railiance-forge/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh.diff

--- forge-owner-review-r2-before-recovery.json
+++ forge-owner-review-r2.json
@@ -1,26 +1,29 @@
 {
   "reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
   "decision": "approved",
-  "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: provider owns target grant contract, dependable stable handoffs, and evidence reflecting current Forgejo runtime. Approve CCR-2026-0046 revision2 bounded design/preparation on exact artifact hashes below. Complete pagination defect is corrected and the versioned model proves effective /user/repos semantics. This is an owner review, not founder authorization or live target proof. Retain all declared pre-activation gates, especially bounded Basic-auth recovery helper/due-date task and separately reviewed consumer image+allowlist+apps rollout; no execution approval is inferred.",
+  "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.",
   "reviewed_revision": 2,
-  "reviewed_at": "2026-10-14T22:53:44.918962+00:00",
+  "reviewed_at": "2026-10-14T23:08:34.771501+00:00",
   "work_item": "FORGE-WP-0007-T02",
   "reviewed_artifacts": {
-    "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "1488d4c5928bf0af2735792855194c8c0d68cc738f1ae5c8a0fba947cd176a1d",
+    "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
     "scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
-    "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "bd235d93cdb1b4f432ae4b2755e0cb80da93a21f7feab115b2a61ea931d656f9",
+    "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
     "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
-    "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b"
+    "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b",
+    "scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
+    "tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d"
   },
   "validation": {
-    "targeted_unittest": "23 passed, independently rerun",
+    "targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)",
     "independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible",
     "fixture_receipt": "pagination-independent-fixture-results.json",
     "static_target_contract": "target-api-contract-r1.json",
     "live_credentials_used": false,
     "live_mutations": false,
     "live_effective_grants_verified": false,
-    "live_native_fetch_verified": false
+    "live_native_fetch_verified": false,
+    "recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token."
   },
   "r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success",
   "contract_findings_resolved": [
@@ -30,7 +33,7 @@
     },
     {
       "id": "FORGE-CUST81-F02",
-      "resolution": "CCR explicitly states manual quarterly policy lacks expiry enforcement and requires due-date owner task/receipt plus executable Basic recovery helper before activation. Deactivation now states exact-token reset+Basic deletion compatible with API; helper/approval remains gate, not claimed complete."
+      "resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation."
     },
     {
       "id": "FORGE-CUST81-F03",
@@ -47,7 +50,7 @@
   "execution_boundary": [
     "Founder exact revision disposition and independent otherowner reviews remain required.",
     "Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.",
-    "Executable exact-token Basic recovery helper plus due-date task/receipt required before activation; separately reviewed rotationCAS update before rotation.",
+    "Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.",
     "No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.",
     "Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven."
   ]