coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare seven-repository reuse-surface reader construction revision 2

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
tegwick 2026-10-15 01:39:47 +02:00
parent 92907919cd
commit b67b57a022
7 changed files with 739 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
builds/reuse-surface-private-source-reader/auth-source-allowlist.json Normal file
View file

@ -0,0 +1 @@
{"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN":["https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738","https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738"]}

1
builds/reuse-surface-private-source-reader/candidate-spec.sha256 Normal file
View file

@ -0,0 +1 @@
59a7334eb58135790547fab0a8c8e8debb94cc7acaae88d30654c9ae887d6732 canonical-sorted-compact-json(construction-inputs.json)

278
builds/reuse-surface-private-source-reader/construction-inputs.json Normal file
View file

@ -0,0 +1,278 @@
{
"id": "MASON-CUST81-PRIVATE-READER-R1",
"revision": 2,
"status": "draft-not-executable",
"engine": "platform-owned-forgejo-restricted-reader-and-existing-eso-delta",
"execution_support": "requires platform reviewed adapter; not an ops_mason.executor supported build_spec",
"preparation_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
"metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
"disclosure_packet_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
"identity": {
"forgejo_user": "reuse-surface-source",
"forgejo_org": "coulomb",
"forgejo_team": "reuse-surface-source-readers",
"restricted": true,
"is_admin": false,
"visibility": "private",
"password": "random value retained only in attended process memory; never stored in evidence",
"team_permission": "read",
"includes_all_repositories": false,
"can_create_org_repo": false,
"units_map": {
"repo.code": "read",
"repo.actions": "none",
"repo.packages": "none",
"repo.issues": "none",
"repo.ext_issues": "none",
"repo.wiki": "none",
"repo.pulls": "none",
"repo.releases": "none",
"repo.projects": "none",
"repo.ext_wiki": "none"
},
"team_repositories": [
"coulomb/rapp-openbao",
"coulomb/rapp-policy-nexus",
"coulomb/rapp-postgres",
"coulomb/rapp-sbom-nexus",
"coulomb/rapp-telemetry",
"coulomb/rapp-tenant-engine",
"coulomb/rapp-user-engine"
],
"token_scopes": [
"read:repository"
],
"token_name_prefix": "reuse-surface-source-read-",
"reuse_other_workload_token": false,
"fail_on_differing_existing_identity_or_team": true,
"enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
},
"delivery": {
"kv_mount": "platform",
"kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
"field": "FORGEJO_SOURCE_TOKEN",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"eso_role": "reuse-surface-runtime-eso",
"eso_identity": "reuse/reuse-surface-eso",
"audience": "openbao",
"ttl": "15m",
"cluster_secret_store": "openbao-reuse",
"store_namespace_condition": [
"reuse"
],
"external_secret": "reuse/reuse-surface-runtime",
"target_secret": "reuse/reuse-surface-env",
"existing_consumption": "Existing envFrom interface is reusable only after approved full fixed image plus runtime-owned exact14 URL/auth-env allowlist is active. Existing authenticated sources need separately reviewed safe inventory and migration before fail-closed rollout.",
"policy_delta": {
"file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
"add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
"retain_existing_paths": true,
"do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
},
"external_secret_data_delta": {
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"remoteRef": {
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
"property": "FORGEJO_SOURCE_TOKEN"
}
},
"delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
"native_source_auth": {
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"auth_header": "Authorization",
"header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
},
"fixed_image_gate": {
"status": "pending owner patch and reviewed image",
"reason": "Current native fetch permits registration-selected auth_env plus arbitrary URL and forwards Authorization on redirect. Both must be fixed before credential delivery.",
"required": [
"reuse owner full redirect and auth_env/URL patch and meaningful boundary tests",
"exact full source/patch digest",
"approved image digest built from fixed source",
"runtime controlled exact14 auth allowlist config digest",
"safe owner inventory and reviewed migration of existing authenticated sources",
"runtime proof denied URLs are checked before credential lookup and authenticated redirects never forward credential",
"apps reviewed rollout and rollback with image/config changes explicit"
],
"current_image_accepts_new_pat": false,
"reviewed_candidate_inputs": {
"consumer_owner_allowlist_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json",
"consumer_owner_allowlist_sha256": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
"consumer_patch_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/reuse-owner-preparation-r1.patch",
"consumer_patch_sha256": "f707ddfd36d5d470c176530671bb30ff6a3af2dfff86937aa8a5618bcb79768e",
"fixed_federation_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
"allowlist_semantic_crosscheck": "pass exact same env and exact14 URL sets; serialization ordering differs",
"image_digest": null,
