coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0013-T04: cite the reader-scope denial journal

Browse source 
cust81-forge-reader-r1.jsonl records reader_scope seven_exact_no_extra_private_grants for attempt bb2693a7640f00b4e401467e. That status is written only after the excluded private repo, admin route, and Actions routes are refused. The workplan is finished. The plan stays reviewed.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 00:35:58 +02:00
parent a35d388c63
commit 7af68f2af4
4 changed files with 30 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Construct the seven-repository reuse-surface source reader"
domain: infotech
repo: ops-mason
status: active
status: finished
owner: codex
topic_slug: netkingdom-security-architecture
created: "2026-10-15"
@ -17,9 +17,8 @@ state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
# Seven-repository hosted reader
Demand: CUST-WP-0081. Metadata disclosure consent is a separate record.
ops-mason surveyed metadata and recorded the platform CCR and founder
decision. It did not mint or apply the lane. T04 stays `wait` until a cited
receipt records the reader least-privilege denial.
ops-mason surveyed metadata and recorded the platform CCR, founder
decision, and the reader-scope journal. It did not mint or apply the lane.
## Prepare the construction bundle
@ -102,8 +101,8 @@ mint, or apply.
```task
id: MASON-WP-0013-T04
status: wait
blocked_on: message-from:railiance-platform
status: done
depends_on: [MASON-WP-0013-T03]
priority: high
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
```
@ -115,11 +114,21 @@ catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
success before actual receipt or finish while unresolved lifecycle work is only
in prose.
Waiting on railiance-platform for a receipt that records the reader
least-privilege denial. The items below are cited. They do not include that
denial result. ops-mason did not log in as the workload and did not mint or apply.
Done as a citation of the platform journal and the custodian receipts.
ops-mason did not log in as the workload and did not mint or apply.
- 2026-10-22: platform reply b6d82e8c is the MAS confirm-binding note. It is not the reader denial receipt.
- 2026-10-22: reader least-privilege denial is the-custodian
`docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl`,
attempt `bb2693a7640f00b4e401467e`, event `verified`, operation
`reader_scope`, status `seven_exact_no_extra_private_grants`, at
`2026-10-15T03:06:09.151956+00:00`. The journal has no secret fields.
`scripts/provision-reuse-surface-forgejo-source.py` writes that status
only after the reader token is refused on private `coulomb/rapp-core-hub`,
on `/admin/users`, and on each of the seven `/actions/secrets` routes
(expected 403 or 404), and after each of the seven permissions is
admin false, push false, pull true. The journal does not store those
HTTP codes itself. Platform reply b6d82e8c is the MAS confirm-binding
note and is not this receipt.
- Metadata, 2026-10-21T22:15:21Z, grant `token-claude-MASON-WP-0014-T04`:
path version 1, ESO policy read, role bound as in T02. Survey-token
@ -127,7 +136,7 @@ denial result. ops-mason did not log in as the workload and did not mint or appl
`platform/data/workloads/reuse/reuse-surface/runtime-secrets`; `list, read`
on the reader metadata path. Writer policy
`workload-kv-read-reuse-surface-runtime` has no stanza for the reader path.
Those are observer and writer-policy negatives, not the reader denial.
Those are the observer and writer-policy negatives. The reader denial is the journal above.
- Seven native indexes: custodian
`docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json`,
id `CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1`, `all_verified` true, seven