MASON-WP-0013-T04: cite the reader-scope denial journal

cust81-forge-reader-r1.jsonl records reader_scope seven_exact_no_extra_private_grants for attempt bb2693a7640f00b4e401467e. That status is written only after the excluded private repo, admin route, and Actions routes are refused. The workplan is finished. The plan stays reviewed.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a

WORK-RECORDS.md

@@ -22,7 +22,7 @@
 | workplan | MASON-WP-0010 | blocked | — | workplans/MASON-WP-0010-security-case-materialization.md |
 | workplan | MASON-WP-0011 | finished | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
 | workplan | MASON-WP-0012 | finished | — | workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md |
-| workplan | MASON-WP-0013 | active | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
+| workplan | MASON-WP-0013 | finished | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | workplan | MASON-WP-0014 | finished | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | workplan | MASON-WP-0015 | active | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
@@ -90,7 +90,7 @@
 | task | MASON-WP-0013-T01 | done | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | task | MASON-WP-0013-T02 | done | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | task | MASON-WP-0013-T03 | done | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
-| task | MASON-WP-0013-T04 | wait | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
+| task | MASON-WP-0013-T04 | done | — | workplans/MASON-WP-0013-reuse-surface-private-source-reader.md |
 | task | MASON-WP-0014-T01 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | task | MASON-WP-0014-T02 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |
 | task | MASON-WP-0014-T03 | done | — | workplans/MASON-WP-0014-mas-tem-relay-smtp.md |

plans/reuse-surface-private-source-reader.md

@@ -424,10 +424,9 @@ different record. This file stays `reviewed`. ops-mason does not set it
 ## 6. Proposed verification and rollback contract
 
 The contract below is the acceptance rule. The platform path already ran.
-ops-mason's 2026-10-21 metadata receipt and the cited seven-index and 70-id
-receipts are on MASON-WP-0013-T04. That task stays `wait`: no cited receipt
-records the reader least-privilege denial. The draft catalog proposal is not
-activated. No secret value is in those records.
+ops-mason's 2026-10-21 metadata receipt, the seven-index receipt, the 70-id
+receipt, and the reader-scope journal are on MASON-WP-0013-T04. The draft
+catalog proposal is not activated. No secret value is in those records.
 
 Before changes: exact CCR/plan/script/manifest digests, owner reviews and founder
 approved revision must match; metadata survey proves current path/policy/role;

tests/test_wp_0013_0014_evidence.py

@@ -122,14 +122,15 @@ def test_private_reader_survey_records_lane_without_approving_apply():
     proposal = (
         ROOT / "builds" / "reuse-surface-private-source-reader" / "catalog-proposal.yaml"
     ).read_text()
-    assert _frontmatter(workplan)["status"] == "active"
+    assert _frontmatter(workplan)["status"] == "finished"
     assert _frontmatter(plan)["status"] == "reviewed"
     assert _frontmatter(plan)["approved_by"] is None
     assert _task_status(workplan, "MASON-WP-0013-T02") == "done"
     assert _task_status(workplan, "MASON-WP-0013-T03") == "done"
-    assert _task_status(workplan, "MASON-WP-0013-T04") == "wait"
-    assert "blocked_on: message-from:railiance-platform" in workplan
-    assert "reader least-privilege denial" in workplan
+    assert _task_status(workplan, "MASON-WP-0013-T04") == "done"
+    assert "cust81-forge-reader-r1.jsonl" in workplan
+    assert "seven_exact_no_extra_private_grants" in workplan
+    assert "coulomb/rapp-core-hub" in workplan
     flat_plan = _flat(plan)
     flat_workplan = _flat(workplan)
     assert "token-claude-MASON-WP-0014-T04" in flat_plan

workplans/MASON-WP-0013-reuse-surface-private-source-reader.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Construct the seven-repository reuse-surface source reader"
 domain: infotech
 repo: ops-mason
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom-security-architecture
 created: "2026-10-15"
@@ -17,9 +17,8 @@ state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
 # Seven-repository hosted reader
 
 Demand: CUST-WP-0081. Metadata disclosure consent is a separate record.
-ops-mason surveyed metadata and recorded the platform CCR and founder
-decision. It did not mint or apply the lane. T04 stays `wait` until a cited
-receipt records the reader least-privilege denial.
+ops-mason surveyed metadata and recorded the platform CCR, founder
+decision, and the reader-scope journal. It did not mint or apply the lane.
 
 ## Prepare the construction bundle
 
@@ -102,8 +101,8 @@ mint, or apply.
 
 ```task
 id: MASON-WP-0013-T04
-status: wait
-blocked_on: message-from:railiance-platform
+status: done
+depends_on: [MASON-WP-0013-T03]
 priority: high
 state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
 ```
@@ -115,11 +114,21 @@ catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
 success before actual receipt or finish while unresolved lifecycle work is only
 in prose.
 
-Waiting on railiance-platform for a receipt that records the reader
-least-privilege denial. The items below are cited. They do not include that
-denial result. ops-mason did not log in as the workload and did not mint or apply.
+Done as a citation of the platform journal and the custodian receipts.
+ops-mason did not log in as the workload and did not mint or apply.
 
-- 2026-10-22: platform reply b6d82e8c is the MAS confirm-binding note. It is not the reader denial receipt.
+- 2026-10-22: reader least-privilege denial is the-custodian
+  `docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl`,
+  attempt `bb2693a7640f00b4e401467e`, event `verified`, operation
+  `reader_scope`, status `seven_exact_no_extra_private_grants`, at
+  `2026-10-15T03:06:09.151956+00:00`. The journal has no secret fields.
+  `scripts/provision-reuse-surface-forgejo-source.py` writes that status
+  only after the reader token is refused on private `coulomb/rapp-core-hub`,
+  on `/admin/users`, and on each of the seven `/actions/secrets` routes
+  (expected 403 or 404), and after each of the seven permissions is
+  admin false, push false, pull true. The journal does not store those
+  HTTP codes itself. Platform reply b6d82e8c is the MAS confirm-binding
+  note and is not this receipt.
 
 - Metadata, 2026-10-21T22:15:21Z, grant `token-claude-MASON-WP-0014-T04`:
   path version 1, ESO policy read, role bound as in T02. Survey-token
@@ -127,7 +136,7 @@ denial result. ops-mason did not log in as the workload and did not mint or appl
   `platform/data/workloads/reuse/reuse-surface/runtime-secrets`; `list, read`
   on the reader metadata path. Writer policy
   `workload-kv-read-reuse-surface-runtime` has no stanza for the reader path.
-  Those are observer and writer-policy negatives, not the reader denial.
+  Those are the observer and writer-policy negatives. The reader denial is the journal above.
 - Seven native indexes: custodian
   `docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json`,
   id `CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1`, `all_verified` true, seven