"owner_review_status": "baseline changes_requested; full candidate must integrate and obtain runtime proof",
"test_report": "owner reports focused30pass; whole226pass1isolatedrelativepath failure; no live runtime proof",
"native_verification_helper_sha256": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
"native_verification_helper_artifact": "/tmp/cust81-reuse-reader-owner/reuse_surface/private_source_verify.py"
}
},
"runtime_auth_source_allowlist": {
"env": "REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST",
"candidate_value": "{\"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\":[\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\",\"https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738\"]}",
"candidate_artifact": "builds/reuse-surface-private-source-reader/auth-source-allowlist.json",
"artifact_sha256": "9a5d5a1ffb6ff1fa9e0cba7fb77779fd832c5bff413718d63c6f6e314ac653fc",
"semantic_value_sha256": "30c823e0ccd4cd5bcccacfa731bcf0674b63ba6d5ec79f2c012ec650201f81f5",
"policy": "Only runtime owner may configure; untrusted registration cannot grant itself authorization. Exact equality checked before any credential env lookup. Exact14 pinned index and entry API URLs only.",
"existing_authenticated_sources": "Owner must safely inventory all authenticated sources using sanitized auth_env/URL metadata and migrate valid existing mappings before fail-closed rollout; do not expose secrets or blindly authorize inventory."
}
},
"sources": [
{
"repo": "rapp-openbao",
"capability_ids": [
"capability.railiance.openbao-package"
],
"consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
"index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-policy-nexus",
"capability_ids": [
"capability.railiance.policy-publication-package"
],
"consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-postgres",
"capability_ids": [
"capability.railiance.postgres-isolation-recovery"
],
"consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-sbom-nexus",
"capability_ids": [
"capability.railiance.sbom-runtime-package"
],
"consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
"index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-telemetry",
"capability_ids": [
"capability.railiance.telemetry-package"
],
"consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-tenant-engine",
"capability_ids": [
"capability.railiance.tenant-engine-package"
],
"consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
"index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
},
{
"repo": "rapp-user-engine",
"capability_ids": [
"capability.railiance.user-engine-package"
],
"consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
"index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
"auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
}
],
"policy_before_sha256": "fab29572fe82fc6674837e430f616409070f97a3867a411b7e21b5141dfaba20",
"policy_candidate_sha256": "788bb9c49ab571e522beeecf7a5e29d1c79c842a84fe6d801978655facd3b5bd",
"caller_writer_policy_sha256": "53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257",
"lifecycle": {
"owner": "railiance-platform",
"target_owner": "railiance-forge",
"consumer": "reuse-surface hosted process only",
"rotation_days": 90,
"expiry": "No PAT native expiry demonstrated; 90-day attended rotation is proposed owner policy, not implemented expiry enforcement.",
"automatic_rotation": false,
"revoke_on": [
"compromise",
"scope drift",
"owner or consumer change",
"90-day rotation after replacement verifies"
],
"replacement_overlap_max_hours": 24,
"outage": "Private refresh fails closed; prior consented cache visibly stale, public sources continue. Never substitute admin/personal/core-hub PAT."
},
"approval": {
"supervisor": "Bernd Worsch, GOVERN @ estate",
"approved_by": null,
"approved_at": null,
"approved_digest": null,
"metadata_disclosure_is_not_credential_approval": true
},
"pre_execution_gates": [
"own scoped metadata survey or platform sanitized equivalent",
"Forgejo owner Q1-Q3 mechanism confirmation",
"platform CCR allocation and reviewed silent provisioner",
"effective exact-seven authorization proof design",
"own owner reviews including reuse native fetch and apps rollout",
"founder exact revision approval",
"headroom/PVC/rollout preflight",
"reuse owner redirect patch reviewed and fixed image approved",
"verify fixed image before projecting reader PAT into hub process",
"full consumer source-authorization patch reviewed, not redirect-only",
"runtime owner exact14 allowlist and existing auth-source migration reviewed"
],
"verification": {
"pre_apply": [
"Pin exact CCR and plan revision/digest, owner reviews, founder disposition and rollout artifacts. Resolve existing identity/team/path conflicts before any mutation.",
"Confirm live namespace/Deployment and its image digest, current ESO identity/binding and secret field presence through safe suppressing helper; no Secret dump.",
"Check CPU headroom and rollout strategy/PVC constraints; retain exact prior source manifest/image and server dry-run/client diff.",
"Current native fetch redirect forwarding hazard must be fixed in the reviewed image before PAT delivery to the hub. An unchanged vulnerable image is not acceptable.",
"Full consumer patch must reject registration-controlled auth_env/URL destinations before credential lookup; configure owner-reviewed allowlist and migrate existing authenticated sources before rollout."
