---
id: MASON-WP-0013
type: workplan
title: "Construct the seven-repository reuse-surface source reader"
domain: infotech
repo: ops-mason
status: proposed
owner: codex
topic_slug: netkingdom-security-architecture
created: "2026-10-15"
updated: "2026-10-21"
flavor: implementation
depends_on: []
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
---

# Seven-repository hosted reader

Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
workplan is prepared in an isolated owner checkout and is not yet integrated,
synced, approved or executed. No production or credential authority is inferred.

## Prepare the construction bundle

```task
id: MASON-WP-0013-T01
status: done
priority: high
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
```

Prepared `plans/reuse-surface-private-source-reader.md` and
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
ESO policy, data item, canonical candidate specification digest and SEC-DSM
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
with R1 evidence preserved. Plan remains draft because required live survey
and independent mechanism/owner reviews are missing.

## Complete scoped survey and construction review

```task
id: MASON-WP-0013-T02
status: wait
needs_human: true
decision_id: 0b55e53b-2531-466c-a2f9-282618b183f8
blocking_reason: "Founder mints ./scripts/bao-session.sh grant MASON-WP-0013-T02. An agent does not log in or grant. This decision is not plan approval."
priority: high
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
```

Requires legitimate own metadata-only survey grant or sanitized platform-owned
survey. Confirm current exact path/policy/role and matching-existing identity
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
Do not use operator tokens or another agent supervision record.

2026-10-21: still `wait`. Plan §2 records the grant refusal
(`no ops-mason-survey grant`) and cites Forgejo-owner `sec_dsm_order` Q1–Q3
from `forge-owner-review-r2.json` (2026-10-14T23:08:34Z). That citation is not
a metadata survey. Exact installed path, policy, and role remain unconfirmed.
Plan status stays `draft`. Founder grant gate is hub decision
`0b55e53b-2531-466c-a2f9-282618b183f8`. It does not approve this plan.

## Bind owner CCR and executable inputs to founder decision

```task
id: MASON-WP-0013-T03
status: wait
depends_on: [MASON-WP-0013-T02]
priority: high
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
```

Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
and rollback artifacts including full fixed image, runtime-controlled allowlist
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
warden owns pointer review. Obtain separate founder decision on exact credential
and live-change revision/digests. Existing disclosure consent cannot approve
repository-wide credential grant. Requires T02.

2026-10-21: still `wait` because T02 is not done. Observed elsewhere, and not
adopted as this task's completion: platform CCR-2026-0046, and founder
decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` (resolved 2026-10-15, Bernd
Worsch, binds execution revision SHA256
`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`). The
disclosure-consent digest
`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
different record. ops-mason does not approve, mint, or apply from this note.

## Verify the authorized owner build and routing handoff

```task
id: MASON-WP-0013-T04
status: wait
depends_on: [MASON-WP-0013-T03]
priority: high
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
```

After T03, founder/platform privileged path executes, ops-mason observes only
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
native seven-index positive and least-privilege negative checks, propose draft
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
success before actual receipt or finish while unresolved lifecycle work is only
in prose.

2026-10-21: still `wait`. This session has no scoped metadata receipt. No
draft catalog route is added; ops-warden catalog has no
`reuse-surface-forgejo-source-read` entry. Platform's hosted receipt
`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json`
is an external claim of seven native indexes and 70 reviewed ids, not an
ops-mason success publication. Lifecycle rotation is already the live task
`RPF-WP-0058-T05` (due 2027-01-13). No second rotation intake is opened here.