coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Track manual seven-source reader rotation deadline

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
codex 2026-10-15 02:00:41 +02:00
parent 635daec6b4
commit cc3c7d883b
1 changed files with 51 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

60
workplans/RPF-WP-0058-reuse-private-source-reader.md
View file

@ -17,9 +17,12 @@ state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
Custody/Q1 work under platform INTENT.md: dependable shared secret custody and
stable delivery with reviewed, delegated apply and revocation. Founder metadata
consent is recorded separately and grants no credential or live rollout authority.
Preparation occurs in isolated clone; no own supervision record means supervised
preparation only. IDs CCR-2026-0046 and RPF-WP-0058 are provisional until integration
rechecks the authoritative owner's latest allocation.
Preparation began in an isolated clone; no own supervision record means supervised
preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in
the authoritative platform source: restricted-reader preparation at
6e8955fcd09b278a6f16c14beffd076b72d10c95 and attended-runner preparation at
635daec6b4265ccbd066b96b53228919ac4cbd79. Both exact commits were verified on
Forge main and the State Hub primary/railiance01 projection.
## Prepare bounded custody change
@ -43,12 +46,18 @@ priority: high
state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
```
Platform prepared-review covers own custody artifacts. Forge, apps and consumer
owners independently review their scopes; their reviews remain pending. Founder
credential provisioning approval must bind exact artifact hashes and confirmed
ESO claims. No approval inferred from metadata disclosure. CCR stays proposed.
Current consumer image cannot receive this credential: full authenticated
redirect/HTTPS plus exact source URL allowlist patch and runtime config required.
Independent preparation reviews are recorded within their owner scopes:
platform custody and attended-runner R3; Forge restricted-reader R2 and
attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
apps release contract R2. These approve preparation/integration, not live action.
Founder credential provisioning and rollout decisions remain pending and must
bind exact artifacts and actual installed-role proof. No approval is inferred
from metadata disclosure. CCR remains proposed and its claims unconfirmed.
The published hardened image digest is
sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
actual deployment of that reviewed image plus the exact URL allowlist and native
verification remain mandatory before reader delivery. The existing vulnerable
runtime cannot receive this credential.
## Execute and verify restricted reader custody
@ -101,3 +110,36 @@ SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
Forty-five targeted reader tests passed (17 attended-runner boundary cases).
The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.
## Rotate or revoke dedicated seven-source reader within 90 days
```task
id: RPF-WP-0058-T05
status: wait
priority: high
due_date: "2027-01-13"
```
Manual platform-owned maintenance for Forgejo identity `reuse-surface-source`,
team `reuse-surface-source-readers`, its exact named seven-repository PAT and
OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
`FORGEJO_SOURCE_TOKEN`. Forgejo PATs do not expire automatically; this live task
is a human-attended rotation/revocation obligation, not an expiry mechanism or
scheduled automation.
The recorded date is provisional operational planning: 2027-01-13 is 90 days
after an assumed activation on 2026-10-15, and no activation has occurred.
Before delivering the credential, record the actual activation receipt/date,
reset this task's due date to that actual date plus 90 days, and retain the
owner/due-date binding in the activation receipt. If the actual deadline cannot
be bound, do not activate delivery.
At maintenance time prepare a separately approved bounded rotation/CAS plan,
including expected existing KV version, sibling preservation, exact dedicated
PAT identity, predecessor retention/cutover and native verification. Alternatively
use the separately approved exact-token recovery helper for Basic-auth revocation
with process-memory password and verified token inventory absence. Preserve the
shared runtime writer/webhook fields and public registrations. Never remint or
recover orphan/ambiguous requests automatically; reconcile authoritative state
before any new approved action. No rotation/revocation is executed by this record.