ops-mason/workplans/ADHOC-2026-10-11.md

id	type	title	domain	repo	status	owner	created	updated	flavor	state_hub_workstream_id
ADHOC-2026-10-11	workplan	Independent ops-mason owner review of Forgejo consumer ESO refinement	infotech	ops-mason	finished	codex	2026-10-11	2026-10-11	implementation	e3854bfd-2bc8-5411-8c96-44ed22d878a7

Review the frozen consumer-reader source refinement

id: ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "d7b760f2-fb8b-542a-a42e-d2846dd03cc9"

Independent dedicated ops-mason-owner review under MASON-WP-0010-T03. Loaded ops-mason AGENTS.md, INTENT.md and SCOPE.md in its checkout; read delegated-owner-review_v0.1.md and agent-environment-orientation.md. Review was performed in an isolated checkout, with no owner source/native writes, authentication, credential values or approval recording.

Exact frozen 17-file manifest: sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb. Proposed full render: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All staged file hashes and both owner implementation baselines verified. Source review approved: minimal duplicate-CCR fix preserves current1.1 naming and gates; proposed1.2 adds the consumer role without transferring acceptance.

Independent verification: 42 builder/plan/structure tests pass in /tmp/forgejo-eso-mason-independent-review/checkout. The two-role regression fails against original case_build.py with two CCR paths collapsing to one identity, demonstrating the original defect. Proposed1.2 is refused by real Mason admission with allow_unimplemented because its type remains proposed. Structural tests cover exact policy/role pins, authenticated owner observations, created/preexisting separation and rollback exclusion for shared objects. Actual Platform apply guard requires approved status and confirmed binding; the proposal remains proposed/unconfirmed. Original reused-policy SHA256 guard remains unchanged.

INTENT basis: Mission four-phase process and Responsibility boundary: construction of exact-path policies/auth roles is Mason work; native custody and delegated application belong to railiance-platform, consumer Kubernetes delivery belongs to railiance-apps, catalog activation belongs to ops-warden. A source review is no founder decision or live grant. Sixth object needs exact successor acknowledgment and authenticated per-object evidence, not old five-object acceptance or planned rollback inventory. Dedicated forgejo/forgejo-keycape-forgejo-eso avoids shared forgejo/default. Shared ESO controller trust, legacy-token fallback, retained target and issued-token expiry/revocation are explicit. Rollback deletes only independently proven created objects, removes role before policy, and preserves preexisting matches.

Review outcome and formal review entry are stored in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json. This local review task is complete; MASON-WP-0010-T03, owner source reconciliation, native proof, exact acknowledgment and first-case/live gates remain with their existing workplans. No new residual is created by this bounded review.

Review revised workload and token recovery generation

id: ADHOC-2026-10-11-T02
status: done
priority: medium
state_hub_task_id: "ff180859-f3d0-5aee-9e09-73e99fee0ad8"

Fresh dedicated ops-mason-owner review under MASON-WP-0010-T03, retaining T01 and its exact c48 review without rewriting its historical outcome. Exact frozen19 manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431; unchanged proposed full render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All19 hashes and three current owner source baselines verified. Independent isolated builder/plan/structure suites:44 passed. New workload and lifecycle counterexamples both fail against the earlier c48 builder, reproducing mislabelled keycape consumer target and delete-only recovery wording. Earlier42 suite and original duplicate-role failure remain preserved in /tmp/forgejo-eso-mason-independent-review.

Revised source review approved against INTENT Mission construction consistency and Responsibility boundary: consumer-reader-policy now derives consuming_service as workload, while KeyCape reader output remains unchanged. Current1.1 consumer generation intentionally corrects target.workload from keycape to forgejo. The committed historical1.1 bundle is unchanged and fresh exact matching correctly refuses that stale target. Only local fixtures correct and rehash historical consumer metadata; no verifier grandfathering or native acceptance transfer is introduced. A new explicit regression proves original historical bundle refusal.

