0012: Per-registration push tokens for CI¶
- Status:
Accepted
- Date:
2026-10-19
Context¶
CI pipelines are not users and have no OIDC identity, yet their writes must be scoped to the registrations they belong to.
Decision¶
Each registration lists env var names of its push tokens
(push_tokens_env).
Push intake accepts only these shared secrets, compared in constant
time; it never accepts OIDC or dev tokens, and push tokens are never
accepted by read routes.
A token authorizes writing candidates to its registration only.
Any client-supplied digest is ignored.
Consequences¶
A leaked push token can add candidates to one registration but cannot read the catalog, publish, or decide.
Rotation is an operator task: list a second env var, deploy, remove the old one.
There is no rate limit; every request, including refused ones, writes an
intake_runrow.