chore(m03): triage secrets/access backlog into active, deferred, superseded #538

New issue

Closed

opened 2026-05-28 01:21:52 +02:00 by codex · 2 comments

codex commented

2026-05-28 01:21:52 +02:00

Collaborator

Scope

Audit Milestone 03 and produce a compact disposition packet for the current secrets/access backlog.

Classify every open M03 issue into:

active now;
defer with reason;
superseded/close candidate;
needs operator decision;
security-sensitive manual lane.

Spec sources

state/roadmap/current-platform-roadmap.md § 03 - Secrets and access hardening
docs/forgejo-agent-operations.md
Open M03 issues: #529, #274, #237, #181, #132, #131

Acceptance criteria

Output is a short markdown packet or issue comment.
Every open M03 issue has a proposed disposition.
Token/secret values are not printed.
No secret rotation or runtime mutation.
Propose which issue should be next, if any.

Out of scope

Rotating tokens.
Editing Infisical.
Changing branch protection or runner credentials.

Agent notes

Recommended executor: Gemini 3.5 Flash local.

Rules:

Keep the PR small and boring.
Prefer closing/splitting stale work over adding new architecture docs.
Do not mutate production runtime.
Do not close issues live unless the issue explicitly requests it and evidence is clear.
PR body must include Spec sources read.

## Scope Audit Milestone 03 and produce a compact disposition packet for the current secrets/access backlog. Classify every open M03 issue into: - active now; - defer with reason; - superseded/close candidate; - needs operator decision; - security-sensitive manual lane. ## Spec sources - `state/roadmap/current-platform-roadmap.md` § 03 - Secrets and access hardening - `docs/forgejo-agent-operations.md` - Open M03 issues: #529, #274, #237, #181, #132, #131 ## Acceptance criteria - Output is a short markdown packet or issue comment. - Every open M03 issue has a proposed disposition. - Token/secret values are not printed. - No secret rotation or runtime mutation. - Propose which issue should be next, if any. ## Out of scope - Rotating tokens. - Editing Infisical. - Changing branch protection or runner credentials. ## Agent notes Recommended executor: Gemini 3.5 Flash local. Rules: - Keep the PR small and boring. - Prefer closing/splitting stale work over adding new architecture docs. - Do not mutate production runtime. - Do not close issues live unless the issue explicitly requests it and evidence is clear. - PR body must include `Spec sources read`.

codex added this to the 03 - Secrets and access hardening milestone

2026-05-28 01:21:52 +02:00

codex added the

labels

2026-05-28 01:21:52 +02:00

codex commented

2026-05-29 16:49:41 +02:00

Author

Collaborator

Role: executor
Intent: lane-outcome
Needs owner: no

M03 triage packet, metadata-only. No secrets, no runtime mutation, no Infisical writes.

Spec sources read:

state/roadmap/current-platform-roadmap.md § 03 - Secrets and access hardening
docs/forgejo-agent-operations.md
decisions/0024-infisical-primary-secrets-pipeline.md
runbooks/secrets-pipeline.md
docs/infisical/key-map.md
docs/agents/agent-sos.md
state/cycle/W4-secrets-access-hardening-output.md
state/reports/w4c-bws-recovery-archive-2026-05-24.md
Open/current M03 issues: #529, #274, #237, #131, #79

Disposition:

Issue	Disposition	Why
#529	closed / done	OLLAMA env aliases are implemented and merged in #605.
#274	defer to M10 / scheduled maintenance	Real future token lifecycle tracker; action window is 2026-08-08, not a current M03 closeout blocker. Keep open and visible.
#237	close as superseded/resolved broad parent	ADR-0024 chose Infisical primary; BWS recovery/archive recon found no current BWS files to recover; Agent SOS + key map now give agents the concrete operating path. Residual work should be narrow issue-specific fixes, not this broad April-era bucket.
#131	move to M08	This is Kan MCP / OpenClaw product-runtime config, explicitly called out by W4 as not a generic M03 blocker. It should be handled with Iskra/OpenClaw context.
#79	move to M06	This is agent-access/ssh-agent lifecycle hardening, not secret-source hardening. It belongs with agent execution and CI governance.

Recommended next:

Close this triage issue after recording the packet.
Close M03 once the moves/close above leave it with zero active closeout blockers.
Start M04 via #539 with M02 closed and M03 reduced to future scheduled maintenance / non-blocking follow-ups.

Next: apply the non-runtime issue hygiene above, then move to #539.

**Role:** executor **Intent:** lane-outcome **Needs owner:** no M03 triage packet, metadata-only. No secrets, no runtime mutation, no Infisical writes. Spec sources read: - `state/roadmap/current-platform-roadmap.md` § 03 - Secrets and access hardening - `docs/forgejo-agent-operations.md` - `decisions/0024-infisical-primary-secrets-pipeline.md` - `runbooks/secrets-pipeline.md` - `docs/infisical/key-map.md` - `docs/agents/agent-sos.md` - `state/cycle/W4-secrets-access-hardening-output.md` - `state/reports/w4c-bws-recovery-archive-2026-05-24.md` - Open/current M03 issues: #529, #274, #237, #131, #79 Disposition: | Issue | Disposition | Why | |---|---|---| | #529 | closed / done | OLLAMA env aliases are implemented and merged in #605. | | #274 | defer to M10 / scheduled maintenance | Real future token lifecycle tracker; action window is 2026-08-08, not a current M03 closeout blocker. Keep open and visible. | | #237 | close as superseded/resolved broad parent | ADR-0024 chose Infisical primary; BWS recovery/archive recon found no current BWS files to recover; Agent SOS + key map now give agents the concrete operating path. Residual work should be narrow issue-specific fixes, not this broad April-era bucket. | | #131 | move to M08 | This is Kan MCP / OpenClaw product-runtime config, explicitly called out by W4 as not a generic M03 blocker. It should be handled with Iskra/OpenClaw context. | | #79 | move to M06 | This is agent-access/ssh-agent lifecycle hardening, not secret-source hardening. It belongs with agent execution and CI governance. | Recommended next: 1. Close this triage issue after recording the packet. 2. Close M03 once the moves/close above leave it with zero active closeout blockers. 3. Start M04 via #539 with M02 closed and M03 reduced to future scheduled maintenance / non-blocking follow-ups. **Next:** apply the non-runtime issue hygiene above, then move to #539.

codex commented

2026-05-29 16:49:44 +02:00

Author

Collaborator

M03 triage actions applied: #274 moved to M10, #131 moved to M08, #79 moved to M06, #237 closed as superseded broad parent. Closing this triage issue.