coilyco-flight-deck/infrastructure
2
0
Fork 0
Code Issues 118 Pull requests Projects Releases Packages Wiki Activity Actions 2

provision-coilyco-ops-bot.sh: absorb the deploy-runner read-token mint/rotation #469

New issue
Closed
opened 2026-07-04 10:19:05 +00:00 by coilyco-ops · 4 comments
coilyco-ops commented 2026-07-04 10:19:05 +00:00
Member
Copy link

The /forgejo/read-token PAT (FORGEJO_READ_TOKEN on the deploy runner, infra#468 + deploy#38) is currently minted ad hoc: an agent fetches the bot password from SSM, basic-auths POST /api/v1/users/coilyco-ops/tokens with scope read:repository, and put-parameters the sha1 - flow documented in docs/cd-runner-private-source-token.md.

Fold that into provision-coilyco-ops-bot.sh so the bot provisioning/rotation script owns it like the api-token and password: idempotent (delete-then-recreate the named token, date-suffixed), same SSM write, same never-echo discipline. Then the doc section shrinks to a pointer at the script.

Provenance: kai-desktop-tower session 2026-07-04, first mint was agent-driven with explicit operator consent.

The /forgejo/read-token PAT (FORGEJO_READ_TOKEN on the deploy runner, infra#468 + deploy#38) is currently minted ad hoc: an agent fetches the bot password from SSM, basic-auths POST /api/v1/users/coilyco-ops/tokens with scope read:repository, and put-parameters the sha1 - flow documented in docs/cd-runner-private-source-token.md. Fold that into provision-coilyco-ops-bot.sh so the bot provisioning/rotation script owns it like the api-token and password: idempotent (delete-then-recreate the named token, date-suffixed), same SSM write, same never-echo discipline. Then the doc section shrinks to a pointer at the script. Provenance: kai-desktop-tower session 2026-07-04, first mint was agent-driven with explicit operator consent.
coilyco-ops commented 2026-07-10 12:22:03 +00:00
Author
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-469 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T12:22:02Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#469 · branch issue-469 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-469 · ward v0.580.0 · dispatched 2026-07-10T12:22:02Z
  • Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-469` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T12:22:02Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#469` · branch `issue-469` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-469` · ward `v0.580.0` · dispatched `2026-07-10T12:22:02Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 12:35:05 +00:00
Author
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-469 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T12:35:05Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#469 · branch issue-469 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-469 · ward v0.580.0 · dispatched 2026-07-10T12:35:05Z
  • Comment thread: 0 included in the pre-flight read, 1 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-469` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T12:35:05Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#469` · branch `issue-469` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-469` · ward `v0.580.0` · dispatched `2026-07-10T12:35:05Z` - **Comment thread:** 0 included in the pre-flight read, 1 stripped (ward's own automated comments). - stripped: @coilyco-ops (2026-07-10T12:22:03Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 12:49:26 +00:00
Author
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-469 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T12:49:26Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#469 · branch issue-469 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-469 · ward v0.580.0 · dispatched 2026-07-10T12:49:26Z
  • Comment thread: 0 included in the pre-flight read, 2 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-469` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T12:49:26Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#469` · branch `issue-469` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-469` · ward `v0.580.0` · dispatched `2026-07-10T12:49:26Z` - **Comment thread:** 0 included in the pre-flight read, 2 stripped (ward's own automated comments). - stripped: @coilyco-ops (2026-07-10T12:22:03Z), @coilyco-ops (2026-07-10T12:35:05Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 13:11:48 +00:00
Author
Member
Copy link

WARD-OUTCOME: done

details

workflow: direct-main; review summary: skipped (review gate skipped by ~/.ward/config.yaml default)
retrospective: this was mostly token plumbing plus a couple of rebases because origin/main kept moving.
confidence: high
surprises: the public actions API was enough to verify the run state, but the attended AWS helper had no credentials in this container.
follow-ups: none

WARD-OUTCOME: done <details><summary>details</summary> workflow: direct-main; review summary: skipped (review gate skipped by ~/.ward/config.yaml default) retrospective: this was mostly token plumbing plus a couple of rebases because origin/main kept moving. confidence: high surprises: the public actions API was enough to verify the run state, but the attended AWS helper had no credentials in this container. follow-ups: none </details>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue-515
issue-486
issue-529
issue-500
issue-483
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
consult
A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  
headless
Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  
interactive
Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  
P0
now / blocking / urgent

  
P1
next / important

  
P2
backlog / will do

  
P3
someday / low

  
P4
icebox / frozen / reopen if it becomes real

No labels
burndown-2026-06
coherence-core
consult
headless
interactive
P0
P1
P2
P3
P4
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilyco-flight-deck/infrastructure#469
No description provided.