docs(secrets): start W4 access hardening #435

Merged

pdurlej merged 1 commit from codex/w4/secrets-access-triage into main

2026-05-24 18:54:17 +02:00

codex commented

2026-05-24 18:32:58 +02:00

Collaborator

Canary status: missing - rely on required Forgejo checks before merge

Canary Context Pack

Product story

W3 is accepted enough to continue, so W4 needs a clean secrets/access map before agents start touching PATs, Infisical, MCP identity, Redis argv, Kan config, or Vault sunset.

What changed

Adds state/cycle/W4-secrets-access-hardening-output.md.
Marks W4 active in state/STATUS_NOW.md.
Adds W4 subwaves to state/roadmap/current-platform-roadmap.md.

Why it changed

W4 is security-sensitive and too broad to execute as a single blob. This PR creates the operator-visible split: W4a runner/PAT, W4b identity/MCP, W4c secrets pipeline/leaks, W4d YubiKey design, W4e Vault handoff.

Files touched

state/cycle/W4-secrets-access-hardening-output.md
state/STATUS_NOW.md
state/roadmap/current-platform-roadmap.md

Relevant context

W3 immediate gate accepted in #434.
Milestone 03 issues: #56, #124, #131, #132, #181, #237, #265, #274.
docs/forgejo-agent-operations.md secret/identity rules.
docs/ci/runner-contract.md deploy-runner Token Auth target state.
docs/specs/vault-to-infisical-migration-v0/ for Vault handoff boundaries.

Runtime evidence

No runtime mutation and no secret reads. This is W4 entry triage only.

Known constraints

No direct PAT/fallback removal until W4a evidence proves Infisical Token Auth is live and rollbackable.
No bulk secret migration.
No Vault writes/sunset from this PR.
No production restart or apply.

Explicit out-of-scope

Implementing #56/#124/#237/#265.
Reading or printing secret values.
Changing RS2000/VPS1000 runtime.

Requested decision

Approve merge if checks pass. Next PR should be W4a read-only evidence for deploy runner Token Auth/direct PAT state.

Merge blockers

Any wording that implies all secrets should be migrated in one batch.
Any wording that authorizes direct PAT removal without evidence.
Any accidental runtime instruction that prints values.

Spec sources read

state/STATUS_NOW.md
state/roadmap/current-platform-roadmap.md
docs/forgejo-agent-operations.md
docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md
state/runtime-layout.md
docs/specs/forgejo-mcp-identity-split-v0/02-plan.md
docs/specs/vault-to-infisical-migration-v0/00-constitution.md
docs/specs/vault-to-infisical-migration-v0/02-plan-and-tasks.md
Forgejo issues #56, #124, #131, #132, #181, #237, #265, #274

Refs #56, #124, #131, #132, #181, #237, #265, #274.

Canary status: missing - rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W3 is accepted enough to continue, so W4 needs a clean secrets/access map before agents start touching PATs, Infisical, MCP identity, Redis argv, Kan config, or Vault sunset. ### What changed - Adds `state/cycle/W4-secrets-access-hardening-output.md`. - Marks W4 active in `state/STATUS_NOW.md`. - Adds W4 subwaves to `state/roadmap/current-platform-roadmap.md`. ### Why it changed W4 is security-sensitive and too broad to execute as a single blob. This PR creates the operator-visible split: W4a runner/PAT, W4b identity/MCP, W4c secrets pipeline/leaks, W4d YubiKey design, W4e Vault handoff. ### Files touched - `state/cycle/W4-secrets-access-hardening-output.md` - `state/STATUS_NOW.md` - `state/roadmap/current-platform-roadmap.md` ### Relevant context - W3 immediate gate accepted in #434. - Milestone 03 issues: #56, #124, #131, #132, #181, #237, #265, #274. - `docs/forgejo-agent-operations.md` secret/identity rules. - `docs/ci/runner-contract.md` deploy-runner Token Auth target state. - `docs/specs/vault-to-infisical-migration-v0/` for Vault handoff boundaries. ### Runtime evidence No runtime mutation and no secret reads. This is W4 entry triage only. ### Known constraints - No direct PAT/fallback removal until W4a evidence proves Infisical Token Auth is live and rollbackable. - No bulk secret migration. - No Vault writes/sunset from this PR. - No production restart or apply. ### Explicit out-of-scope - Implementing #56/#124/#237/#265. - Reading or printing secret values. - Changing RS2000/VPS1000 runtime. ### Requested decision Approve merge if checks pass. Next PR should be W4a read-only evidence for deploy runner Token Auth/direct PAT state. ### Merge blockers - Any wording that implies all secrets should be migrated in one batch. - Any wording that authorizes direct PAT removal without evidence. - Any accidental runtime instruction that prints values. ## Spec sources read - `state/STATUS_NOW.md` - `state/roadmap/current-platform-roadmap.md` - `docs/forgejo-agent-operations.md` - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` - `state/runtime-layout.md` - `docs/specs/forgejo-mcp-identity-split-v0/02-plan.md` - `docs/specs/vault-to-infisical-migration-v0/00-constitution.md` - `docs/specs/vault-to-infisical-migration-v0/02-plan-and-tasks.md` - Forgejo issues #56, #124, #131, #132, #181, #237, #265, #274 Refs #56, #124, #131, #132, #181, #237, #265, #274.

codex added 1 commit

2026-05-24 18:32:58 +02:00

docs(secrets): start W4 access hardening

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 20s