],
"positive": [
"PAT metadata scope exactly read:repository; exact seven team repos with no other private grants.",
"Actual native fetch_remote_index_text from hub process with the approved auth_env fetches all seven pinned raw index URLs; validate schema, one expected capability each and exact index SHA256. No token or fetched private source output.",
"ESO Ready and materialized key present checked without values; Deployment Ready on reviewed fixed-image digest after controlled rollout; redirect credential isolation verified.",
"Register private sources only after credential and native fetch receipts; fresh hosted federation then proves all70 reviewed IDs exactly once and matching metadata."
],
"negative": [
"Reader cannot fetch a known private repository outside the seven (preselected by platform using metadata, no unauthorized body retention).",
"Forgejo writes, admin/user operations and non-code unit access denied; probe design must avoid creating writes if an unexpected permission exists.",
"Default identity and scoped writer OIDC caller cannot read new KV path; ESO role cannot read any other sibling path, and wrong SA/namespace/audience cannot authenticate.",
"Native missing-auth and anonymous private-index fetch fail closed; no fallback to admin/personal/core-hub credentials.",
"Registration-selected auth_env or unlisted same-host/other-host/unpinned/wrong-query URL is refused before credential lookup; token value is never read or transmitted.",
"Authenticated redirects fail closed without forwarding Authorization, including same-origin path changes. Runtime allowlist contains exact14 consented pinned URL strings only for new readerenv."
],
"receipts": "Sanitized IDs, repo names, scopes, hashes, status booleans and timestamps only; no credentials, raw errors, private index bodies or Secret objects."
},
"rollback": {
"immediate": "Revoke this dedicated PAT and remove exact new team/user grants. Disable only private registrations created by the associated attempt after reconciling ambiguous requests; preserve all public registrations.",
"delivery": "Remove only new ES data item and exact new ESO policy stanza, restore prior source revision through owner path, delete only new materialized token key if needed using suppressed owner helper, then roll the reviewed fixed image or restore a prior image only after credential removal is verified. Do not delete reuse-surface-env or rotate existing writer/webhook fields. Remove only the new reader environment mapping from runtime source allowlist while preserving separately reviewed existing mappings; coordinate image/config rollback so stale deployments never receive the PAT.",
"preserve_evidence": "Retain failed/partial outcomes, reconcile any ambiguous identity or token creation; never blindly remint after an observation timeout."
},
"cost_estimate_eur": 0,
"cost_assumptions": "Incremental cloud infrastructure only; existing service/resources. Build and rollout of reviewed fixed image is required. Human labor/compute changes not priced; re-estimate if owner rollout changes resources.",
"credible_loss_estimate_eur": null,
"risk_unpriced_reason": "Repository-wide private source exposure and availability impact cannot be bounded from local evidence; supervised execution required.",
"revision_history": [
{
"revision": 1,
"spec_sha256": "0d1f604c76e086c82675dc535004cf4da51ef5dc247959fab50295a673407980",
"status": "draft-unapproved-never-executed",
"ref": "custodian owner-assembly/mason-r1/"
},
{
"revision": 2,
"reason": "Same proposal refined after consumer owner found URL/auth_env credential exfiltration in addition to redirect forwarding."
