From 03edd82d53de94eeb96e061fcc5fe00b7b065732 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Wed, 19 Aug 2026 00:20:19 +0000
Subject: [PATCH] fix(P03 W6/W7): forge-agnostic token name in run_platform.sh
 + config (REQ-230)

The W6 'unset NOVA_GITEA_TOKEN' line in scripts/run_platform.sh tripped
the test_no_forge_mentions guard (REQ-230 forbids forge-specific names in
synced files). Renamed to NOVA_FORGE_TOKEN (forge-agnostic); .env.secrets
adds NOVA_FORGE_TOKEN as an alias; config.json scopes now map forge + gitea
-> NOVA_FORGE_TOKEN. scripts/rotate_spike_key.sh (excluded from the sync
scan) keeps the NOVA_GITEA_TOKEN backward-compat fallback for local runs.
Full suite green (844 passed).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---
---
 .ciagent/config.json                    | 3 ++-
 scripts/run_platform.sh                 | 5 ++++-
 tests/test_deploy_workflow_env_input.py | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.ciagent/config.json b/.ciagent/config.json
index 118b75e..cf9a3dc 100644
--- a/.ciagent/config.json
+++ b/.ciagent/config.json
@@ -72,7 +72,8 @@
     "sources": [".env", ".env.secrets", ".env.*"],
     "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"],
     "scopes": {
-      "gitea": "NOVA_GITEA_TOKEN",
+      "forge": "NOVA_FORGE_TOKEN",
+      "gitea": "NOVA_FORGE_TOKEN",
       "github": "GITHUB_TOKEN",
       "gitlab": "GITLAB_TOKEN",
       "openai": "OPENAI_API_KEY",
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index d508c81..dad0a01 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -389,11 +389,14 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
   # the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
   # secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
   # blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
+  # The forge-token name is forge-agnostic (NOVA_FORGE_TOKEN, REQ-230);
+  # scripts/rotate_spike_key.sh (excluded from the sync scan) keeps a
+  # forge-specific backward-compat fallback for local runs.
   export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
   export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
   # Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
   export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
-  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN
+  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN
 fi
 
 echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="
diff --git a/tests/test_deploy_workflow_env_input.py b/tests/test_deploy_workflow_env_input.py
index df4d694..d5c9538 100644
--- a/tests/test_deploy_workflow_env_input.py
+++ b/tests/test_deploy_workflow_env_input.py
@@ -113,5 +113,5 @@ def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
     assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
     assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
     assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
-    # ...then unsets the raw NOVA_AWS_* + the forge-token name.
-    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text
+    # ...then unsets the raw NOVA_AWS_* + the forge-agnostic forge-token name.
+    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN" in text