ops-mason/workplans/ADHOC-2026-10-11.md

id	type	title	domain	repo	status	owner	created	updated	flavor
ADHOC-2026-10-11	workplan	Independent ops-mason owner review of Forgejo consumer ESO refinement	infotech	ops-mason	finished	codex	2026-10-11	2026-10-11	implementation

Review the frozen consumer-reader source refinement

id: ADHOC-2026-10-11-T01
status: done
priority: medium

Independent dedicated ops-mason-owner review under MASON-WP-0010-T03. Loaded ops-mason AGENTS.md, INTENT.md and SCOPE.md in its checkout; read delegated-owner-review_v0.1.md and agent-environment-orientation.md. Review was performed in an isolated checkout, with no owner source/native writes, authentication, credential values or approval recording.

Exact frozen 17-file manifest: sha256:c48b64e5e704e8f11ca65095c376c8a9fecc2b3a58e74b9eb62096c80d00f4fb. Proposed full render: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All staged file hashes and both owner implementation baselines verified. Source review approved: minimal duplicate-CCR fix preserves current1.1 naming and gates; proposed1.2 adds the consumer role without transferring acceptance.

Independent verification: 42 builder/plan/structure tests pass in /tmp/forgejo-eso-mason-independent-review/checkout. The two-role regression fails against original case_build.py with two CCR paths collapsing to one identity, demonstrating the original defect. Proposed1.2 is refused by real Mason admission with allow_unimplemented because its type remains proposed. Structural tests cover exact policy/role pins, authenticated owner observations, created/preexisting separation and rollback exclusion for shared objects. Actual Platform apply guard requires approved status and confirmed binding; the proposal remains proposed/unconfirmed. Original reused-policy SHA256 guard remains unchanged.

INTENT basis: Mission four-phase process and Responsibility boundary: construction of exact-path policies/auth roles is Mason work; native custody and delegated application belong to railiance-platform, consumer Kubernetes delivery belongs to railiance-apps, catalog activation belongs to ops-warden. A source review is no founder decision or live grant. Sixth object needs exact successor acknowledgment and authenticated per-object evidence, not old five-object acceptance or planned rollback inventory. Dedicated forgejo/forgejo-keycape-forgejo-eso avoids shared forgejo/default. Shared ESO controller trust, legacy-token fallback, retained target and issued-token expiry/revocation are explicit. Rollback deletes only independently proven created objects, removes role before policy, and preserves preexisting matches.

Review outcome and formal review entry are stored in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review.json. This local review task is complete; MASON-WP-0010-T03, owner source reconciliation, native proof, exact acknowledgment and first-case/live gates remain with their existing workplans. No new residual is created by this bounded review.

Review revised workload and token recovery generation

id: ADHOC-2026-10-11-T02
status: done
priority: medium

Fresh dedicated ops-mason-owner review under MASON-WP-0010-T03, retaining T01 and its exact c48 review without rewriting its historical outcome. Exact frozen19 manifest sha256:5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431; unchanged proposed full render sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35. All19 hashes and three current owner source baselines verified. Independent isolated builder/plan/structure suites:44 passed. New workload and lifecycle counterexamples both fail against the earlier c48 builder, reproducing mislabelled keycape consumer target and delete-only recovery wording. Earlier42 suite and original duplicate-role failure remain preserved in /tmp/forgejo-eso-mason-independent-review.

Revised source review approved against INTENT Mission construction consistency and Responsibility boundary: consumer-reader-policy now derives consuming_service as workload, while KeyCape reader output remains unchanged. Current1.1 consumer generation intentionally corrects target.workload from keycape to forgejo. The committed historical1.1 bundle is unchanged and fresh exact matching correctly refuses that stale target. Only local fixtures correct and rehash historical consumer metadata; no verifier grandfathering or native acceptance transfer is introduced. A new explicit regression proves original historical bundle refusal.

Role-backed consumer recovery first reverts the consumer reference; restricts cleanup to independently proven created objects; preserves shared/preexisting matches; requires owner token revocation or independently verified expiry before declaring deactivation; forbids a new login/remint during recovery; and stops on changed references/UIDs/ownership. Proposed type rollback and CCR42 retain role-before-policy ordering. These are source obligations, not an installed recovery adapter or supplied custody authority. Real proposed1.2 admission remains refused, CCR42 remains proposed with unconfirmed binding, and exact acknowledgment/native per-owner evidence/founder live go remain pending.

Own task completed before formal refined review entry in docs/evidence/2026-10-11-forgejo-consumer-eso-independent-mason-review-refined.json. No source writes in owner checkout, native act, authentication, credential value, acknowledgment, admission/binding/status mutation or completion claim. Fresh source build/bundle reconciliation follows exact acceptance; earlier approval does not migrate to the corrected output. Existing MASON-WP-0010-T03 and first-case owner work retain these next steps.