From 7e757b0fd9dcff228a79a9564aa6bd77b581401c Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Sun, 13 Sep 2026 20:09:50 +1200 Subject: [PATCH] harness(HC-11): declare write_targets on the four forge-credential layers (gitea-admin, gitea-ssh, gitea-ssh-accelerators, gitea-ssh-homelab) (b1de17b4) Held locally until the agent-runtimes HC-11 composer change is deployed: the live composer is extra=forbid and would reject the new key. Claude-Session: https://claude.ai/code/session_018LRh1S2bHJYhEgrMu3UJx8 --- harnesses/contexts/gitea-admin/v1/harness.yaml | 3 +++ harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml | 3 +++ harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml | 3 +++ harnesses/contexts/gitea-ssh/v1/harness.yaml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/harnesses/contexts/gitea-admin/v1/harness.yaml b/harnesses/contexts/gitea-admin/v1/harness.yaml index cbae8dd..0dc8c75 100644 --- a/harnesses/contexts/gitea-admin/v1/harness.yaml +++ b/harnesses/contexts/gitea-admin/v1/harness.yaml @@ -4,6 +4,9 @@ version: 1 description: "Gitea admin: SSH, git identity, API token for skynet org" requires: [] provides: [gitea-admin] +# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate). +write_targets: + - "gitea.oreillyit.nz/skynet/*" git_identity: name: "agent-runtimes" diff --git a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml index 20e8959..b3ff668 100644 --- a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml +++ b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml @@ -4,6 +4,9 @@ version: 1 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (accelerator_automation / accelerators org)" requires: [] provides: [git-access] +# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate). +write_targets: + - "gitea.oreillyit.nz/accelerators/*" git_identity: name: "agent-runtimes" diff --git a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml index d10a104..3ed95e6 100644 --- a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml +++ b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml @@ -4,6 +4,9 @@ version: 1 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (cluster-administrator / homelab org)" requires: [] provides: [git-access] +# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate). +write_targets: + - "gitea.oreillyit.nz/homelab/*" git_identity: name: "agent-runtimes" diff --git a/harnesses/contexts/gitea-ssh/v1/harness.yaml b/harnesses/contexts/gitea-ssh/v1/harness.yaml index e05b647..cc7bf23 100644 --- a/harnesses/contexts/gitea-ssh/v1/harness.yaml +++ b/harnesses/contexts/gitea-ssh/v1/harness.yaml @@ -4,6 +4,9 @@ version: 1 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (ai_enablement)" requires: [] provides: [git-access] +# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate). +write_targets: + - "gitea.oreillyit.nz/skynet/*" git_identity: name: "agent-runtimes"