Record verified seven-source reader custody and rotation deadline

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Reuse Surface exact seven private-source repository reader
-status: proposed
+status: approved
 created: '2026-10-15'
 updated: '2026-10-15'
 requester:
@@ -47,7 +47,7 @@ openbao:
       - reuse-surface-eso
       service_account_namespaces:
       - reuse
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
     policies:
     - workload-kv-read-reuse-surface-runtime-eso
     ttl: 15m

docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json

@@ -0,0 +1,36 @@
+{
+  "id": "RPF-WP-0058-CUSTODY-VERIFICATION-R1",
+  "ccr_id": "CCR-2026-0046",
+  "decision_ref": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e",
+  "decision_status": "resolved/made observed from primary State Hub",
+  "approval_receipt_sha256": "ce11b56faa51cb0912c6bdd228a10d0e5dec5a93f295410eaaf370399e7abd85",
+  "approved_executed_ccr_sha256": "23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02",
+  "policy_receipt_sha256": "01d417a09d547b88a792fbc00bcc1502f1235da2d666196632a71d7f1c11bdbd",
+  "policy_attempt": "93578ba93d6153fdb07c65db",
+  "policy_terminal_at": "2026-10-15T03:06:13.283133+00:00",
+  "policy_outcome": "policy_and_custody_verified_delivery_pending",
+  "bootstrap_receipt_sha256": "f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171",
+  "bootstrap_attempt": "bb2693a7640f00b4e401467e",
+  "bootstrap_terminal_at": "2026-10-15T03:06:12.816932+00:00",
+  "bootstrap_outcome": "provisioned_verified_delivery_pending",
+  "forgejo_identity": "reuse-surface-source",
+  "forgejo_team_id": 5,
+  "forgejo_pat_id": 72,
+  "token_scope": "read:repository",
+  "repository_scope": "Exactly seven approved private repositories, complete grant preflight and seven pinned index hashes verified by bounded bootstrap.",
+  "custody_activation_at": "2026-10-15T03:06:09.579844+00:00",
+  "manual_rotation_due_at": "2027-01-13T03:06:09.579844+00:00",
+  "manual_rotation_due_date": "2027-01-13",
+  "maintenance_task": "RPF-WP-0058-T05",
+  "maintenance_task_uuid": "f0780e75-b0bd-5bf5-b926-c8413abb885c",
+  "expiry_enforced_automatically": false,
+  "warden_terminal_audit": {
+    "access_audit_at": "2026-10-15T03:06:13.494014+00:00",
+    "unified_audit_at": "2026-10-15T03:06:13.495110+00:00",
+    "outcome": "ok",
+    "exit_code": 0,
+    "meaning": "Installed owner envelope confirms silent child success, self-revocation and helper cleanup; no token/helper was read."
+  },
+  "delivery_status": "pending_apps_phase_b_and_native_proof",
+  "no_reexecution_or_remint": true
+}

workplans/RPF-WP-0058-reuse-private-source-reader.md

@@ -4,7 +4,7 @@ type: workplan
 title: Prepare the exact seven private-source reader for reuse-surface
 domain: financials
 repo: railiance-platform
-status: proposed
+status: active
 owner: codex
 topic_slug: platform
 created: '2026-10-15'
@@ -34,14 +34,14 @@ state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"
 ```
 
 Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded
-provisioner, tests and exact ESO policy delta. No provisioner invocation against
+provisioner, tests and exact ESO policy delta. Preparation itself performed no live action; the separately founder-attended
-live service, token read, policy apply, or cluster change has occurred.
+credential execution is now verified in T03 and its dated custody evidence.
 
 ## Independent owner review and founder disposition
 
 ```task
 id: RPF-WP-0058-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
 ```
@@ -50,9 +50,11 @@ Independent preparation reviews are recorded within their owner scopes:
 platform custody and attended-runner R3; Forge restricted-reader R2 and
 attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
 apps release contract R2. These approve preparation/integration, not live action.
-Founder credential provisioning and rollout decisions remain pending and must
+Founder execution decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e is resolved;
-bind exact artifacts and actual installed-role proof. No approval is inferred
+the approved exact credential revision executed through the attended owner lane.
-from metadata disclosure. CCR remains proposed and its claims unconfirmed.
+Installed-role proof preceded conditional state transition, and CCR is approved
+with confirmed claims at the exact prebound SHA256 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
+This authority is separate from the earlier metadata disclosure consent.
 The published hardened image digest is
 sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
 actual deployment of that reviewed image plus the exact URL allowlist and native
@@ -63,7 +65,7 @@ runtime cannot receive this credential.
 
 ```task
 id: RPF-WP-0058-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"
 ```
@@ -98,8 +100,10 @@ empty, duplicate IDs and supplied total-count consistency prevent silent short
 page acceptance. No live complete-grant proof is claimed by these mocks.
 
 
-Attended execution preparation R3 is complete, while T03 stays `wait` because no
+Attended execution preparation R3 was followed by actual founder execution.
-founder credential decision, login, installed-claim proof or live write has run.
+T03 is now done: policy attempt 93578ba93d6153fdb07c65db ended successfully
+at 2026-10-15T03:06:13.283133Z; bootstrap attempt bb2693a7640f00b4e401467e
+ended provisioned/verified with delivery pending at 03:06:12.816932Z.
 The quiet owner runner captures hash-verified policy bytes for stdin, preserves
 the existing ESO role, and verifies the actual immutable role/desired ACL before
 and after bootstrap, including idempotent runs. A conditional CCR candidate binds
@@ -109,7 +113,11 @@ Independent Forge preparation review R3 approved the exact runner; its receipt
 SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
 Forty-five targeted reader tests passed (17 attended-runner boundary cases).
 The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
-OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.
+OpenBao/Forgejo routes. Actual silent founder execution verified exact seven-source
+reader scope, created PAT metadata ID72/team5, and stored the reader at its separate
+KV path. Credentials stayed inside the reviewed process; no value was printed.
+Warden audits at03:06:13Z report outcome ok/exit0, including session revocation
+and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json.
 
 
 ## Rotate or revoke dedicated seven-source reader within 90 days
@@ -129,12 +137,16 @@ OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
 is a human-attended rotation/revocation obligation, not an expiry mechanism or
 scheduled automation.
 
-The recorded date is provisional operational planning: 2027-01-13 is 90 days
+The deadline is now bound to actual verified custody activation, not an assumed
-after an assumed activation on 2026-10-15, and no activation has occurred.
+date: 2026-10-15T03:06:09.579844+00:00. The manual deadline is exactly
-Before delivering the credential, record the actual activation receipt/date,
+2027-01-13T03:06:09.579844+00:00 (task due_date 2027-01-13), actual activation plus 90 days.
-reset this task's due date to that actual date plus 90 days, and retain the
+Activation proof is bootstrap attempt bb2693a7640f00b4e401467e, verified kv_create;
-owner/due-date binding in the activation receipt. If the actual deadline cannot
+receipt SHA256 f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171.
-be bound, do not activate delivery.
+The owner/task binding is RPF-WP-0058-T05, UUID
+f0780e75-b0bd-5bf5-b926-c8413abb885c, and is retained in the dated custody receipt.
+Source and indexed task description must carry this actual date before delivery.
+The structured Hub due_date cache remains a documented limitation; no automatic
+reminder or server-side expiry is claimed.
 
 At maintenance time prepare a separately approved bounded rotation/CAS plan,
 including expected existing KV version, sibling preservation, exact dedicated