}
]
}

7
builds/reuse-surface-private-source-reader/externalsecret-data-item.json Normal file
View file

@ -0,0 +1,7 @@
{
"secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
"remoteRef": {
"key": "workloads/reuse/reuse-surface/forgejo-source-read",
"property": "FORGEJO_SOURCE_TOKEN"
}
}

15
builds/reuse-surface-private-source-reader/workload-kv-read-reuse-surface-runtime-eso.hcl Normal file
View file

@ -0,0 +1,15 @@
path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
capabilities = ["read"]
}
path "auth/token/lookup-self" {
capabilities = ["read"]
}
path "auth/token/revoke-self" {
capabilities = ["update"]
}
path "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" {
capabilities = ["read"]
}

357
plans/reuse-surface-private-source-reader.md Normal file
View file

@ -0,0 +1,357 @@
---
id: reuse-surface-private-source-reader
revision: 2
proposal_id: MASON-CUST81-PRIVATE-READER-R1
demand_source: the-custodian/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
consumer_repo: reuse-surface
credential_type: forgejo-restricted-source-read-with-existing-kubernetes-eso
status: draft
approved_by: null
approved_at: null
created: "2026-10-15"
updated: "2026-10-15"
construction_inputs: builds/reuse-surface-private-source-reader/construction-inputs.json
candidate_spec_sha256: 59a7334eb58135790547fab0a8c8e8debb94cc7acaae88d30654c9ae887d6732
approved_spec_sha256: null
filed_as: null
---
# Construction plan: seven-repository hosted capability reader
## 1. Demand
The reuse-surface hub has established 63 of the 70 reviewed security capabilities.
It needs authenticated reads of the seven remaining private repository indexes.
The founder explicitly approved only public disclosure of the exact capability
metadata in CUST81-PRIVATE-METADATA-DISCLOSURE-R1; repository source remains
private. This plan proposes a dedicated repository reader for the hosted process
and delivery through its existing namespace-bound ESO identity. Credential access
and live changes require their own reviewed exact-revision approval.
Preparation source is CUST81-PRIVATE-READER-PROVISIONING-PREPARATION-R1, SHA256
`7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99`.
Consent receipt SHA256 is
`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52`;
disclosure packet SHA256 is
`46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35`.
The bundled construction-inputs retain all seven consented commits, index hashes
and native raw API URLs. These references contain no credential values.
The delegated ops-mason preparation worker has no own supervision record or
survey token. It is supervised for preparation only and borrows no custodian
agent authority. No live OpenBao, Forgejo, Kubernetes or credential read was
performed. This plan is deliberately **draft**, not reviewed or executable.
## 2. Existing-structure survey
### Local evidence; live survey incomplete
A live `scripts/plan-survey.py` result does not exist: no scoped ops-mason-survey
grant was supplied. Do not treat source files as installed state. Before review,
obtain an owner-scoped metadata survey with exact path/policy and Kubernetes-role
arguments, or a platform-owned sanitized equivalent. Refused queries stay
incomplete rather than being described as absence. No operator/admin session may
be substituted for the ops-mason survey grant.
Local source observations from the pinned preparation and checked files:
- `railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl`
SHA256 `fab29572fe82fc6674837e430f616409070f97a3867a411b7e21b5141dfaba20`
grants the existing runtime-secrets data path and lookup/revoke-self endpoints.
- The caller policy `workload-kv-read-reuse-surface-runtime`, SHA256
`53dd5eecc94fd8d7fc281a858f5d9fc27c8c895fd79161fd113cd3a1387a1257`,
grants the existing runtime-secrets entry plus self-lifecycle/capability checks;
it does not grant the proposed new source-reader path.
- ClusterSecretStore `openbao-reuse` uses Kubernetes role
`reuse-surface-runtime-eso`, SA `reuse/reuse-surface-eso`, audience `openbao`,
conditions limited to namespace `reuse`. No new static ESO token is proposed.
- `railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml` already maps
writer/webhook fields to `reuse/reuse-surface-env`; Deployment uses envFrom.
Its comments still describe a retired static ESO token; those comments must not
be taken as a procedure or used to mint one. Apps owns correction on integration.
- CCR-2026-0031 and `provision-core-hub-forgejo-source.py` demonstrate dedicated
`read:repository` PAT custody. That script explicitly sets all-repository team
membership and must **not** be executed unchanged for this demand.
- Catalog `reuse-surface-hub-write-token` describes the caller writer lane;
`forgejo-admin-api-token` is privileged bootstrap authority. Neither is the
private-index consumer credential. The preparation found no dedicated private
reader lane; installed absence has not been surveyed.
**Does an existing lane satisfy this demand?** Existing workload identity and
ESO delivery can be reused. Existing writer credentials and all-repository
source readers cannot satisfy the exact-seven grant. Propose a dedicated target
identity and new exact KV entry, with one stanza added to the existing ESO policy.
A differing existing user/team/path/policy must halt for reconciliation before
any mutation. Matching names alone do not establish matching effective scope.
