tegwick
dee677f226
The ops-mason-survey grant confirmed the existing private-reader lane and the MAS delivery metadata. CCR-2026-0046 and founder decision 9833715e are recorded apart from the disclosure consent. The plan stays reviewed, and the draft catalog route is not activated. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
146 lines
6.1 KiB
Markdown
146 lines
6.1 KiB
Markdown
---
|
||
id: MASON-WP-0013
|
||
type: workplan
|
||
title: "Construct the seven-repository reuse-surface source reader"
|
||
domain: infotech
|
||
repo: ops-mason
|
||
status: finished
|
||
owner: codex
|
||
topic_slug: netkingdom-security-architecture
|
||
created: "2026-10-15"
|
||
updated: "2026-10-22"
|
||
flavor: implementation
|
||
depends_on: []
|
||
state_hub_workstream_id: "a1da7c80-a299-5a46-8b42-9e366271442c"
|
||
---
|
||
|
||
# Seven-repository hosted reader
|
||
|
||
Demand: CUST-WP-0081. Metadata disclosure consent is a separate record.
|
||
ops-mason surveyed metadata and recorded the platform CCR, founder decision,
|
||
and cited receipts. It did not mint or apply the lane.
|
||
|
||
## Prepare the construction bundle
|
||
|
||
```task
|
||
id: MASON-WP-0013-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "4b484f05-d51d-59f9-b282-658bc7ab0096"
|
||
```
|
||
|
||
Prepared `plans/reuse-surface-private-source-reader.md` and
|
||
`builds/reuse-surface-private-source-reader/` with exact-seven scope, candidate
|
||
ESO policy, data item, canonical candidate specification digest and SEC-DSM
|
||
hierarchy/lifecycle analysis. R2 refines the same proposal: full consumer
|
||
auth_env/URL authorization and redirect fix plus exact14 runtime allowlist gate,
|
||
with R1 evidence preserved. Plan remains draft because required live survey
|
||
and independent mechanism/owner reviews are missing.
|
||
|
||
Appended 2026-10-22: the live survey is on T02. After that survey the plan
|
||
status is `reviewed`.
|
||
|
||
## Complete scoped survey and construction review
|
||
|
||
```task
|
||
id: MASON-WP-0013-T02
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
|
||
```
|
||
|
||
Requires legitimate own metadata-only survey grant or sanitized platform-owned
|
||
survey. Confirm current exact path/policy/role and matching-existing identity
|
||
handling; Forgejo owner confirms Q1–Q3 hierarchy choices. Review effective grants
|
||
across all API pages, secret lifecycle, negative tests and caller/ESO separation.
|
||
Do not use operator tokens or another agent supervision record.
|
||
|
||
Done 2026-10-21T22:15:21Z. `scripts/plan-survey.py` ran under grant
|
||
`token-claude-MASON-WP-0014-T04` (policies `default`, `ops-mason-survey`).
|
||
That was the one minted survey grant. It is not an operator or admin token.
|
||
|
||
Plan §2 records the exact path
|
||
`platform/workloads/reuse/reuse-surface/forgejo-source-read`
|
||
(`current_version=1`), policy `workload-kv-read-reuse-surface-runtime-eso`
|
||
(`read` on that data path), and Kubernetes role `reuse-surface-runtime-eso`
|
||
(SA `reuse-surface-eso`, namespace `reuse`, audience `openbao`). Decision:
|
||
the OpenBao delivery lane already matches. The writer policy does not cover
|
||
the path. Forgejo-owner Q1–Q3 are cited from `forge-owner-review-r2.json`.
|
||
The plan is `reviewed`, not approved by ops-mason.
