ops(secret-recovery): review held Forgejo admin/temp PATs after cooldown #722

New issue

Open

opened 2026-06-05 07:20:48 +02:00 by codex · 1 comment

codex commented

2026-06-05 07:20:48 +02:00

Collaborator

Context: during secret recovery on 2026-06-05, FORGEJO_API_TOKEN and FORGEJO_ADMIN_PAT_TEMP were intentionally held, not rotated/revoked, per live owner direction. They are useful recovery/admin lane credentials while multiple agents are still active.

Acceptance:

Re-check after a few stable days whether both are still needed.
If still needed, document owner, scope, and expected expiry.
If no longer needed, rotate/revoke through the normal backup-gated path.
Do not print token values, prefixes, suffixes, hashes, or raw env.

Non-goal: do not revoke during the immediate post-recovery cooldown.

Context: during secret recovery on 2026-06-05, `FORGEJO_API_TOKEN` and `FORGEJO_ADMIN_PAT_TEMP` were intentionally held, not rotated/revoked, per live owner direction. They are useful recovery/admin lane credentials while multiple agents are still active. Acceptance: - Re-check after a few stable days whether both are still needed. - If still needed, document owner, scope, and expected expiry. - If no longer needed, rotate/revoke through the normal backup-gated path. - Do not print token values, prefixes, suffixes, hashes, or raw env. Non-goal: do not revoke during the immediate post-recovery cooldown.

codex referenced this issue

2026-06-05 07:34:46 +02:00

security: rotate secrets exposed during Kan analytics deploy transcript #711

Iskra commented

2026-06-12 03:14:25 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#722`
Priority	p1
Action	operator_needed
Scores	reach 4 / impact 4 / confidence 5
Piotr fit	high
Effort	small
Labels	`judge/p1`, `judge/operator-needed`
Judge	`iskra` via `openclaw`

Rationale: This is P1 operator-needed security hygiene because temporary recovery credentials should not remain open-ended after the cooldown window.

Caveat: Do not print token values, prefixes, suffixes, hashes, or raw env while deciding whether to retain or revoke them.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 5,
  "effort_hint": "small",
  "escalation": {
    "kind": "operator",
    "reason": "Held admin and recovery credentials require owner-approved review, expiry decision, and backup-gated rotation path."
  },
  "evidence_refs": [
    {
      "note": "Issue tracks post-cooldown review of Forgejo admin and temp PATs intentionally held during secret recovery.",
      "type": "forgejo",
      "value": "issue-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Body states the credentials were held per live owner direction because multiple agents still needed recovery or admin lanes.",
      "type": "forgejo",
      "value": "issue-body-context"
    },
    {
      "note": "Acceptance requires re-checking need, documenting owner/scope/expiry if retained, or rotating/revoking through backup-gated path if no longer needed.",
      "type": "forgejo",
      "value": "issue-body-acceptance"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-12T01:14:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/operator-needed"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This is P1 operator-needed security hygiene because temporary recovery credentials should not remain open-ended after the cooldown window.",
  "reach": 4,
  "recommended_next_action": "operator_needed",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 722,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:a47ed5ffe090d57dfaaa89a28151b0a90ce5d498d7a59ecd3bab16bb0527b35e",
    "commit_count": null,
    "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "head_sha": null,
    "labels": [],
    "labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "state": "open",
    "title_hash": "sha256:63d41ca71354d51c1149cb94bab57b1eed49a2d132708c03c8bfafad8c2bf2df",
    "updated_at": "2026-06-05T07:34:46+02:00"
  },
  "top_caveat": "Do not print token values, prefixes, suffixes, hashes, or raw env while deciding whether to retain or revoke them."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#722` | | Priority | p1 | | Action | operator_needed | | Scores | reach 4 / impact 4 / confidence 5 | | Piotr fit | high | | Effort | small | | Labels | `judge/p1`, `judge/operator-needed` | | Judge | `iskra` via `openclaw` | **Rationale:** This is P1 operator-needed security hygiene because temporary recovery credentials should not remain open-ended after the cooldown window. **Caveat:** Do not print token values, prefixes, suffixes, hashes, or raw env while deciding whether to retain or revoke them. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 5, "effort_hint": "small", "escalation": { "kind": "operator", "reason": "Held admin and recovery credentials require owner-approved review, expiry decision, and backup-gated rotation path." }, "evidence_refs": [ { "note": "Issue tracks post-cooldown review of Forgejo admin and temp PATs intentionally held during secret recovery.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body states the credentials were held per live owner direction because multiple agents still needed recovery or admin lanes.", "type": "forgejo", "value": "issue-body-context" }, { "note": "Acceptance requires re-checking need, documenting owner/scope/expiry if retained, or rotating/revoking through backup-gated path if no longer needed.", "type": "forgejo", "value": "issue-body-acceptance" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-12T01:14:00Z", "labels_to_apply": [ "judge/p1", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This is P1 operator-needed security hygiene because temporary recovery credentials should not remain open-ended after the cooldown window.", "reach": 4, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 722, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:a47ed5ffe090d57dfaaa89a28151b0a90ce5d498d7a59ecd3bab16bb0527b35e", "commit_count": null, "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "head_sha": null, "labels": [], "labels_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "state": "open", "title_hash": "sha256:63d41ca71354d51c1149cb94bab57b1eed49a2d132708c03c8bfafad8c2bf2df", "updated_at": "2026-06-05T07:34:46+02:00" }, "top_caveat": "Do not print token values, prefixes, suffixes, hashes, or raw env while deciding whether to retain or revoke them." }  ``` </details>

Iskra added the

judge/operator-needed

judge/p1

labels

2026-06-12 03:14:25 +02:00