docs(secrets): record W4a token auth evidence #436

Merged

pdurlej merged 1 commit from codex/w4a/deploy-runner-token-auth-evidence into main

2026-05-24 19:07:36 +02:00

codex commented

2026-05-24 19:03:12 +02:00

Collaborator

Canary status: missing - rely on required Forgejo checks before merge

Canary Context Pack

Product story

W4a needs to close the temporary deploy-runner direct PAT state without turning credential cleanup into guesswork. This PR records the read-only evidence before any runtime mutation.

What changed

Adds state/reports/w4a-deploy-runner-token-auth-2026-05-24.md.
Updates state/cycle/W4-secrets-access-hardening-output.md with W4a status.
Updates state/STATUS_NOW.md with the removal gate and evidence summary.

Why it changed

The runner is using Infisical Token Auth in real auto-apply logs, but the direct fallback key PLATFORMCTL_FORGEJO_TOKEN is still present. That should be removed only with explicit operator approval and rollback.

Files touched

state/reports/w4a-deploy-runner-token-auth-2026-05-24.md
state/cycle/W4-secrets-access-hardening-output.md
state/STATUS_NOW.md

Relevant context

#265 deploy-runner direct PAT to Infisical.
#274 Token Auth expiry rotation.
docs/ci/runner-contract.md target state: no runner-local direct PAT as normal state.
control-plane/platformctl/apply.py token resolution order.

Runtime evidence

Read-only only:

Token Auth file exists with mode 600, owner forgejo-deploy:forgejo-deploy, size 333 bytes.
Runner env file exists with mode 600, owner forgejo-deploy:forgejo-deploy, size 907 bytes.
Direct fallback key still present: PLATFORMCTL_FORGEJO_TOKEN.
Last 48h auto-apply logs checked: 16.
forgejo_token_source=infisical-token-auth: 16 logs.
forgejo_token_source=direct-env-fallback: 0 logs.
Watchdog positive restarts in last 24h: 0.

Known constraints

No secret value was read or printed.
Direct fallback removal is not part of this PR.
Removing the fallback is a runtime credential mutation and requires w4a-remove-direct-pat-approved.

Explicit out-of-scope

Editing RS2000 runtime files.
Restarting the deploy runner.
Running a new auto-apply smoke.
Closing #265.

Requested decision

Approve merge if checks pass. After merge, operator can approve w4a-remove-direct-pat-approved to remove the dead fallback with backup + rollback.

Merge blockers

Any secret value in the report.
Any statement that direct fallback is removed already.
Any weakening of the explicit removal gate.

Spec sources read

state/cycle/W4-secrets-access-hardening-output.md
state/STATUS_NOW.md
docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md
control-plane/platformctl/apply.py
RS2000 read-only systemd/stat/journal/action-log metadata

Refs #265, #274.

Canary status: missing - rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W4a needs to close the temporary deploy-runner direct PAT state without turning credential cleanup into guesswork. This PR records the read-only evidence before any runtime mutation. ### What changed - Adds `state/reports/w4a-deploy-runner-token-auth-2026-05-24.md`. - Updates `state/cycle/W4-secrets-access-hardening-output.md` with W4a status. - Updates `state/STATUS_NOW.md` with the removal gate and evidence summary. ### Why it changed The runner is using Infisical Token Auth in real auto-apply logs, but the direct fallback key `PLATFORMCTL_FORGEJO_TOKEN` is still present. That should be removed only with explicit operator approval and rollback. ### Files touched - `state/reports/w4a-deploy-runner-token-auth-2026-05-24.md` - `state/cycle/W4-secrets-access-hardening-output.md` - `state/STATUS_NOW.md` ### Relevant context - #265 deploy-runner direct PAT to Infisical. - #274 Token Auth expiry rotation. - `docs/ci/runner-contract.md` target state: no runner-local direct PAT as normal state. - `control-plane/platformctl/apply.py` token resolution order. ### Runtime evidence Read-only only: - Token Auth file exists with mode `600`, owner `forgejo-deploy:forgejo-deploy`, size `333` bytes. - Runner env file exists with mode `600`, owner `forgejo-deploy:forgejo-deploy`, size `907` bytes. - Direct fallback key still present: `PLATFORMCTL_FORGEJO_TOKEN`. - Last 48h auto-apply logs checked: 16. - `forgejo_token_source=infisical-token-auth`: 16 logs. - `forgejo_token_source=direct-env-fallback`: 0 logs. - Watchdog positive restarts in last 24h: 0. ### Known constraints - No secret value was read or printed. - Direct fallback removal is not part of this PR. - Removing the fallback is a runtime credential mutation and requires `w4a-remove-direct-pat-approved`. ### Explicit out-of-scope - Editing RS2000 runtime files. - Restarting the deploy runner. - Running a new auto-apply smoke. - Closing #265. ### Requested decision Approve merge if checks pass. After merge, operator can approve `w4a-remove-direct-pat-approved` to remove the dead fallback with backup + rollback. ### Merge blockers - Any secret value in the report. - Any statement that direct fallback is removed already. - Any weakening of the explicit removal gate. ## Spec sources read - `state/cycle/W4-secrets-access-hardening-output.md` - `state/STATUS_NOW.md` - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` - `control-plane/platformctl/apply.py` - RS2000 read-only systemd/stat/journal/action-log metadata Refs #265, #274.

codex added 1 commit

2026-05-24 19:03:12 +02:00

docs(secrets): record W4a token auth evidence

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 23s