## 3. Proposed changes
### SEC-DSM §37 decision procedure, in order
1. **Q1 — native identity:** the current native raw HTTP fetch uses an
Authorization credential; Kubernetes SA identity alone is not demonstrated
as accepted by this Forgejo route. Candidate answer: no for the current
consumer interface, subject to Forgejo/reuse owner confirmation. Anonymous
access would require private visibility change and does not satisfy demand.
2. **Q2 — federation:** human KeyCape OIDC login does not prove a machine-token
exchange for these raw API requests. No workload federation exchange for this
target is evidenced by the local source review. Candidate answer: no viable
installed interface demonstrated; Forgejo owner must confirm or supply a
higher mechanism. If supported reliably, revise to federation before approval.
3. **Q3 — ephemeral target credential:** the local CCR-0031 precedent states PATs
have no server-side expiry. No usable ephemeral Forgejo issuance/revocation
service is evidenced. Candidate answer: no mechanism demonstrated, pending
target-owner confirmation. Do not add a broker just to label a static PAT
dynamic (DSM-TRANS-003). ESO's 15-minute Bao token does not expire the PAT.
4. **Q4 — automatic rotation:** do not reuse an existing broader PAT. No automated
rotation job for this proposed dedicated identity is evidenced. Provisioning
capability is not automatic lifecycle enforcement. Answer: not demonstrated;
proposed attended rotation is explicitly manual, owned and dated.
5. **Q5 — residual static credential:** conditional on Q1–Q3 owner confirmation,
use a centrally governed dedicated PAT, OpenBao as custody authority, Forgejo
as grant/revocation authority, ESO/Kubernetes/env as delivery copies. Level 5
in §5, **centrally managed static secret**, not level 3 or 4. No AppRole is
needed: the existing ESO projected workload identity authenticates to Bao.
These answers follow DSM-ARCH-001–004, DSM-TRANS-002/003, DSM-K8S-001–004 and
§35/36: use existing projected SA identity for delivery, avoid adding a static
ESO token or broker, and distinguish central custody from delivery copies.
Unconfirmed Q1–Q3 are explicit review gates, not asserted facts.
### Exact object changes and boundaries
- **create** restricted private non-admin Forgejo user `reuse-surface-source`;
**create** org team `coulomb/reuse-surface-source-readers`. Dedicated target
identity replaces unsuitable broad readers identified in §2. Team permission
`read`, `includes_all_repositories=false`, `can_create_org_repo=false`, only
`repo.code=read`; all non-code units `none`. Team members exactly this user.
- **create** team membership for exactly `coulomb/rapp-openbao`,
`coulomb/rapp-policy-nexus`, `coulomb/rapp-postgres`, `coulomb/rapp-sbom-nexus`,
`coulomb/rapp-telemetry`, `coulomb/rapp-tenant-engine`, `coulomb/rapp-user-engine`.
Follow all API pages and inspect effective user grants, other teams, direct
collaborator access, organisation membership and repository ownership. Adding
seven repositories without checking extra effective grants is insufficient.
Existing identity/team with differing configuration is a conflict, not permission
to remove unrelated access silently. Reconciliation needs a revised plan.
- **create** dedicated PAT named `reuse-surface-source-read-<UTC-attempt>` with
scopes exactly `[read:repository]`. Platform-owned attended helper holds values
in memory, suppresses every raw response/error and returns token IDs only.
Password used for service bootstrap is random memory-only, never persisted
in evidence or reused as workload authentication. Prevent unattended password
login and recovery escalation according to Forgejo owner review.
- **create** KV-v2 entry `platform/workloads/reuse/reuse-surface/forgejo-source-read`,
field `FORGEJO_SOURCE_TOKEN`. Platform alone provisions value through its
reviewed silent custody route from stdin; ops-mason does not handle the value.
It must retain accessor/token ID and custody version in sanitized lifecycle
inventory. A new path separates private reader from attended writer callers.
- **modify** only existing policy `workload-kv-read-reuse-surface-runtime-eso` by
adding `read` on exact
`platform/data/workloads/reuse/reuse-surface/forgejo-source-read`.
Candidate full file is bundled, SHA256
`788bb9c49ab571e522beeecf7a5e29d1c79c842a84fe6d801978655facd3b5bd`.
No glob, metadata grant, other sibling, caller writer policy, OIDC binding,
AppRole or Kubernetes auth role change. Verify role/token is still 15m and
bound to exact SA/namespace/audience; source configuration is not live proof.
