract.md section Lessons learned - Infisical Token Auth recovery (2026-05-13/14) covering:

minimum TTL for persistent runner tokens;
Token Auth + scoped ACL conditions;
expiry tracking and reminder issue practice;
v0.158.x raw-secrets/glob behavior;
RS2000 public-edge 403 vs local Infisical endpoint finding.

Why it changed

The 2026-05-14 close-out found that the previous short TTL was the root cause of repeated 403s, and that RS2000 cannot currently use the public Infisical edge path for the runner.

Files touched

docs/ci/runner-contract.md

Relevant context

#265 - Token Auth migration
#272 / #273 - silent direct-PAT fallback blocker and fix
#274 - pre-expiry rotation reminder
#142 - RS2000 cutover lane

Runtime evidence

No runtime changes in this PR.

Evidence gathered during the dispatch:

local token file mode 0600, size 333 bytes;
RS2000 token file mode 0600, owner forgejo-deploy:forgejo-deploy, size 333 bytes;
same token returns HTTP 200 from Mac and via local Infisical container endpoint on RS2000;
public https://infisical.pdurlej.com returns HTTP 403 from RS2000.

Known constraints

The operational smoke passed after #273 merged. This doc records the lesson; #276 tracks the soak start in STATUS_NOW.md.

Explicit out-of-scope

No workflow_dispatch smoke.
No direct PAT removal.
No production apply.
No Infisical UI/ACL changes.

Requested decision

Merge after spot-check if the lesson is accurate and useful.

Merge blockers

Any claim that soak has started before #273 + smoke.
Any secret value or token body.

Spec sources read

docs/ci/runner-contract.md - target doc.
scripts/forgejo/deploy-runner-install-infisical-token-auth - install behavior.
control-plane/platformctl/apply.py - resolver behavior.
state/codex-prep/rs2000-closeout-handover-2026-05-12.md - prior failure notes.

Canary status: missing - docs-only Lite PR; operator merge after spot-check. ## Canary Context Pack ### Product story The Infisical Token Auth recovery burned too much time because the runner token expired silently and the failure looked like an ACL/method problem. This PR records the operational lesson where future agents will look first. ### What changed Added `docs/ci/runner-contract.md` section `Lessons learned - Infisical Token Auth recovery (2026-05-13/14)` covering: - minimum TTL for persistent runner tokens; - Token Auth + scoped ACL conditions; - expiry tracking and reminder issue practice; - v0.158.x raw-secrets/glob behavior; - RS2000 public-edge 403 vs local Infisical endpoint finding. ### Why it changed The 2026-05-14 close-out found that the previous short TTL was the root cause of repeated 403s, and that RS2000 cannot currently use the public Infisical edge path for the runner. ### Files touched - `docs/ci/runner-contract.md` ### Relevant context - #265 - Token Auth migration - #272 / #273 - silent direct-PAT fallback blocker and fix - #274 - pre-expiry rotation reminder - #142 - RS2000 cutover lane ### Runtime evidence No runtime changes in this PR. Evidence gathered during the dispatch: - local token file mode `0600`, size `333 bytes`; - RS2000 token file mode `0600`, owner `forgejo-deploy:forgejo-deploy`, size `333 bytes`; - same token returns HTTP 200 from Mac and via local Infisical container endpoint on RS2000; - public `https://infisical.pdurlej.com` returns HTTP 403 from RS2000. ### Known constraints The operational smoke passed after #273 merged. This doc records the lesson; #276 tracks the soak start in STATUS_NOW.md. ### Explicit out-of-scope - No workflow_dispatch smoke. - No direct PAT removal. - No production apply. - No Infisical UI/ACL changes. ### Requested decision Merge after spot-check if the lesson is accurate and useful. ### Merge blockers - Any claim that soak has started before #273 + smoke. - Any secret value or token body. ## Spec sources read - `docs/ci/runner-contract.md` - target doc. - `scripts/forgejo/deploy-runner-install-infisical-token-auth` - install behavior. - `control-plane/platformctl/apply.py` - resolver behavior. - `state/codex-prep/rs2000-closeout-handover-2026-05-12.md` - prior failure notes.

codex added 1 commit

2026-05-14 09:23:05 +02:00

docs(ci): record Infisical Token Auth runner lessons

canary-required / collect-diff (pull_request) Failing after 3s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

workflow-lint / lint (pull_request) Successful in 4s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / canary (pull_request) Has been skipped