Prepare seven-repository reuse-surface reader construction revision 2

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

workplans/MASON-WP-0013-reuse-surface-private-source-reader.md

@@ -0,0 +1,80 @@
+---
+id: MASON-WP-0013
+type: workplan
+title: "Construct the seven-repository reuse-surface source reader"
+domain: infotech
+repo: ops-mason
+status: proposed
+owner: codex
+topic_slug: netkingdom-security-architecture
+created: "2026-10-15"
+updated: "2026-10-15"
+flavor: implementation
+depends_on: []
+---
+
+# Seven-repository hosted reader
+
+Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
+workplan is prepared in an isolated owner checkout and is not yet integrated,
+synced, approved or executed. No production or credential authority is inferred.
+
+## Prepare the construction bundle
+
+```task
+id: MASON-WP-0013-T01
+status: done
+priority: high
+```
+
+Prepared `plans/reuse-surface-private-source-reader.md` and
+`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
+ESO policy, data item, canonical candidate specification digest and SEC-DSM
+hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
+auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
+with R1 evidence preserved. Plan remains draft because required live survey
+and independent mechanism/owner reviews are missing.
+
+## Complete scoped survey and construction review
+
+```task
+id: MASON-WP-0013-T02
+status: wait
+priority: high
+```
+
+Requires legitimate own metadata-only survey grant or sanitized platform-owned
+survey. Confirm current exact path/policy/role and matching-existing identity
+handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
+across all API pages, secret lifecycle, negative tests and caller/ESO separation.
+Do not use operator tokens or another agent supervision record.
+
+## Bind owner CCR and executable inputs to founder decision
+
+```task
+id: MASON-WP-0013-T03
+status: wait
+priority: high
+```
+
+Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
+and rollback artifacts including full fixed image, runtime-controlled allowlist
+and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
+warden owns pointer review. Obtain separate founder decision on exact credential
+and live-change revision/digests. Existing disclosure consent cannot approve
+repository-wide credential grant. Requires T02.
+
+## Verify the authorized owner build and routing handoff
+
+```task
+id: MASON-WP-0013-T04
+status: wait
+priority: high
+```
+
+After T03, founder/platform privileged path executes, ops-mason observes only
+through scoped permitted metadata. Preserve outcome/rollback receipts, complete
+native seven-index positive and least-privilege negative checks, propose draft
+catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
+success before actual receipt or finish while unresolved lifecycle work is only
+in prose.