docs(status): note Infisical Token Auth soak blocker #276

Merged

pdurlej merged 2 commits from codex/status/infisical-token-auth-pending-soak into main

2026-05-14 09:44:29 +02:00

codex commented

2026-05-14 09:24:30 +02:00

Collaborator

Canary status: missing - status-only PR; operator merge after spot-check.

Canary Context Pack

Product story

STATUS_NOW.md is the operator wakeup file. After #273 merged, run #729/API #869 proved that the deploy runner can resolve the Forgejo apply token through Infisical Token Auth.

What changed

Updated the Owner Action Board to reflect the current safe state:

Infisical Token Auth soak started on 2026-05-14 after run #729/API #869.
Soak ends 2026-05-21 if repeated Infisical-path smokes stay green and there are no 403/token errors.
Direct PAT stays during soak.
Expiry is tracked in #274, action by 2026-08-08.

Why it changed

Before #273, a smoke would have preferred direct PAT and been a false positive. After #273 merged and run #729 succeeded with forgejo_token_source=infisical-token-auth, the status file should show the real state: soak has started, but direct PAT removal is still blocked.

Files touched

state/STATUS_NOW.md

Runtime evidence

Run #729/API #869: success, workflow_dispatch, commit cec1037b....
Log marker: forgejo_token_source=infisical-token-auth appeared twice.
No direct-env-fallback marker observed.
Artifact summary: plan in-sync, apply noop exitCode 0, health OK exitCode 0.

Known constraints

This PR does not claim the direct PAT can be removed. It only starts the soak clock.

Explicit out-of-scope

No runner env changes.
No direct PAT removal.
No F3/stateful smoke.

Requested decision

Merge after spot-check if the Owner Action Board matches the current operational truth.

Merge blockers

Any wording that implies direct PAT removal is allowed before 2026-05-21 and repeated green Infisical-path smokes.

Spec sources read

state/STATUS_NOW.md - target operator status file.
#142 run #729 evidence comments.
#265 Token Auth migration thread.
#274 expiry reminder issue.

Canary status: missing - status-only PR; operator merge after spot-check. ## Canary Context Pack ### Product story `STATUS_NOW.md` is the operator wakeup file. After #273 merged, run #729/API #869 proved that the deploy runner can resolve the Forgejo apply token through Infisical Token Auth. ### What changed Updated the Owner Action Board to reflect the current safe state: - Infisical Token Auth soak started on 2026-05-14 after run #729/API #869. - Soak ends 2026-05-21 if repeated Infisical-path smokes stay green and there are no 403/token errors. - Direct PAT stays during soak. - Expiry is tracked in #274, action by 2026-08-08. ### Why it changed Before #273, a smoke would have preferred direct PAT and been a false positive. After #273 merged and run #729 succeeded with `forgejo_token_source=infisical-token-auth`, the status file should show the real state: soak has started, but direct PAT removal is still blocked. ### Files touched - `state/STATUS_NOW.md` ### Runtime evidence - Run #729/API #869: success, `workflow_dispatch`, commit `cec1037b...`. - Log marker: `forgejo_token_source=infisical-token-auth` appeared twice. - No `direct-env-fallback` marker observed. - Artifact summary: plan `in-sync`, apply `noop` exitCode 0, health `OK` exitCode 0. ### Known constraints This PR does not claim the direct PAT can be removed. It only starts the soak clock. ### Explicit out-of-scope - No runner env changes. - No direct PAT removal. - No F3/stateful smoke. ### Requested decision Merge after spot-check if the Owner Action Board matches the current operational truth. ### Merge blockers - Any wording that implies direct PAT removal is allowed before 2026-05-21 and repeated green Infisical-path smokes. ## Spec sources read - `state/STATUS_NOW.md` - target operator status file. - #142 run #729 evidence comments. - #265 Token Auth migration thread. - #274 expiry reminder issue.

codex added 1 commit

2026-05-14 09:24:30 +02:00

docs(status): note Infisical Token Auth soak blocker

canary-required / collect-diff (pull_request) Failing after 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

base-is-main / guard (pull_request) Successful in 1s

Details

5d1b43deb1

codex added the

risk/runtime