Record verified seven-source reader custody and rotation deadline

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

workplans/RPF-WP-0058-reuse-private-source-reader.md

@@ -4,7 +4,7 @@ type: workplan
 title: Prepare the exact seven private-source reader for reuse-surface
 domain: financials
 repo: railiance-platform
-status: proposed
+status: active
 owner: codex
 topic_slug: platform
 created: '2026-10-15'
@@ -34,14 +34,14 @@ state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"
 ```
 
 Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded
-provisioner, tests and exact ESO policy delta. No provisioner invocation against
-live service, token read, policy apply, or cluster change has occurred.
+provisioner, tests and exact ESO policy delta. Preparation itself performed no live action; the separately founder-attended
+credential execution is now verified in T03 and its dated custody evidence.
 
 ## Independent owner review and founder disposition
 
 ```task
 id: RPF-WP-0058-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
 ```
@@ -50,9 +50,11 @@ Independent preparation reviews are recorded within their owner scopes:
 platform custody and attended-runner R3; Forge restricted-reader R2 and
 attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
 apps release contract R2. These approve preparation/integration, not live action.
-Founder credential provisioning and rollout decisions remain pending and must
-bind exact artifacts and actual installed-role proof. No approval is inferred
-from metadata disclosure. CCR remains proposed and its claims unconfirmed.
+Founder execution decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e is resolved;
+the approved exact credential revision executed through the attended owner lane.
+Installed-role proof preceded conditional state transition, and CCR is approved
+with confirmed claims at the exact prebound SHA256 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
+This authority is separate from the earlier metadata disclosure consent.
 The published hardened image digest is
 sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
 actual deployment of that reviewed image plus the exact URL allowlist and native
@@ -63,7 +65,7 @@ runtime cannot receive this credential.
 
 ```task
 id: RPF-WP-0058-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"
 ```
@@ -98,8 +100,10 @@ empty, duplicate IDs and supplied total-count consistency prevent silent short
 page acceptance. No live complete-grant proof is claimed by these mocks.
 
 
-Attended execution preparation R3 is complete, while T03 stays `wait` because no
-founder credential decision, login, installed-claim proof or live write has run.
+Attended execution preparation R3 was followed by actual founder execution.
+T03 is now done: policy attempt 93578ba93d6153fdb07c65db ended successfully
+at 2026-10-15T03:06:13.283133Z; bootstrap attempt bb2693a7640f00b4e401467e
+ended provisioned/verified with delivery pending at 03:06:12.816932Z.
 The quiet owner runner captures hash-verified policy bytes for stdin, preserves
 the existing ESO role, and verifies the actual immutable role/desired ACL before
 and after bootstrap, including idempotent runs. A conditional CCR candidate binds
@@ -109,7 +113,11 @@ Independent Forge preparation review R3 approved the exact runner; its receipt
 SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
 Forty-five targeted reader tests passed (17 attended-runner boundary cases).
 The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
-OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.
+OpenBao/Forgejo routes. Actual silent founder execution verified exact seven-source
+reader scope, created PAT metadata ID72/team5, and stored the reader at its separate
+KV path. Credentials stayed inside the reviewed process; no value was printed.
+Warden audits at03:06:13Z report outcome ok/exit0, including session revocation
+and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json.
 
 
 ## Rotate or revoke dedicated seven-source reader within 90 days
@@ -129,12 +137,16 @@ OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
 is a human-attended rotation/revocation obligation, not an expiry mechanism or
 scheduled automation.
 
-The recorded date is provisional operational planning: 2027-01-13 is 90 days
-after an assumed activation on 2026-10-15, and no activation has occurred.
-Before delivering the credential, record the actual activation receipt/date,
-reset this task's due date to that actual date plus 90 days, and retain the
-owner/due-date binding in the activation receipt. If the actual deadline cannot
-be bound, do not activate delivery.
+The deadline is now bound to actual verified custody activation, not an assumed
+date: 2026-10-15T03:06:09.579844+00:00. The manual deadline is exactly
+2027-01-13T03:06:09.579844+00:00 (task due_date 2027-01-13), actual activation plus 90 days.
+Activation proof is bootstrap attempt bb2693a7640f00b4e401467e, verified kv_create;
+receipt SHA256 f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171.
+The owner/task binding is RPF-WP-0058-T05, UUID
+f0780e75-b0bd-5bf5-b926-c8413abb885c, and is retained in the dated custody receipt.
+Source and indexed task description must carry this actual date before delivery.
+The structured Hub due_date cache remains a documented limitation; no automatic
+reminder or server-side expiry is claimed.
 
 At maintenance time prepare a separately approved bounded rotation/CAS plan,
 including expected existing KV version, sibling preservation, exact dedicated