ops-mason/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
MASON-WP-0013	workplan	Construct the seven-repository reuse-surface source reader	infotech	ops-mason	active	codex	netkingdom-security-architecture	2026-10-15	2026-10-22	implementation		a1da7c80-a299-5a46-8b42-9e366271442c

Seven-repository hosted reader

Demand: CUST-WP-0081. Metadata disclosure consent is a separate record. ops-mason surveyed metadata and recorded the platform CCR and founder decision. It did not mint or apply the lane. T04 stays wait until a cited receipt records the reader least-privilege denial.

Prepare the construction bundle

id: MASON-WP-0013-T01
status: done
priority: high
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"

Prepared plans/reuse-surface-private-source-reader.md and builds/reuse-surface-private-source-reader/ with exact-seven scope, candidate ESO policy, data item, canonical candidate specification digest and SEC-DSM hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate, with R1 evidence preserved. Plan remains draft because required live survey and independent mechanism/owner reviews are missing.

Appended 2026-10-22: the live survey is on T02. After that survey the plan status is reviewed.

Complete scoped survey and construction review

id: MASON-WP-0013-T02
status: done
priority: high
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"

Requires legitimate own metadata-only survey grant or sanitized platform-owned survey. Confirm current exact path/policy/role and matching-existing identity handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants across all API pages, secret lifecycle, negative tests and caller/ESO separation. Do not use operator tokens or another agent supervision record.

Done 2026-10-21T22:15:21Z. scripts/plan-survey.py ran under grant token-claude-MASON-WP-0014-T04 (policies default, ops-mason-survey). That was the one minted survey grant. It is not an operator or admin token.

Plan §2 records the exact path platform/workloads/reuse/reuse-surface/forgejo-source-read (current_version=1), policy workload-kv-read-reuse-surface-runtime-eso (read on that data path), and Kubernetes role reuse-surface-runtime-eso (SA reuse-surface-eso, namespace reuse, audience openbao). Decision: the OpenBao delivery lane already matches. The writer policy does not cover the path. Forgejo-owner Q1–Q3 are cited from forge-owner-review-r2.json. The plan is reviewed, not approved by ops-mason.

Bind owner CCR and executable inputs to founder decision

id: MASON-WP-0013-T03
status: done
depends_on: [MASON-WP-0013-T02]
priority: high
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"

Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout and rollback artifacts including full fixed image, runtime-controlled allowlist and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation; warden owns pointer review. Obtain separate founder decision on exact credential and live-change revision/digests. Existing disclosure consent cannot approve repository-wide credential grant. Requires T02.

Done as a record of the already-resolved binding. ops-mason did not approve, mint, or apply.

• Platform CCR-2026-0046. The executed CCR digest cited by platform evidence is 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
• Founder decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e, resolved 2026-10-15 by Bernd Worsch. It binds execution revision SHA256 704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380.
• Disclosure-consent digest 4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52 is a different record.

Verify the authorized owner build and routing handoff

id: MASON-WP-0013-T04
status: wait
blocked_on: message-from:railiance-platform
priority: high
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"

After T03, founder/platform privileged path executes, ops-mason observes only through scoped permitted metadata. Preserve outcome/rollback receipts, complete native seven-index positive and least-privilege negative checks, propose draft catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish success before actual receipt or finish while unresolved lifecycle work is only in prose.

Waiting on railiance-platform for a receipt that records the reader least-privilege denial. The items below are cited. They do not include that denial result. ops-mason did not log in as the workload and did not mint or apply.

• 2026-10-22: platform reply b6d82e8c is the MAS confirm-binding note. It is not the reader denial receipt.

• Metadata, 2026-10-21T22:15:21Z, grant token-claude-MASON-WP-0014-T04: path version 1, ESO policy read, role bound as in T02. Survey-token capabilities: deny on the reader data path and on platform/data/workloads/reuse/reuse-surface/runtime-secrets; list, read on the reader metadata path. Writer policy workload-kv-read-reuse-surface-runtime has no stanza for the reader path. Those are observer and writer-policy negatives, not the reader denial.

• Seven native indexes: custodian docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json, id CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1, all_verified true, seven repositories, checked_at 2026-10-15T03:30:20.627885Z. No source body is copied here.

• Seventy reviewed ids: custodian docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json, reviewed_present 70, all_reviewed_hosted_exactly_once true, composed_at 2026-10-15T03:31:48Z. That file is the CUST-WP-0081 evidence. This task cites it and does not copy the seventy ids.

• Outcome receipt: railiance-platform docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json, bootstrap attempt bb2693a7640f00b4e401467e. The preserved rollback contract is the-custodian docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json field rollback. Rollback was not run. The live rotation and revocation record remains RPF-WP-0058-T05.

• Draft catalog route, not activated: builds/reuse-surface-private-source-reader/catalog-proposal.yaml. It is not in the ops-warden catalog.