ops-mason/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
MASON-WP-0013	workplan	Construct the seven-repository reuse-surface source reader	infotech	ops-mason	finished	codex	netkingdom-security-architecture	2026-10-15	2026-10-22	implementation		a1da7c80-a299-5a46-8b42-9e366271442c

Seven-repository hosted reader

Demand: CUST-WP-0081. Metadata disclosure consent is a separate record. ops-mason surveyed metadata and recorded the platform CCR, founder decision, and the reader-scope journal. It did not mint or apply the lane.

Prepare the construction bundle

id: MASON-WP-0013-T01
status: done
priority: high
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"

Prepared plans/reuse-surface-private-source-reader.md and builds/reuse-surface-private-source-reader/ with exact-seven scope, candidate ESO policy, data item, canonical candidate specification digest and SEC-DSM hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate, with R1 evidence preserved. Plan remains draft because required live survey and independent mechanism/owner reviews are missing.

Appended 2026-10-22: the live survey is on T02. After that survey the plan status is reviewed.

Complete scoped survey and construction review

id: MASON-WP-0013-T02
status: done
priority: high
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"

Requires legitimate own metadata-only survey grant or sanitized platform-owned survey. Confirm current exact path/policy/role and matching-existing identity handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants across all API pages, secret lifecycle, negative tests and caller/ESO separation. Do not use operator tokens or another agent supervision record.

Done 2026-10-21T22:15:21Z. scripts/plan-survey.py ran under grant token-claude-MASON-WP-0014-T04 (policies default, ops-mason-survey). That was the one minted survey grant. It is not an operator or admin token.

Plan §2 records the exact path platform/workloads/reuse/reuse-surface/forgejo-source-read (current_version=1), policy workload-kv-read-reuse-surface-runtime-eso (read on that data path), and Kubernetes role reuse-surface-runtime-eso (SA reuse-surface-eso, namespace reuse, audience openbao). Decision: the OpenBao delivery lane already matches. The writer policy does not cover the path. Forgejo-owner Q1–Q3 are cited from forge-owner-review-r2.json. The plan is reviewed, not approved by ops-mason.

Bind owner CCR and executable inputs to founder decision

id: MASON-WP-0013-T03
status: done
depends_on: [MASON-WP-0013-T02]
priority: high
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"

Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout and rollback artifacts including full fixed image, runtime-controlled allowlist and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation; warden owns pointer review. Obtain separate founder decision on exact credential and live-change revision/digests. Existing disclosure consent cannot approve repository-wide credential grant. Requires T02.

Done as a record of the already-resolved binding. ops-mason did not approve, mint, or apply.

• Platform CCR-2026-0046. The executed CCR digest cited by platform evidence is 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
• Founder decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e, resolved 2026-10-15 by Bernd Worsch. It binds execution revision SHA256 704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380.
• Disclosure-consent digest 4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52 is a different record.

Verify the authorized owner build and routing handoff

id: MASON-WP-0013-T04
status: done
depends_on: [MASON-WP-0013-T03]
priority: high
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"

After T03, founder/platform privileged path executes, ops-mason observes only through scoped permitted metadata. Preserve outcome/rollback receipts, complete native seven-index positive and least-privilege negative checks, propose draft catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish success before actual receipt or finish while unresolved lifecycle work is only in prose.

Done as a citation of the platform journal and the custodian receipts. ops-mason did not log in as the workload and did not mint or apply.

• 2026-10-22: reader least-privilege denial is the-custodian docs/assessments/netkingdom-2026-10-14/cust81-forge-reader-r1.jsonl, attempt bb2693a7640f00b4e401467e, event verified, operation reader_scope, status seven_exact_no_extra_private_grants, at 2026-10-15T03:06:09.151956+00:00. The journal has no secret fields. scripts/provision-reuse-surface-forgejo-source.py writes that status only after the reader token is refused on private coulomb/rapp-core-hub, on /admin/users, and on each of the seven /actions/secrets routes (expected 403 or 404), and after each of the seven permissions is admin false, push false, pull true. The journal does not store those HTTP codes itself. Platform reply b6d82e8c is the MAS confirm-binding note and is not this receipt.

• Metadata, 2026-10-21T22:15:21Z, grant token-claude-MASON-WP-0014-T04: path version 1, ESO policy read, role bound as in T02. Survey-token capabilities: deny on the reader data path and on platform/data/workloads/reuse/reuse-surface/runtime-secrets; list, read on the reader metadata path. Writer policy workload-kv-read-reuse-surface-runtime has no stanza for the reader path. Those are the observer and writer-policy negatives. The reader denial is the journal above.

• Seven native indexes: custodian docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json, id CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1, all_verified true, seven repositories, checked_at 2026-10-15T03:30:20.627885Z. No source body is copied here.

• Seventy reviewed ids: custodian docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json, reviewed_present 70, all_reviewed_hosted_exactly_once true, composed_at 2026-10-15T03:31:48Z. That file is the CUST-WP-0081 evidence. This task cites it and does not copy the seventy ids.

• Outcome receipt: railiance-platform docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json, bootstrap attempt bb2693a7640f00b4e401467e. The preserved rollback contract is the-custodian docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json field rollback. Rollback was not run. The live rotation and revocation record remains RPF-WP-0058-T05.

• Draft catalog route, not activated: builds/reuse-surface-private-source-reader/catalog-proposal.yaml. It is not in the ops-warden catalog.