feat(mason): approve the forge read lane and draft its catalog entry

Plan approved 2026-08-26, breadth organisation-wide repository read. The
§4 contingency was satisfied first: STATE-WP-0084-T01 landed the same
day, so a missing grant now surfaces as a named unreadable condition
rather than as silence — which is what the breadth argument rested on.

T01 done. T03 drafted in ops-warden on a branch (entry + playbook +
regenerated high-risk artifact). T02 needs an operator: no valid OpenBao
session here, and the token is the forge owner's to mint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166

plans/state-hub-forge-derivation-read.md

@@ -3,7 +3,10 @@ id: state-hub-forge-derivation-read
 demand_source: ops-mason/workplans/MASON-WP-0003
 consumer_repo: state-hub
 credential_type: openbao-approle-kv
-status: draft
+status: approved
+approved_by: "Bernd Worsch"
+approved_at: "2026-08-26"
+breadth: organisation-wide-read
 created: "2026-08-26"
 updated: "2026-08-26"
 ---
@@ -172,3 +175,36 @@ repository for retirement, the near-miss that `vergabe-teilnahme` produced.
 2. Breadth: organisation-wide read, or per-repository read.
 3. Rotation: accept build-phase posture (no scheduled `secret_id` expiry), or
    require rotation now.
+
+## 6. Decision (phase 3 outcome)
+
+**Approved 2026-08-26 by Bernd Worsch. Breadth: organisation-wide repository
+read.**
+
+The reasoning, recorded because a bare value would not survive the next person
+asking why:
+
+- **Approved as proposed.** No change to the path, policy, or AppRole shape in
+  §3, and no change to the rejection of `forgejo-admin-api-token` reuse in §2.
+- **Organisation-wide read over per-repository.** The recurring maintenance
+  cost of the narrow option is real and lands on whoever adds a private
+  repository months from now, who has no reason to know this lane exists. The
+  accepted price is the wider leak radius: a leaked token reads every private
+  repository in the organisation — read only, no write, no administration, no
+  persistence.
+- **The contingency in §4 is satisfied.** The recommendation was conditional on
+  `STATE-WP-0084-T01` landing first, so a missing grant would surface as a
+  named condition rather than as silence. It landed on 2026-08-26 (state-hub
+  `85181cd`): an unreadable repository now reports as unreadable, and a source
+  that produced no records cannot retire anything even when retirement is
+  acknowledged.
+- **Rotation: not separately decided; build-phase posture stands** as proposed
+  — no scheduled `secret_id` expiry, matching the existing workload AppRoles.
+  This is the §5 default rather than an explicit ruling, and it is the thing to
+  revisit first when posture changes.
+
+**What approval authorises.** Phase 4 for `MASON-WP-0003-T02` and `T03` only:
+the OpenBao policy, the AppRole, the KV path structure, and the pointer-only
+ops-warden catalog entry. It does not authorise ops-mason to mint or handle the
+token value — the forge owner mints it with organisation-wide repository read
+and no other scope, and `paste_once_provision` delivers it.

workplans/MASON-WP-0003-state-hub-forge-read-lane.md

@@ -78,7 +78,7 @@ or without this credential.
 
 ```task
 id: MASON-WP-0003-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "36d26000-ae71-5a58-a563-a07ff5be664f"
 ```
@@ -106,11 +106,20 @@ Acceptance: the plan reaches `status: reviewed`, the founder decision is
 recorded with its reasoning rather than as a bare value, and the plan carries
 `approved_by`/`approved_at`.
 
+**Done (2026-08-26).** Approved by Bernd Worsch, breadth **organisation-wide
+repository read**. The §4 contingency was satisfied first: `STATE-WP-0084-T01`
+landed 2026-08-26, so a repository central may not read now reports as
+unreadable and a source that produced no records cannot retire anything even
+when retirement is acknowledged — which is what makes a missing grant visible
+and, in turn, what the breadth argument rested on. Rotation was not separately
+ruled on; build-phase posture stands as proposed. Reasoning in
+`plans/state-hub-forge-derivation-read.md` §6.
+
 ## Build the AppRole, policy, and KV path structure
 
 ```task
 id: MASON-WP-0003-T02
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "68a1c8e4-c12b-550e-962c-06a90ab8c1c2"
 ```
@@ -135,7 +144,7 @@ approved plan.
 
 ```task
 id: MASON-WP-0003-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "e14f0eb3-a920-5623-b4c1-c20858dbb45d"
 ```
@@ -152,6 +161,21 @@ contribution to `ops-warden`, not a live API call.
 Acceptance: `warden route find` returns the lane; `warden route show` gives an
 operator enough to act without reading this workplan.
 
+**Drafted 2026-08-26**, awaiting contribution to `ops-warden` (branch
+`mason/state-hub-forge-derivation-read`, commit `3a4333d`). Entry
+`state-hub-forge-derivation-read`: pointer-only, `warden_executes: false`,
+`status: draft`, `risk: high` — graded on breadth rather than write authority,
+since the token is read-only but organisation-wide. Playbook at
+`wiki/playbooks/state-hub-forge-derivation-read.md`, whose verification section
+leads with the *negative* check: the AppRole must be denied on
+`platform/workloads/forgejo/forgejo-admin`, because not being able to do what
+the admin lane can is the entire argument for building this one.
+
+`registry/generated/high-risk-data-paths.yaml` regenerated (21 → 24 lanes); it
+had been stale since 2026-08-23, so the regeneration also picks up two
+unrelated lanes. Promote the entry to `active` once T02 has built the structure
+and the negative check passes.
+
 ## Handoff
 
 Once T02 and T03 are done, notify `state-hub` so `STATE-WP-0084-T02` can