tegwick
7d915a2eb5
REUSE_SURFACE_TOKEN is custody of the Railiance01 K8s secret reuse-surface-env, not OpenBao. Workers blocked on hub register can now discover the lane via warden route find and obtain it through the documented kubectl handoff.
2.4 KiB
reuse-surface Hub Write Token
Date: 2026-07-07
Catalog: reuse-surface-hub-write-token (status active, resolvable: true)
Owner: reuse-surface (service) · deploy custody railiance-apps (K8s secret)
Bearer token for authenticated writes to the production federation hub at
https://reuse.coulomb.social (POST /v1/repos, reuse-surface hub register).
ops-warden does not hold this token — it is a pointer lane to the cluster
secret that backs the hub Deployment.
Owner-confirmed lane (no placeholders)
| Field | Value |
|---|---|
| Cluster | Railiance01 (92.205.62.239) |
| Namespace | reuse |
| Secret | reuse-surface-env |
| Field | REUSE_SURFACE_TOKEN |
| Kubeconfig | ~/.kube/config-hosteurope |
| Deploy runbook | railiance-apps/docs/reuse-surface-on-railiance01.md |
| Hub API spec | reuse-surface/specs/FederationHubAPI.md |
This is not an OpenBao KV path. The token is generated at deploy time and
stored only in the Kubernetes Secret consumed by the reuse-surface workload.
Worker checklist
-
Confirm kubeconfig reachability (you act as yourself; ops-warden adds no credential):
kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse -
Export for a shell session (value streams to your terminal — never paste into chat):
export REUSE_SURFACE_URL=https://reuse.coulomb.social export REUSE_SURFACE_TOKEN=$( kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \ -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d ) -
Or proxy via warden access (same kubectl command, audited metadata only):
warden route show reuse-surface-hub-write-token --json warden access reuse-surface-hub-write-token --no-policy --fetch -
Register a repo after publish-check passes:
reuse-surface hub status reuse-surface hub register --repo <slug> \ --url <gitea-raw-capabilities-yaml-url> \ --domain <domain> -
Verify federated index picked up the new source:
curl -fsS "$REUSE_SURFACE_URL/v1/federated" | jq '.sources | map(.repo) | index("<slug>")'
Never commit the token, paste it into State Hub or agent chat, or store it in a
workplan. Rotation: regenerate the secret on-cluster and roll the Deployment
(reuse-surface/docs/deploy/reuse-kubernetes.md).