- **modify** existing `reuse/reuse-surface-runtime` ExternalSecret by one data
item: secretKey `REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN`, remoteRef key
`workloads/reuse/reuse-surface/forgejo-source-read`, property
`FORGEJO_SOURCE_TOKEN`. Bundled JSON item is a proposal for apps integration,
not a standalone apply object. Preserve existing writer and webhook fields.
- **modify** native fetch code/image through reuse and apps review: reuse owner
identified both Authorization header forwarding on redirects and registration-
controlled auth_env/URL credential exfiltration in the current native fetch.
Do not project the PAT until the full reviewed fix is image-digest pinned and
runtime authorization plus redirect credential isolation are verified.
Then deliver through existing envFrom and an apps-approved controlled rollout.
Image change is explicit; preserve resource bounds unless separately reviewed.
Rollout must account for SQLite/PVC and single-node headroom before approval.
- **modify** owner-controlled runtime config `REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST`
to map `REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` to the exact fourteen consented
pinned API URL strings: seven indexes and seven capability entries. Candidate
config is `builds/reuse-surface-private-source-reader/auth-source-allowlist.json`;
registrations cannot set or widen this runtime authority. The patched consumer
checks exact URL membership **before credential lookup**, requires HTTPS and
refuses authenticated redirects including same-origin path changes. Apps/reuse
must safely inventory existing authenticated registrations (auth_env and URL
metadata only), review which destinations remain legitimate, and migrate their
mappings before fail-closed rollout. Inventory is not blanket consent. The new
reader mapping stays exact14; any existing legitimate other mapping needs its
own owner-reviewed authorization. Missing/invalid mappings fail closed.
- **create** proposed ops-warden pointer `reuse-surface-forgejo-source-read` in
draft status after construction, owner `railiance-platform`, non-SSH route
only (`warden_executes:false`). Runtime reader is the hub, not warden.
Activation remains ops-warden's independent verified catalog review.
### Full consumer candidate pins
Reuse owner provided full patch SHA256
`f707ddfd36d5d470c176530671bb30ff6a3af2dfff86937aa8a5618bcb79768e`,
fixed `federation.py` SHA256
`dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd`,
native verification helper `private_source_verify.py` SHA256
`c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c`,
and owner runtime allowlist SHA256
`e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286`.
The ops-mason bundled compact allowlist has the same exact env and fourteen URL
sets; serialization/order differs. The construction inputs retain absolute
isolated-owner artifact references for integration. Owner reports focused30pass
and whole226pass with one isolated-relative-path failure; this is not native
runtime proof. Fixed image digest and owner execution review remain pending.
### Revision preservation
R2 refines the same proposal and trial; R1 is preserved under custodian
`owner-assembly/mason-r1/` and `/tmp/cust81-mason-reader-r1-snapshot`. R1 candidate
spec digest was `0d1f604c76e086c82675dc535004cf4da51ef5dc247959fab50295a673407980`.
Neither revision was approved or executed. The full consumer fix and runtime
allowlist supersede the earlier redirect-only image gate. Approval, when sought,
must bind this final reviewed revision, its consumer patch, runtime config and
image; do not create another scored trial from this refinement.
### Residual-secret lifecycle and elimination
Credential owner is railiance-platform; Forgejo owns target grants; reuse-surface
is the only workload consumer. Authority exposes **entire source code of the
seven repositories**, not just registry files. Metadata disclosure approval
alone does not authorize this larger repository-read grant.
Known intended copies: OpenBao KV current version and retained versions/backups;
Kubernetes Secret in `reuse` and etcd backups; hub process environment; transient
minting/delivery memory. Every namespace actor allowed to attach the ESO store or
reference the materialized Secret is an indirect consumer/exposure path and must
be reviewed; namespace conditions are not per-pod isolation. No CI/chat/local
credential file copy is allowed. Avoid Secret last-applied annotation copies.
Proposed lifetime policy is attended rotation **every 90 days**, and immediately
on compromise, owner change, consumer retirement or scope drift. This is a
recommended stricter policy than CCR-0031's 180-day precedent; it is not a claim
of automated enforcement or PAT native expiry. Record issuance and next-due UTC
in platform inventory, with an assigned owner reminder before activation.
Rotation: mint one replacement with the same checked grant; compare scopes and
all effective grants; write it as a new KV version without changing other fields;
wait for ESO, roll the reviewed fixed image, verify all seven native fetches, then revoke old
PAT by recorded ID. Replacement overlap must end within 24 hours. Failed or
ambiguous replacement issuance is reconciled by token-name/ID inventory before
retry; no blind minting. Review retained KV versions/backups under platform's
retention policy; obsolete token copies are harmless only after target revocation.
