--- id: MASON-WP-0013 type: workplan title: "Construct the seven-repository reuse-surface source reader" domain: infotech repo: ops-mason status: finished owner: codex topic_slug: netkingdom-security-architecture created: "2026-10-15" updated: "2026-10-22" flavor: implementation depends_on: [] state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c" --- # Seven-repository hosted reader Demand: CUST-WP-0081. Metadata disclosure consent is a separate record. ops-mason surveyed metadata and recorded the platform CCR, founder decision, and the reader-scope journal. It did not mint or apply the lane. ## Prepare the construction bundle ```task id: MASON-WP-0013-T01 status: done priority: high state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096" ``` Prepared `plans/reuse-surface-private-source-reader.md` and `builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate ESO policy, data item, canonical candidate specification digest and SEC-DSM hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate, with R1 evidence preserved. Plan remains draft because required live survey and independent mechanism/owner reviews are missing. Appended 2026-10-22: the live survey is on T02. After that survey the plan status is `reviewed`. ## Complete scoped survey and construction review ```task id: MASON-WP-0013-T02 status: done priority: high state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6" ``` Requires legitimate own metadata-only survey grant or sanitized platform-owned survey. Confirm current exact path/policy/role and matching-existing identity handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants across all API pages, secret lifecycle, negative tests and caller/ESO separation. Do not use operator tokens or another agent supervision record. Done 2026-10-21T22:15:21Z. `scripts/plan-survey.py` ran under grant `token-claude-MASON-WP-0014-T04` (policies `default`, `ops-mason-survey`). That was the one minted survey grant. It is not an operator or admin token. Plan §2 records the exact path `platform/workloads/reuse/reuse-surface/forgejo-source-read` (`current_version=1`), policy `workload-kv-read-reuse-surface-runtime-eso` (`read` on that data path), and Kubernetes role `reuse-surface-runtime-eso` (SA `reuse-surface-eso`, namespace `reuse`, audience `openbao`). Decision: the OpenBao delivery lane already matches. The writer policy does not cover the path. Forgejo-owner Q1–Q3 are cited from `forge-owner-review-r2.json`. The plan is `reviewed`, not approved by ops-mason. ## Bind owner CCR and executable inputs to founder decision ```task id: MASON-WP-0013-T03 status: done depends_on: [MASON-WP-0013-T02] priority: high state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4" ``` Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout and rollback artifacts including full fixed image, runtime-controlled allowlist and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation; warden owns pointer review. Obtain separate founder decision on exact credential and live-change revision/digests. Existing disclosure consent cannot approve repository-wide credential grant. Requires T02. Done as a record of the already-resolved binding. ops-mason did not approve, mint, or apply. - Platform CCR-2026-0046. The executed CCR digest cited by platform evidence is `23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02`. - Founder decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e`, resolved 2026-10-15 by Bernd Worsch. It binds execution revision SHA256 `704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`. - Disclosure-consent digest `4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a different record. ## Verify the authorized owner build and routing handoff ```task id: MASON-WP-0013-T04 status: done depends_on: [MASON-WP-0013-T03] priority: high state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f" ``` After T03, founder/platform privileged path executes, ops-mason observes only through scoped permitted metadata. Preserve outcome/rollback receipts, complete native seven-index positive and least-privilege negative checks, propose draft catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish success before actual receipt or finish while unresolved lifecycle work is only in prose. Done as a citation of the platform journal and the custodian receipts. ops-mason did not log in as the workload and did not mint or apply. - 2026-10-22: reader least-privilege denial is the-custodian `docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl`, attempt `bb2693a7640f00b4e401467e`, event `verified`, operation `reader_scope`, status `seven_exact_no_extra_private_grants`, at `2026-10-15T03:06:09.151956+00:00`. The journal has no secret fields. `scripts/provision-reuse-surface-forgejo-source.py` writes that status only after the reader token is refused on private `coulomb/rapp-core-hub`, on `/admin/users`, and on each of the seven `/actions/secrets` routes (expected 403 or 404), and after each of the seven permissions is admin false, push false, pull true. The journal does not store those HTTP codes itself. Platform reply b6d82e8c is the MAS confirm-binding note and is not this receipt. - Metadata, 2026-10-21T22:15:21Z, grant `token-claude-MASON-WP-0014-T04`: path version 1, ESO policy read, role bound as in T02. Survey-token capabilities: `deny` on the reader data path and on `platform/data/workloads/reuse/reuse-surface/runtime-secrets`; `list, read` on the reader metadata path. Writer policy `workload-kv-read-reuse-surface-runtime` has no stanza for the reader path. Those are the observer and writer-policy negatives. The reader denial is the journal above. - Seven native indexes: custodian `docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json`, id `CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1`, `all_verified` true, seven repositories, `checked_at` 2026-10-15T03:30:20.627885Z. No source body is copied here. - Seventy reviewed ids: custodian `docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json`, `reviewed_present` 70, `all_reviewed_hosted_exactly_once` true, `composed_at` 2026-10-15T03:31:48Z. That file is the CUST-WP-0081 evidence. This task cites it and does not copy the seventy ids. - Outcome receipt: railiance-platform `docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json`, bootstrap attempt `bb2693a7640f00b4e401467e`. The preserved rollback contract is the-custodian `docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json` field `rollback`. Rollback was not run. The live rotation and revocation record remains `RPF-WP-0058-T05`. - Draft catalog route, not activated: `builds/reuse-surface-private-source-reader/catalog-proposal.yaml`. It is not in the ops-warden catalog.