Role-backed consumer recovery first reverts the consumer reference; restricts cleanup to independently proven created objects; preserves shared/preexisting matches; requires owner token revocation or independently verified expiry before declaring deactivation; forbids a new login/remint during recovery; and stops on changed references/UIDs/ownership. Proposed type rollback and CCR42 retain role-before-policy ordering. These are source obligations, not an installed recovery adapter or supplied custody authority. Real proposed1.2 admission remains refused, CCR42 remains proposed with unconfirmed binding, and exact acknowledgment/native per-owner evidence/founder live go remain pending.

Own task completed before formal refined review entry in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json. No source writes in owner checkout, native act, authentication, credential value, acknowledgment, admission/binding/status mutation or completion claim. Fresh source build/bundle reconciliation follows exact acceptance; earlier approval does not migrate to the corrected output. Existing MASON-WP-0010-T03 and first-case owner work retain these next steps.

Independently review native client-custody capability preparation

id: ADHOC-2026-10-11-T03
status: done
priority: medium

Completed independent ops-mason source review preparation for MASON-WP-0009-T05 before issuing its formal review. Read this repo's AGENTS.md, INTENT.md, MASON-WP-0009, survey policy and the exact operator/ESO platform policies, plus fleet delegated-owner-review and environment orientation. Reviewed frozen manifest SHA256 e5d4781c6280c3bc8a3930c63cfb563f59752465720d6c2c3e95eb0551f8e949 and verified all five staged digests and existing workplan baseline. Original input and owner checkouts were not changed.

INTENT Mission/Responsibility boundary permits metadata/capability verification, not secret retrieval or policy widening. Fixed allowlisted endpoints, task-bound survey identity and data deny, -no-store operator OIDC and fixed ESO TokenRequest retain that boundary. Native nonmember acceptance correctly requires independent same-attempt issuer identity plus platform groups-refusal correlation; the runner never treats login errors as acceptance. Attendance/source-digest checks are procedural gates, not new live authority or runtime isolation.

Existing 19 tests pass. Independent synthetic counterexamples show Api.call accepts HTTP202 text/plain JSON errors as a successful revoke response, and survey accepts an omitted accessor as SHA256 of empty input. These are concrete acceptance/correlation defects, so a fresh source revision is required before native proposal execution. The query identity-failure recovery exception is explicitly declared: no confirmation, founder revocation, acceptance remains blocked. It is not silently counted as clean.

This bounded review task is complete. Corrections and native proof remain live in MASON-WP-0009-T05; no plan completion or route activation is claimed and no new residual is parked in prose. No native action, credential request, value access, approval disposition, commit, push or consistency sync was performed.

T03 corrected-source re-review — same review trial

Completed independent re-review preparation before the refined formal entry. Original request-changes review and frozen refinement01 are preserved. Exact corrected manifest SHA256 4dbf808e2d79c2e6600a163e147db7d15b075e59a8edf8cd236f31fdce9b5155, verifier SHA256 f7685646dca48db5874174940c1826db186e1ed73e167814d8c0f37af3ad619c. Verified all five immutable hashes and actual existing WP0009 baseline.

Corrected source now accepts only HTTP200 application/json object envelopes with endpoint data/auth shape and no errors member. Self-revoke requires HTTP204 and empty body; stale or error responses cannot confirm cleanup. Nonempty typed bounded accessors are mandatory; recovered query/lane tokens still revoke after missing accessor or other later verification refusal. TTL types/limits, mixed errors plus auth recovery, source digest preflight, incremental 64KiB native stdout/stderr capture and redirect/proxy guards are covered. All 29 maker tests pass independently. Four additional independent counterexamples pass: cross-origin redirect target gets no token/request; absent revoke response and failed cleanup remain unproved; expired TTL/missing accessor retain cleanup with no correlation success; oversized native stderr is refused while child runs.

INTENT Mission/Responsibility boundary remains respected: no KV GET, no widening, source preparation only, exact founder go still required. Nonmember acceptance continues to need issuer-authenticated human nonmember/aal2 and correlated native platform groups refusal for the same attempted subject/flow; callback text alone never passes. Source acceptance does not attest native isolation or finish T05. Corrections to the first review's two blocking defects are complete at source; existing MASON-WP-0009-T05 retains all native matrices, nonmember correlation, owner acceptance and route activation. No new residual or native act is claimed.