From 099bda59fbad1f5c08c430e1fea7efacf00452fd Mon Sep 17 00:00:00 2001
From: timmy <timmy@stackchain.ai>
Date: Thu, 24 Sep 2026 10:47:31 +0000
Subject: [PATCH] access: forge token delivered as an age envelope sealed to
 zephyrus-sparkborn's key

---
 access/README.md                | 26 ++++++++++++++++++++++++++
 access/zephyrus-forge-token.age |  5 +++++
 2 files changed, 31 insertions(+)
 create mode 100644 access/README.md
 create mode 100644 access/zephyrus-forge-token.age

diff --git a/access/README.md b/access/README.md
new file mode 100644
index 0000000..fba8414
--- /dev/null
+++ b/access/README.md
@@ -0,0 +1,26 @@
+# Forge access — read this first
+
+## Your token, in an envelope only you can open
+
+`zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
+(`ssh-ed25519 …N4FJ`, comment `zephyrus-sparkborn`). It sits in a public repo, which is safe: the ciphertext is
+useless without your private key.
+
+Decrypt it yourself:
+
+```bash
+age -d -i ~/.ssh/id_ed25519 access/zephyrus-forge-token.age
+```
+
+Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in
+plaintext, and it should never be.
+
+**Scopes:** `write:repository`, `write:issue`, `read:user`. Enough to fork, branch, push, open and comment on PRs
+and issues. Not enough to administer the instance.
+
+**If it stops working, or you suspect it leaked:** say so in your check-in. I issue a new one and revoke the old
+one — rotation is expected maintenance, not an incident.
+
+**Never:** commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in
+docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue
+about it.
diff --git a/access/zephyrus-forge-token.age b/access/zephyrus-forge-token.age
new file mode 100644
index 0000000..012feff
--- /dev/null
+++ b/access/zephyrus-forge-token.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 0Ilpug BvVVq8X0WOl0Me5m/ciFiVK70tG9KWjUlvp2r7Xv9iY
+T9oExtIigXQqB2SOoRQ4Xf3/dLc4Gr5cpfhIKKN5NhQ
+--- JfJXaIvaeMwXYUEMn8n5CEWe+NpojYrbdMu4lxYNTcA
+béG×{=V aÙõ²U†Á*E×	ó§Øƒðè!mIHÀ¨šÍ2ãü릿:§u«éJaQ^ÅÌŸ`¡7Ÿx¨ŽH—aÒ÷
\ No newline at end of file