docs(secrets): record W4a direct PAT removal #437

Merged

pdurlej merged 1 commit from codex/w4a/remove-direct-pat-report into main

2026-05-24 19:19:50 +02:00

codex commented

2026-05-24 19:18:22 +02:00

Collaborator

Canary status: missing — state/report-only documentation PR; rely on required Forgejo checks before merge

Canary Context Pack

Product story

W4a closes the deploy-runner direct PAT fallback removal with operator-visible evidence. The deploy lane should now depend on Infisical Token Auth in normal state, with rollback documented but not active.

What changed

Added state/reports/w4a-direct-pat-removal-2026-05-24.md with runtime evidence, smoke result, and rollback.
Updated state/cycle/W4-secrets-access-hardening-output.md to mark W4a removal complete.
Updated state/STATUS_NOW.md with the latest W4a evidence and next steps.

Why it changed

Operator approved w4a-remove-direct-pat-approved; the fallback was removed and a no-op auto-apply smoke confirmed Infisical Token Auth was used.

Files touched

state/reports/w4a-direct-pat-removal-2026-05-24.md
state/cycle/W4-secrets-access-hardening-output.md
state/STATUS_NOW.md

Relevant context

W4 secrets/access hardening
Issue #265 Token Auth migration
Issue #274 Token Auth rotation reminder

Runtime evidence

Backup: /var/lib/forgejo-deploy-runner/platformctl-deploy.env.w4a-20260524T170930Z.bak
Removed direct fallback key: PLATFORMCTL_FORGEJO_TOKEN
Restarted only forgejo-deploy-runner.service
Smoke: platformctl-auto-apply.yml run #1948 for matrix-well-known succeeded
Run log marker: forgejo_token_source=infisical-token-auth
Direct fallback marker count: 0
Unhealthy containers: 0
Watchdog positive restarts last 30m: 0

Known constraints

No secret values are stored in the repo report. #274 stays open for the 2026-08-12 Token Auth rotation.

Explicit out-of-scope

No further runtime mutation in this PR.
No Infisical token rotation.
No broader W4b/W4c identity or secret-pipeline changes.

Requested decision

Merge the evidence/report PR so #265 can be closed cleanly.

Merge blockers

Any contradiction in runtime evidence, accidental secret disclosure, or failing required checks.

Spec sources read

state/STATUS_NOW.md — current operator-facing status
state/cycle/W4-secrets-access-hardening-output.md — W4 execution state
state/reports/w4a-deploy-runner-token-auth-2026-05-24.md — W4a pre-removal evidence

Closes #265

Canary status: missing — state/report-only documentation PR; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story W4a closes the deploy-runner direct PAT fallback removal with operator-visible evidence. The deploy lane should now depend on Infisical Token Auth in normal state, with rollback documented but not active. ### What changed - Added `state/reports/w4a-direct-pat-removal-2026-05-24.md` with runtime evidence, smoke result, and rollback. - Updated `state/cycle/W4-secrets-access-hardening-output.md` to mark W4a removal complete. - Updated `state/STATUS_NOW.md` with the latest W4a evidence and next steps. ### Why it changed Operator approved `w4a-remove-direct-pat-approved`; the fallback was removed and a no-op auto-apply smoke confirmed Infisical Token Auth was used. ### Files touched - `state/reports/w4a-direct-pat-removal-2026-05-24.md` - `state/cycle/W4-secrets-access-hardening-output.md` - `state/STATUS_NOW.md` ### Relevant context - W4 secrets/access hardening - Issue #265 Token Auth migration - Issue #274 Token Auth rotation reminder ### Runtime evidence - Backup: `/var/lib/forgejo-deploy-runner/platformctl-deploy.env.w4a-20260524T170930Z.bak` - Removed direct fallback key: `PLATFORMCTL_FORGEJO_TOKEN` - Restarted only `forgejo-deploy-runner.service` - Smoke: `platformctl-auto-apply.yml` run #1948 for `matrix-well-known` succeeded - Run log marker: `forgejo_token_source=infisical-token-auth` - Direct fallback marker count: `0` - Unhealthy containers: `0` - Watchdog positive restarts last 30m: `0` ### Known constraints No secret values are stored in the repo report. #274 stays open for the 2026-08-12 Token Auth rotation. ### Explicit out-of-scope - No further runtime mutation in this PR. - No Infisical token rotation. - No broader W4b/W4c identity or secret-pipeline changes. ### Requested decision Merge the evidence/report PR so #265 can be closed cleanly. ### Merge blockers Any contradiction in runtime evidence, accidental secret disclosure, or failing required checks. ## Spec sources read - `state/STATUS_NOW.md` — current operator-facing status - `state/cycle/W4-secrets-access-hardening-output.md` — W4 execution state - `state/reports/w4a-deploy-runner-token-auth-2026-05-24.md` — W4a pre-removal evidence Closes #265

codex added 1 commit

2026-05-24 19:18:22 +02:00

docs(secrets): record W4a direct PAT removal

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 22s