tegwick
ca5e98d4e4
MASON-WP-0013-T02 and MASON-WP-0014-T04 stay wait. Hub decision 0b55e53b-2531-466c-a2f9-282618b183f8 asks the founder to mint the two scoped grants. An agent does not log in or grant, and this decision does not approve the private-reader plan. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
114 lines
4.7 KiB
Markdown
114 lines
4.7 KiB
Markdown
---
|
||
id: MASON-WP-0013
|
||
type: workplan
|
||
title: "Construct the seven-repository reuse-surface source reader"
|
||
domain: infotech
|
||
repo: ops-mason
|
||
status: proposed
|
||
owner: codex
|
||
topic_slug: netkingdom-security-architecture
|
||
created: "2026-10-15"
|
||
updated: "2026-10-21"
|
||
flavor: implementation
|
||
depends_on: []
|
||
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
|
||
---
|
||
|
||
# Seven-repository hosted reader
|
||
|
||
Demand: CUST-WP-0081; metadata disclosure consent is recorded separately. This
|
||
workplan is prepared in an isolated owner checkout and is not yet integrated,
|
||
synced, approved or executed. No production or credential authority is inferred.
|
||
|
||
## Prepare the construction bundle
|
||
|
||
```task
|
||
id: MASON-WP-0013-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
|
||
```
|
||
|
||
Prepared `plans/reuse-surface-private-source-reader.md` and
|
||
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
|
||
ESO policy, data item, canonical candidate specification digest and SEC-DSM
|
||
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
|
||
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
|
||
with R1 evidence preserved. Plan remains draft because required live survey
|
||
and independent mechanism/owner reviews are missing.
|
||
|
||
## Complete scoped survey and construction review
|
||
|
||
```task
|
||
id: MASON-WP-0013-T02
|
||
status: wait
|
||
needs_human: true
|
||
decision_id: 0b55e53b-2531-466c-a2f9-282618b183f8
|
||
blocking_reason: "Founder mints ./scripts/bao-session.sh grant MASON-WP-0013-T02. An agent does not log in or grant. This decision is not plan approval."
|
||
priority: high
|
||
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
|
||
```
|
||
|
||
Requires legitimate own metadata-only survey grant or sanitized platform-owned
|
||
survey. Confirm current exact path/policy/role and matching-existing identity
|
||
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
|
||
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
|
||
Do not use operator tokens or another agent supervision record.
|
||
|
||
2026-10-21: still `wait`. Plan §2 records the grant refusal
|
||
(`no ops-mason-survey grant`) and cites Forgejo-owner `sec_dsm_order` Q1–Q3
|
||
from `forge-owner-review-r2.json` (2026-10-14T23:08:34Z). That citation is not
|
||
a metadata survey. Exact installed path, policy, and role remain unconfirmed.
|
||
Plan status stays `draft`. Founder grant gate is hub decision
|
||
`0b55e53b-2531-466c-a2f9-282618b183f8`. It does not approve this plan.
|
||
|
||
## Bind owner CCR and executable inputs to founder decision
|
||
|
||
```task
|
||
id: MASON-WP-0013-T03
|
||
status: wait
|
||
depends_on: [MASON-WP-0013-T02]
|
||
priority: high
|
||
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
|
||
```
|
||
|
||
Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
|
||
and rollback artifacts including full fixed image, runtime-controlled allowlist
|
||
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
|
||
warden owns pointer review. Obtain separate founder decision on exact credential
|
||
and live-change revision/digests. Existing disclosure consent cannot approve
|
||
repository-wide credential grant. Requires T02.
|
||
|
||
2026-10-21: still `wait` because T02 is not done. Observed elsewhere, and not
|
||
adopted as this task's completion: platform CCR-2026-0046, and founder
|
||
decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e` (resolved 2026-10-15, Bernd
|
||
Worsch, binds execution revision SHA256
|
||
`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`). The
|
||
disclosure-consent digest
|
||
`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
|
||
different record. ops-mason does not approve, mint, or apply from this note.
|
||
|
||
## Verify the authorized owner build and routing handoff
|
||
|
||
```task
|
||
id: MASON-WP-0013-T04
|
||
status: wait
|
||
depends_on: [MASON-WP-0013-T03]
|
||
priority: high
|
||
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
|
||
```
|
||
|
||
After T03, founder/platform privileged path executes, ops-mason observes only
|
||
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
|
||
native seven-index positive and least-privilege negative checks, propose draft
|
||
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
|
||
success before actual receipt or finish while unresolved lifecycle work is only
|
||
in prose.
|
||
|
||
2026-10-21: still `wait`. This session has no scoped metadata receipt. No
|
||
draft catalog route is added; ops-warden catalog has no
|
||
`reuse-surface-forgejo-source-read` entry. Platform's hosted receipt
|
||
`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json`
|
||
is an external claim of seven native indexes and 70 reviewed ids, not an
|
||
ops-mason success publication. Lifecycle rotation is already the live task
|
||
`RPF-WP-0058-T05` (due 2027-01-13). No second rotation intake is opened here.
|