2026-10-15 01:39:47 +02:00
|
|
|
|
---
|
|
|
|
|
|
id: MASON-WP-0013
|
|
|
|
|
|
type: workplan
|
|
|
|
|
|
title: "Construct the seven-repository reuse-surface source reader"
|
|
|
|
|
|
domain: infotech
|
|
|
|
|
|
repo: ops-mason
|
|
|
|
|
|
status: proposed
|
|
|
|
|
|
owner: codex
|
|
|
|
|
|
topic_slug: netkingdom-security-architecture
|
|
|
|
|
|
created: "2026-10-15"
|
|
|
|
|
|
updated: "2026-10-15"
|
|
|
|
|
|
flavor: implementation
|
|
|
|
|
|
depends_on: []
|
2026-10-18 11:24:59 +02:00
|
|
|
|
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
|
2026-10-15 01:39:47 +02:00
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
# Seven-repository hosted reader
|
|
|
|
|
|
|
|
|
|
|
|
Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
|
|
|
|
|
|
workplan is prepared in an isolated owner checkout and is not yet integrated,
|
|
|
|
|
|
synced, approved or executed. No production or credential authority is inferred.
|
|
|
|
|
|
|
|
|
|
|
|
## Prepare the construction bundle
|
|
|
|
|
|
|
|
|
|
|
|
```task
|
|
|
|
|
|
id: MASON-WP-0013-T01
|
|
|
|
|
|
status: done
|
|
|
|
|
|
priority: high
|
2026-10-18 11:24:59 +02:00
|
|
|
|
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
|
2026-10-15 01:39:47 +02:00
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Prepared `plans/reuse-surface-private-source-reader.md` and
|
|
|
|
|
|
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
|
|
|
|
|
|
ESO policy, data item, canonical candidate specification digest and SEC-DSM
|
|
|
|
|
|
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
|
|
|
|
|
|
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
|
|
|
|
|
|
with R1 evidence preserved. Plan remains draft because required live survey
|
|
|
|
|
|
and independent mechanism/owner reviews are missing.
|
|
|
|
|
|
|
|
|
|
|
|
## Complete scoped survey and construction review
|
|
|
|
|
|
|
|
|
|
|
|
```task
|
|
|
|
|
|
id: MASON-WP-0013-T02
|
|
|
|
|
|
status: wait
|
|
|
|
|
|
priority: high
|
2026-10-18 11:24:59 +02:00
|
|
|
|
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
|
2026-10-15 01:39:47 +02:00
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Requires legitimate own metadata-only survey grant or sanitized platform-owned
|
|
|
|
|
|
survey. Confirm current exact path/policy/role and matching-existing identity
|
|
|
|
|
|
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
|
|
|
|
|
|
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
|
|
|
|
|
|
Do not use operator tokens or another agent supervision record.
|
|
|
|
|
|
|
|
|
|
|
|
## Bind owner CCR and executable inputs to founder decision
|
|
|
|
|
|
|
|
|
|
|
|
```task
|
|
|
|
|
|
id: MASON-WP-0013-T03
|
|
|
|
|
|
status: wait
|
|
|
|
|
|
priority: high
|
2026-10-18 11:24:59 +02:00
|
|
|
|
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
|
2026-10-15 01:39:47 +02:00
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
|
|
|
|
|
|
and rollback artifacts including full fixed image, runtime-controlled allowlist
|
|
|
|
|
|
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
|
|
|
|
|
|
warden owns pointer review. Obtain separate founder decision on exact credential
|
|
|
|
|
|
and live-change revision/digests. Existing disclosure consent cannot approve
|
|
|
|
|
|
repository-wide credential grant. Requires T02.
|
|
|
|
|
|
|
|
|
|
|
|
## Verify the authorized owner build and routing handoff
|
|
|
|
|
|
|
|
|
|
|
|
```task
|
|
|
|
|
|
id: MASON-WP-0013-T04
|
|
|
|
|
|
status: wait
|
|
|
|
|
|
priority: high
|
2026-10-18 11:24:59 +02:00
|
|
|
|
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
|
2026-10-15 01:39:47 +02:00
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
After T03, founder/platform privileged path executes, ops-mason observes only
|
|
|
|
|
|
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
|
|
|
|
|
|
native seven-index positive and least-privilege negative checks, propose draft
|
|
|
|
|
|
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
|
|
|
|
|
|
success before actual receipt or finish while unresolved lifecycle work is only
|
|
|
|
|
|
in prose.
|