Immediate revocation deletes the dedicated PAT by ID, then removes/disables only
this identity's team grants as approved. Compromise response reviews Forgejo
access/audit metadata and scans owned repositories and approved logs for leaks
without placing tokens in prompts. Use secret scanners/redactors and suppressed
negative probes. Availability strategy fails private refresh closed and marks
consented cache stale; public discovery continues. Never substitute privileged
personal/admin/core-hub credentials during issuer outage.
Elimination depends on Forgejo/native federation or an operationally viable
short-lived service credential, plus native consumer support. Revisit at rotation
and at target upgrades; retain a live owner record for that engineering debt.
## 4. Review notes (ops-mason phase 2, incomplete)
Reuse existing delivery identity and stores rather than introduce AppRole/static
ESO authority. The new PAT is isolated; caller writer policy stays byte-identical.
The proposed full ESO policy preserves every original byte before one added exact
read stanza; integration must compare current live and source digests. If policy
changed, rebase, review and pin a fresh digest rather than overwrite it.
Existing `ops_mason.executor` engines do not express Forgejo user/team/PAT and
shared-policy extension. Do not mislabel this JSON as a supported build_spec or
pass it to a single-KV builder: that could replace existing policy. Candidate
spec digest is SHA256 of UTF-8 sorted compact JSON with allow_nan=false. It
binds scope; it is neither approval nor an executable adapter. Platform must
allocate CCR, own a silent idempotent provisioner and pin all execution/artifact
inputs before phase 3. Approval of a construction plan does not supply a token.
This draft is not yet phase-3 ready. Gaps: scoped live structure survey, target
Q1–Q3 confirmation, effective-access enumeration design, reviewed platform CCR
and script, consumer raw-route/Bearer behavior, full authorization/redirect-fixed image and runtime allowlist proof plan, apps exact deployment
and headroom/PVC rollback plan, independent owner reviews. No owner review is
written on another repo's behalf. Only ops-mason's own preparation findings are
recorded here. No own autopilot grant or monetary risk limit is claimed.
## 5. Executive summary (candidate; not yet ready for approval)
1. **One-line ask.** Give the hosted capability hub a dedicated read-only account
for the seven private repositories whose capability metadata you consented
to publish, delivered using the existing workload-identity path.
2. **Who/what gets access.** Forgejo user `reuse-surface-source` obtains the
seven-repository read grant; the existing `reuse-surface-runtime-eso` identity
reads one additional exact custody entry for the hub. Namespace actors able
to reuse the delivery store/Secret remain an exposure consideration to review.
3. **To what.** Read-only source access across the seven named private repositories,
with no write/admin/non-code-unit grants. The hub publishes only the pinned
consented capability metadata; repository visibility stays private.
4. **For how long.** Bao delivery tokens remain 15 minutes, but the Forgejo PAT
has no expiry demonstrated. Proposed attended rotation is every 90 days with
immediate revocation on compromise; this distinction must be accepted explicitly.
5. **Blast radius if the credential leaks.** Entire private source of those seven
repositories can be read. The token must have no additional private-repository
access and cannot write. Metadata disclosure consent is narrower than that read
grant. Availability impact of controlled rollout remains owner-reviewed.
6. **Cost to reverse.** Revoke one PAT, remove only its dedicated grants, remove
one new ESO data item and one new policy stanza, and roll the reviewed fixed image.
Reconcile private registrations from the exact attempt; preserve the existing
public capabilities and writer/webhook keys. No additional paid infrastructure
is proposed (incremental estimate EUR 0); labor and credible loss remain unpriced,
so this stays supervised.
After the missing reviews and executable inputs are attached, the founder can
**approve**, **reject**, or **send back to phase 1**. No founder disposition is
recorded for this credential proposal. Existing metadata consent is retained as
separate evidence and does not set status approved.
## 6. Proposed verification and rollback contract
This section describes future acceptance, **not a build result**. Phase 4 has not
run and no success evidence or active catalog entry exists.
Before changes: exact CCR/plan/script/manifest digests, owner reviews and founder
approved revision must match; metadata survey proves current path/policy/role;
source/consent pins match; all existing user/team conflicts resolved; previous
policy and deployment revision retained; apps runs dry-run and client diff,
confirms target node and headroom/PVC strategy. Never read or print Secret objects.
