pdurlej/platform

Fork 0

fix(iskra): codify Forgejo ICS stale-feed fallback and repair credential lane #797

New issue

Open

opened 2026-06-17 21:27:15 +02:00 by codex · 1 comment

codex commented

2026-06-17 21:27:15 +02:00

Collaborator

Summary

iskra-forgejo-issues-ics.service was failing with Forgejo HTTP 401. Runtime was patched on 2026-06-17 to degrade to a stale feed when a previous issues.ics exists, so systemd no longer emits false-fire while the operator-facing feed remains usable. The root credential/token problem remains.

Scope

Codify the stale-feed fallback in the owning source repository or desired-state path.
Keep stale metadata explicit: status=fresh|stale, reason, timestamp, no private issue payload in manifest.
Diagnose/repair the Forgejo credential lane without printing token values.
Keep runtime behavior: if there is no previous feed, generator failure must still fail the unit.

Spec sources (whitelist)

state/reports/rs2000-runtime-health-closeout-2026-06-17.md
Runtime wrapper path observed: /opt/iskra-openclaw/scripts/iskra-publish-ics.sh
Runtime unit observed: /etc/systemd/system/iskra-forgejo-issues-ics.service

Do NOT read

Forgejo token values or token-bearing env files.
Private issue feed contents unless a separate live approval scopes that read.
Full iskra-openclaw repo until the owning source path for the wrapper is identified.

Extracted context

Closeout behavior:

iskra-forgejo-issues-ics.service -> status=0/SUCCESS after stale-feed fallback
manifest status=stale
reason=forgejo_fetch_failed
generatorExitCode=1
privacyMode=metadata_only

The wrapper backup before the final live edit is:

/opt/iskra-openclaw/scripts/iskra-publish-ics.sh.pre-stale-fallback-rc-fix-20260617T191016Z

Acceptance criteria

Source-controlled wrapper implements the same stale-feed behavior as runtime.
Service reports success only when a fresh feed is generated or an existing feed is safely retained with stale metadata.
HTTP 401 credential cause is repaired or explicitly blocked with a non-secret diagnostic.
No token values, token prefixes/suffixes, private issue contents, or feed secret path components are posted.
Runtime drift between source and RS2000 is closed after review.

Hard stops

Do not read or print the Forgejo token value.
Do not broaden token scope without live scoped approval.
Do not expose the ICS feed publicly beyond the existing route.
Do not delete the previous issues.ics fallback artifact.

Source

Created from RS2000 runtime health closeout on 2026-06-17.

## Summary `iskra-forgejo-issues-ics.service` was failing with Forgejo HTTP 401. Runtime was patched on 2026-06-17 to degrade to a stale feed when a previous `issues.ics` exists, so systemd no longer emits false-fire while the operator-facing feed remains usable. The root credential/token problem remains. ## Scope - Codify the stale-feed fallback in the owning source repository or desired-state path. - Keep stale metadata explicit: `status=fresh|stale`, `reason`, timestamp, no private issue payload in manifest. - Diagnose/repair the Forgejo credential lane without printing token values. - Keep runtime behavior: if there is no previous feed, generator failure must still fail the unit. ## Spec sources (whitelist) - `state/reports/rs2000-runtime-health-closeout-2026-06-17.md` - Runtime wrapper path observed: `/opt/iskra-openclaw/scripts/iskra-publish-ics.sh` - Runtime unit observed: `/etc/systemd/system/iskra-forgejo-issues-ics.service` ## Do NOT read - Forgejo token values or token-bearing env files. - Private issue feed contents unless a separate live approval scopes that read. - Full `iskra-openclaw` repo until the owning source path for the wrapper is identified. ## Extracted context Closeout behavior: ```text iskra-forgejo-issues-ics.service -> status=0/SUCCESS after stale-feed fallback manifest status=stale reason=forgejo_fetch_failed generatorExitCode=1 privacyMode=metadata_only ``` The wrapper backup before the final live edit is: ```text /opt/iskra-openclaw/scripts/iskra-publish-ics.sh.pre-stale-fallback-rc-fix-20260617T191016Z ``` ## Acceptance criteria - Source-controlled wrapper implements the same stale-feed behavior as runtime. - Service reports success only when a fresh feed is generated or an existing feed is safely retained with stale metadata. - HTTP 401 credential cause is repaired or explicitly blocked with a non-secret diagnostic. - No token values, token prefixes/suffixes, private issue contents, or feed secret path components are posted. - Runtime drift between source and RS2000 is closed after review. ## Hard stops - Do not read or print the Forgejo token value. - Do not broaden token scope without live scoped approval. - Do not expose the ICS feed publicly beyond the existing route. - Do not delete the previous `issues.ics` fallback artifact. ## Source Created from RS2000 runtime health closeout on 2026-06-17.

