ops-mason/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md

---
id: MASON-WP-0013
type: workplan
title: "Construct the seven-repository reuse-surface source reader"
domain: infotech
repo: ops-mason
status: finished
owner: codex
topic_slug: netkingdom-security-architecture
created: "2026-10-15"
updated: "2026-10-22"
flavor: implementation
depends_on: []
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
---

# Seven-repository hosted reader

Demand: CUST-WP-0081. Metadata disclosure consent is a separate record.
ops-mason surveyed metadata and recorded the platform CCR, founder
decision, and the reader-scope journal. It did not mint or apply the lane.

## Prepare the construction bundle

```task
id: MASON-WP-0013-T01
status: done
priority: high
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
```

Prepared `plans/reuse-surface-private-source-reader.md` and
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
ESO policy, data item, canonical candidate specification digest and SEC-DSM
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
with R1 evidence preserved. Plan remains draft because required live survey
and independent mechanism/owner reviews are missing.

Appended 2026-10-22: the live survey is on T02. After that survey the plan
status is `reviewed`.

## Complete scoped survey and construction review

```task
id: MASON-WP-0013-T02
status: done
priority: high
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
```

Requires legitimate own metadata-only survey grant or sanitized platform-owned
survey. Confirm current exact path/policy/role and matching-existing identity
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
Do not use operator tokens or another agent supervision record.

Done 2026-10-21T22:15:21Z. `scripts/plan-survey.py` ran under grant
`token-claude-MASON-WP-0014-T04` (policies `default`, `ops-mason-survey`).
That was the one minted survey grant. It is not an operator or admin token.

Plan §2 records the exact path
`platform/workloads/reuse/reuse-surface/forgejo-source-read`
(`current_version=1`), policy `workload-kv-read-reuse-surface-runtime-eso`
(`read` on that data path), and Kubernetes role `reuse-surface-runtime-eso`
(SA `reuse-surface-eso`, namespace `reuse`, audience `openbao`). Decision:
the OpenBao delivery lane already matches. The writer policy does not cover
the path. Forgejo-owner Q1–Q3 are cited from `forge-owner-review-r2.json`.
The plan is `reviewed`, not approved by ops-mason.

## Bind owner CCR and executable inputs to founder decision

```task
id: MASON-WP-0013-T03
status: done
depends_on: [MASON-WP-0013-T02]
priority: high
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
```

Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
and rollback artifacts including full fixed image, runtime-controlled allowlist
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
warden owns pointer review. Obtain separate founder decision on exact credential
and live-change revision/digests. Existing disclosure consent cannot approve
repository-wide credential grant. Requires T02.

Done as a record of the already-resolved binding. ops-mason did not approve,
mint, or apply.

- Platform CCR-2026-0046. The executed CCR digest cited by platform evidence
  is `23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02`.
- Founder decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e`. Hub read:
  status `resolved`, decision_type `made`, decided_by `Bernd Worsch`,
  decided_at `2026-10-15T00:07:05.087085Z`. It binds execution revision
  SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`.
  The hub description says the existing metadata approval is separate.
- Disclosure-consent digest
  `4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
  different record.

## Verify the authorized owner build and routing handoff

```task
id: MASON-WP-0013-T04
status: done
depends_on: [MASON-WP-0013-T03]
priority: high
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
```

After T03, founder/platform privileged path executes, ops-mason observes only
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
native seven-index positive and least-privilege negative checks, propose draft
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
success before actual receipt or finish while unresolved lifecycle work is only
in prose.

Done as a citation of the platform journal and the custodian receipts.
ops-mason did not log in as the workload and did not mint or apply.

- 2026-10-22: reader least-privilege denial is the-custodian
  `docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl`,
  attempt `bb2693a7640f00b4e401467e`, event `verified`, operation
  `reader_scope`, status `seven_exact_no_extra_private_grants`, at
  `2026-10-15T03:06:09.151956+00:00`. The journal has no secret fields.
  `scripts/provision-reuse-surface-forgejo-source.py` writes that status
  only after the reader token is refused on private `coulomb/rapp-core-hub`,
  on `/admin/users`, and on each of the seven `/actions/secrets` routes
  (expected 403 or 404), and after each of the seven permissions is
  admin false, push false, pull true. The journal does not store those
  HTTP codes itself. Platform reply b6d82e8c is the MAS confirm-binding
  note and is not this receipt.

- Metadata, 2026-10-21T22:15:21Z, grant `token-claude-MASON-WP-0014-T04`:
  path version 1, ESO policy read, role bound as in T02. Survey-token
  capabilities: `deny` on the reader data path and on
  `platform/data/workloads/reuse/reuse-surface/runtime-secrets`; `list, read`
  on the reader metadata path. Writer policy
  `workload-kv-read-reuse-surface-runtime` has no stanza for the reader path.
  Those are the observer and writer-policy negatives. The reader denial is the journal above.
- Seven native indexes: custodian
  `docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json`,
  id `CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1`, `all_verified` true, seven
  repositories, `checked_at` 2026-10-15T03:30:20.627885Z. No source body is
  copied here.
- Seventy reviewed ids: custodian
  `docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json`,
  `reviewed_present` 70, `all_reviewed_hosted_exactly_once` true,
  `composed_at` 2026-10-15T03:31:48Z. That file is the CUST-WP-0081
  evidence. This task cites it and does not copy the seventy ids.
- Outcome receipt: railiance-platform
  `docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json`,
  bootstrap attempt `bb2693a7640f00b4e401467e`. The preserved rollback
  contract is the-custodian
  `docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json`
  field `rollback`. Rollback was not run. The live rotation and revocation
  record remains `RPF-WP-0058-T05`.
- Draft catalog route, not activated:
  `builds/reuse-surface-private-source-reader/catalog-proposal.yaml`.
  It is not in the ops-warden catalog.