Before projecting any PAT into the hub: reuse owner patch must close native
both redirect Authorization forwarding and registration-controlled auth_env/URL
exfiltration. Tests must prove unlisted URL refusal before credential lookup and
no redirect credential forwarding. Apps must pin the full fixed image and exact
runtime allowlist configuration; review/migrate existing authenticated sources
before rollout. The earlier same-image and redirect-only assumptions are
superseded; full fixed image/source/patch and owner-runtime config approval remain
pending. The candidate allowlist encodes the consent packet exact fourteen URLs.
After target issuance, scope metadata must be exactly read:repository, team repo
set exactly seven and complete effective grants enumerated. Choose a known private
outside repo by target-owner metadata and prove denial without body retention.
Use safe read-only negative admin/non-code routes; never try writes as a negative
probe because unexpected privilege could make them succeed. Verify absence of
write authority through scope and effective permissions. Missing auth/anonymous
private raw reads fail closed, never cached as fresh successes.
Bao positive receipt proves ESO role exact path read; negative receipts prove
default identity and dedicated caller writer cannot read the new path, ESO cannot
read an unrelated sibling, and wrong SA/namespace/audience cannot authenticate.
These are effective token-specific checks, not a test on an admin session.
Owner suppressing helper checks ESO Ready and materialized key presence only.
In the actual running hub, native `fetch_remote_index_text` must fetch all seven
pinned URLs using `REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` and native header code;
validate schema, exact index hashes, exact expected IDs and relative entry handling
without printing private bodies. Local curl success is insufficient for native
runtime verification. Then register seven pinned sources with the approved writer
lane and force fresh composition; prove all 70 reviewed IDs exactly once, no stale
private fallback and matching metadata. Public URLs/entries and source bytes must
stay inside disclosure consent; new commits need renewed metadata review.
Rollback order: immediately revoke dedicated PAT; disable only new private
registrations after reconciling ambiguous requests; remove/revert exact new
ESO data item and policy stanza through owner paths; remove only the new
materialized token key with a suppressing helper, preserve writer/webhook keys;
controlled approved-image rollout. A previously vulnerable image must never
receive the new reader key; verify key removal before restoring such an image.
Restore previous pinned policy/deployment revision
when applicable. Retain partial, failed and unverified outcomes and token IDs.
Do not delete the shared Secret/store/role, overwrite unrelated policy changes,
or remove all public registrations. Restore only the new reader runtime mapping,
preserving separately reviewed existing authenticated-source mappings. No transactional rollback is claimed.

80
workplans/MASON-WP-0013-reuse-surface-private-source-reader.md Normal file
View file

@ -0,0 +1,80 @@
---
id: MASON-WP-0013
type: workplan
title: "Construct the seven-repository reuse-surface source reader"
domain: infotech
repo: ops-mason
status: proposed
owner: codex
topic_slug: netkingdom-security-architecture
created: "2026-10-15"
updated: "2026-10-15"
flavor: implementation
depends_on: []
---
# Seven-repository hosted reader
Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
workplan is prepared in an isolated owner checkout and is not yet integrated,
synced, approved or executed. No production or credential authority is inferred.
## Prepare the construction bundle
```task
id: MASON-WP-0013-T01
status: done
priority: high
```
Prepared `plans/reuse-surface-private-source-reader.md` and
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
ESO policy, data item, canonical candidate specification digest and SEC-DSM
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
with R1 evidence preserved. Plan remains draft because required live survey
and independent mechanism/owner reviews are missing.
## Complete scoped survey and construction review
```task
id: MASON-WP-0013-T02
status: wait
priority: high
```
Requires legitimate own metadata-only survey grant or sanitized platform-owned
survey. Confirm current exact path/policy/role and matching-existing identity
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
Do not use operator tokens or another agent supervision record.
## Bind owner CCR and executable inputs to founder decision
```task
id: MASON-WP-0013-T03
status: wait
priority: high
```
Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
and rollback artifacts including full fixed image, runtime-controlled allowlist
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
warden owns pointer review. Obtain separate founder decision on exact credential
and live-change revision/digests. Existing disclosure consent cannot approve
repository-wide credential grant. Requires T02.
## Verify the authorized owner build and routing handoff
```task
id: MASON-WP-0013-T04
status: wait
priority: high
```
After T03, founder/platform privileged path executes, ops-mason observes only
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
native seven-index positive and least-privilege negative checks, propose draft
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
success before actual receipt or finish while unresolved lifecycle work is only
in prose.