feat(identity): bind personas to workload authority #7

Merged

riley merged 7 commits from feat/persona-workload-identity into main 2026-07-21 01:16:38 +00:00

Conversation 2 Commits 7 Files changed 80 +2441 -192

codetether-bot commented 2026-07-20 23:40:11 +00:00

Collaborator

Copy link

First-class persona workload identity: deterministic Kubernetes/SPIFFE identity, dedicated Keycloak service accounts, explicit OPA roles, immutable PostgreSQL bindings, Forgejo receipts, rotating SPIRE TLS trust, and production Argo wiring. Validation: 171 focused tests, Ruff, Helm lint, Kubernetes server-side dry run, live TLS verification, and PostgreSQL 16 integration. Depends on forgejo-codetether-agent PR #2 for receipt projection.

First-class persona workload identity: deterministic Kubernetes/SPIFFE identity, dedicated Keycloak service accounts, explicit OPA roles, immutable PostgreSQL bindings, Forgejo receipts, rotating SPIRE TLS trust, and production Argo wiring. Validation: 171 focused tests, Ruff, Helm lint, Kubernetes server-side dry run, live TLS verification, and PostgreSQL 16 integration. Depends on forgejo-codetether-agent PR #2 for receipt projection.

codetether-bot added 2 commits 2026-07-20 23:40:11 +00:00

feat(identity): bind personas to workload authority b046e01750

ops(identity): enable verified workload provisioning 5aeb9571a7

codetether-bot added 1 commit 2026-07-20 23:42:41 +00:00

style(identity): apply repository formatter 69f056cf2e

riley added 2 commits 2026-07-21 00:55:40 +00:00

fix(identity): use codetether.run trust domain 36408051c7

ops(identity): record Forgejo canary rollout 55350e8ab9

riley added 1 commit 2026-07-21 00:58:47 +00:00

style(identity): format trust-domain tests b75ee99155

riley added 1 commit 2026-07-21 01:14:47 +00:00

ops(identity): record Forgejo production rollout 118bb70dce

riley merged commit 36d3943ef2 into main 2026-07-21 01:16:38 +00:00

riley referenced this pull request from a commit 2026-07-21 01:16:40 +00:00

Merge pull request 'feat(identity): bind personas to workload authority' (#7) from feat/persona-workload-identity into main

codetether-bot commented 2026-07-27 21:16:48 +00:00

Author

Collaborator

Copy link

⚠️ CodeTether Fix

Task ended with status failed.

Error: OpenAI Codex ChatGPT backend is disabled. Configure OPENAI_API_KEY for the official OpenAI API, or set CODETETHER_OPENAI_CODEX_ALLOW_CHATGPT_BACKEND=1 to opt in.

Task: d518b65e-ae70-477a-839c-884cb1dcce6f

## ⚠️ CodeTether Fix Task ended with status `failed`. Error: OpenAI Codex ChatGPT backend is disabled. Configure OPENAI_API_KEY for the official OpenAI API, or set CODETETHER_OPENAI_CODEX_ALLOW_CHATGPT_BACKEND=1 to opt in. Task: `d518b65e-ae70-477a-839c-884cb1dcce6f` <!-- codetether-forgejo-terminal:d518b65e-ae70-477a-839c-884cb1dcce6f -->

codetether-bot commented 2026-07-27 21:17:18 +00:00

Author

Collaborator

Copy link

⚠️ CodeTether Fix

Task ended with status failed.

Error: OpenAI Codex ChatGPT backend is disabled. Configure OPENAI_API_KEY for the official OpenAI API, or set CODETETHER_OPENAI_CODEX_ALLOW_CHATGPT_BACKEND=1 to opt in.

Task: 9c8fc60b-0e80-4c28-8bc2-e54df60bf6f1

## ⚠️ CodeTether Fix Task ended with status `failed`. Error: OpenAI Codex ChatGPT backend is disabled. Configure OPENAI_API_KEY for the official OpenAI API, or set CODETETHER_OPENAI_CODEX_ALLOW_CHATGPT_BACKEND=1 to opt in. Task: `9c8fc60b-0e80-4c28-8bc2-e54df60bf6f1` <!-- codetether-forgejo-terminal:9c8fc60b-0e80-4c28-8bc2-e54df60bf6f1 -->

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

riley/codetether!7

No description provided.