tegwick
9121961444
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
85 lines
3 KiB
Markdown
85 lines
3 KiB
Markdown
---
|
||
id: MASON-WP-0013
|
||
type: workplan
|
||
title: "Construct the seven-repository reuse-surface source reader"
|
||
domain: infotech
|
||
repo: ops-mason
|
||
status: proposed
|
||
owner: codex
|
||
topic_slug: netkingdom-security-architecture
|
||
created: "2026-10-15"
|
||
updated: "2026-10-15"
|
||
flavor: implementation
|
||
depends_on: []
|
||
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
|
||
---
|
||
|
||
# Seven-repository hosted reader
|
||
|
||
Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
|
||
workplan is prepared in an isolated owner checkout and is not yet integrated,
|
||
synced, approved or executed. No production or credential authority is inferred.
|
||
|
||
## Prepare the construction bundle
|
||
|
||
```task
|
||
id: MASON-WP-0013-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
|
||
```
|
||
|
||
Prepared `plans/reuse-surface-private-source-reader.md` and
|
||
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
|
||
ESO policy, data item, canonical candidate specification digest and SEC-DSM
|
||
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
|
||
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
|
||
with R1 evidence preserved. Plan remains draft because required live survey
|
||
and independent mechanism/owner reviews are missing.
|
||
|
||
## Complete scoped survey and construction review
|
||
|
||
```task
|
||
id: MASON-WP-0013-T02
|
||
status: wait
|
||
priority: high
|
||
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
|
||
```
|
||
|
||
Requires legitimate own metadata-only survey grant or sanitized platform-owned
|
||
survey. Confirm current exact path/policy/role and matching-existing identity
|
||
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
|
||
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
|
||
Do not use operator tokens or another agent supervision record.
|
||
|
||
## Bind owner CCR and executable inputs to founder decision
|
||
|
||
```task
|
||
id: MASON-WP-0013-T03
|
||
status: wait
|
||
priority: high
|
||
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
|
||
```
|
||
|
||
Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
|
||
and rollback artifacts including full fixed image, runtime-controlled allowlist
|
||
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
|
||
warden owns pointer review. Obtain separate founder decision on exact credential
|
||
and live-change revision/digests. Existing disclosure consent cannot approve
|
||
repository-wide credential grant. Requires T02.
|
||
|
||
## Verify the authorized owner build and routing handoff
|
||
|
||
```task
|
||
id: MASON-WP-0013-T04
|
||
status: wait
|
||
priority: high
|
||
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
|
||
```
|
||
|
||
After T03, founder/platform privileged path executes, ops-mason observes only
|
||
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
|
||
native seven-index positive and least-privilege negative checks, propose draft
|
||
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
|
||
success before actual receipt or finish while unresolved lifecycle work is only
|
||
in prose.
|