codex added the

class/security-sensitive

status:operator-needed

owner-attention

labels

2026-06-17 21:27:15 +02:00

codex referenced this issue

2026-06-17 21:31:11 +02:00

ops(rs2000): close runtime health cleanup #800

Iskra commented

2026-06-20 03:02:02 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#797`
Priority	p1
Action	operator_needed
Scores	reach 4 / impact 4 / confidence 4
Piotr fit	high
Effort	medium
Labels	`judge/p1`, `judge/operator-needed`
Judge	`iskra` via `openclaw`

Rationale: This is a high-priority runtime reliability and exposure-control item because it preserves Forgejo issue feed behavior while the underlying credential failure remains blocked.

Caveat: The judgment does not inspect token material or verify the live Forgejo service state.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 4,
  "effort_hint": "medium",
  "escalation": {
    "kind": "operator",
    "reason": "The target remains blocked on a security-sensitive Forgejo credential lane and should be repaired under operator control."
  },
  "evidence_refs": [
    {
      "note": "Public repository metadata and dry-run packet only.",
      "type": "snapshot",
      "value": "issue-or-pr-title-body-labels-and-target-snapshot"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-20T00:00:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/operator-needed"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This is a high-priority runtime reliability and exposure-control item because it preserves Forgejo issue feed behavior while the underlying credential failure remains blocked.",
  "reach": 4,
  "recommended_next_action": "operator_needed",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 797,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:d4b5a4fe41be1cbfe5b1ba802ba52e120a4c9a82e20c4be9a6974845b8bf1998",
    "commit_count": null,
    "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "head_sha": null,
    "labels": [
      "class/security-sensitive",
      "domain:forgejo",
      "domain:runtime",
      "kind/ops",
      "owner-attention",
      "priority:p1",
      "risk/exposure",
      "risk/runtime",
      "safety:secret-touch",
      "status:blocked",
      "status:operator-needed"
    ],
    "labels_hash": "sha256:dd11e4586cb86cae5bdcf6b39cbd00b416f19518979d0c4744c4b13a176dfa49",
    "state": "open",
    "title_hash": "sha256:d5d46d5dcfb2a91e2eedde6013ca80241cd787f3d2c79e4906952196fb957b59",
    "updated_at": "2026-06-17T21:31:11+02:00"
  },
  "top_caveat": "The judgment does not inspect token material or verify the live Forgejo service state."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#797` | | Priority | p1 | | Action | operator_needed | | Scores | reach 4 / impact 4 / confidence 4 | | Piotr fit | high | | Effort | medium | | Labels | `judge/p1`, `judge/operator-needed` | | Judge | `iskra` via `openclaw` | **Rationale:** This is a high-priority runtime reliability and exposure-control item because it preserves Forgejo issue feed behavior while the underlying credential failure remains blocked. **Caveat:** The judgment does not inspect token material or verify the live Forgejo service state. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 4, "effort_hint": "medium", "escalation": { "kind": "operator", "reason": "The target remains blocked on a security-sensitive Forgejo credential lane and should be repaired under operator control." }, "evidence_refs": [ { "note": "Public repository metadata and dry-run packet only.", "type": "snapshot", "value": "issue-or-pr-title-body-labels-and-target-snapshot" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-20T00:00:00Z", "labels_to_apply": [ "judge/p1", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This is a high-priority runtime reliability and exposure-control item because it preserves Forgejo issue feed behavior while the underlying credential failure remains blocked.", "reach": 4, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 797, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:d4b5a4fe41be1cbfe5b1ba802ba52e120a4c9a82e20c4be9a6974845b8bf1998", "commit_count": null, "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "head_sha": null, "labels": [ "class/security-sensitive", "domain:forgejo", "domain:runtime", "kind/ops", "owner-attention", "priority:p1", "risk/exposure", "risk/runtime", "safety:secret-touch", "status:blocked", "status:operator-needed" ], "labels_hash": "sha256:dd11e4586cb86cae5bdcf6b39cbd00b416f19518979d0c4744c4b13a176dfa49", "state": "open", "title_hash": "sha256:d5d46d5dcfb2a91e2eedde6013ca80241cd787f3d2c79e4906952196fb957b59", "updated_at": "2026-06-17T21:31:11+02:00" }, "top_caveat": "The judgment does not inspect token material or verify the live Forgejo service state." }  ``` </details>

Iskra added the

judge/operator-needed

judge/p1

labels

2026-06-20 03:02:02 +02:00