|
||
|
||
## Bind owner CCR and executable inputs to founder decision
|
||
|
||
```task
|
||
id: MASON-WP-0013-T03
|
||
status: done
|
||
depends_on: [MASON-WP-0013-T02]
|
||
priority: high
|
||
state_hub_task_id: "99d605e6-865c-5518-bb8b-d7e1e1bbf5c4"
|
||
```
|
||
|
||
Platform allocates CCR and reviewed silent adapter; apps owns concrete rollout
|
||
and rollback artifacts including full fixed image, runtime-controlled allowlist
|
||
and reviewed migration of existing authenticated sources; reuse owns native fetch/public metadata validation;
|
||
warden owns pointer review. Obtain separate founder decision on exact credential
|
||
and live-change revision/digests. Existing disclosure consent cannot approve
|
||
repository-wide credential grant. Requires T02.
|
||
|
||
Done as a record of the already-resolved binding. ops-mason did not approve,
|
||
mint, or apply.
|
||
|
||
- Platform CCR-2026-0046. The executed CCR digest cited by platform evidence
|
||
is `23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02`.
|
||
- Founder decision `9833715e-a22a-45c0-ab6c-881f0f4f1a0e`, resolved
|
||
2026-10-15 by Bernd Worsch. It binds execution revision SHA256
|
||
`704a9c932202fc14456652ea4dfdb3acb8b1db0ab3bbf5fff50e92b2c517c380`.
|
||
- Disclosure-consent digest
|
||
`4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52` is a
|
||
different record.
|
||
|
||
## Verify the authorized owner build and routing handoff
|
||
|
||
```task
|
||
id: MASON-WP-0013-T04
|
||
status: done
|
||
depends_on: [MASON-WP-0013-T03]
|
||
priority: high
|
||
state_hub_task_id: "8125f98b-f87c-582f-af8c-f5e809caf50f"
|
||
```
|
||
|
||
After T03, founder/platform privileged path executes, ops-mason observes only
|
||
through scoped permitted metadata. Preserve outcome/rollback receipts, complete
|
||
native seven-index positive and least-privilege negative checks, propose draft
|
||
catalog route and hand 70-ID fresh audit evidence to CUST-WP-0081. Never publish
|
||
success before actual receipt or finish while unresolved lifecycle work is only
|
||
in prose.
|
||
|
||
Done as observation of the platform path plus this session's metadata
|
||
receipt. ops-mason did not re-execute the build and did not publish a new
|
||
success by logging in as the workload.
|
||
|
||
- Metadata, 2026-10-21T22:15:21Z, grant `token-claude-MASON-WP-0014-T04`:
|
||
path version 1, ESO policy read, role bound as in T02. Survey-token
|
||
capabilities: `deny` on the reader data path and on
|
||
`platform/data/workloads/reuse/reuse-surface/runtime-secrets`; `list, read`
|
||
on the reader metadata path. Writer policy
|
||
`workload-kv-read-reuse-surface-runtime` has no stanza for the reader path.
|
||
- Seven native indexes: custodian
|
||
`docs/assessments/netkingdom-2026-10-14/private-native-fetch-verification-r1.json`,
|
||
id `CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1`, `all_verified` true, seven
|
||
repositories, `checked_at` 2026-10-15T03:30:20.627885Z. No source body is
|
||
copied here.
|
||
- Seventy reviewed ids: custodian
|
||
`docs/assessments/netkingdom-2026-10-14/hosted-private-registration-verification-r1.json`,
|
||
`reviewed_present` 70, `all_reviewed_hosted_exactly_once` true,
|
||
`composed_at` 2026-10-15T03:31:48Z. That file is the CUST-WP-0081
|
||
evidence. This task cites it and does not copy the seventy ids.
|
||
- Outcome receipt: railiance-platform
|
||
`docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json`,
|
||
bootstrap attempt `bb2693a7640f00b4e401467e`. The preserved rollback
|
||
contract is the-custodian
|
||
`docs/assessments/netkingdom-2026-10-14/private-reader-execution-proposal-r1.json`
|
||
field `rollback`. Rollback was not run. The live rotation and revocation
|
||
record remains `RPF-WP-0058-T05`.
|
||
- Draft catalog route, not activated:
|
||
`builds/reuse-surface-private-source-reader/catalog-proposal.yaml`.
|
||
It is not in the ops-warden catalog.
|