{
  "id": "CCR-2026-0046-BOOTSTRAP-R2",
  "revision": 2,
  "sources": [
    {
      "repo": "rapp-openbao",
      "capability_ids": [
        "capability.railiance.openbao-package"
      ],
      "consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
      "index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-policy-nexus",
      "capability_ids": [
        "capability.railiance.policy-publication-package"
      ],
      "consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
      "index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-postgres",
      "capability_ids": [
        "capability.railiance.postgres-isolation-recovery"
      ],
      "consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
      "index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-sbom-nexus",
      "capability_ids": [
        "capability.railiance.sbom-runtime-package"
      ],
      "consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
      "index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-telemetry",
      "capability_ids": [
        "capability.railiance.telemetry-package"
      ],
      "consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
      "index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-tenant-engine",
      "capability_ids": [
        "capability.railiance.tenant-engine-package"
      ],
      "consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
      "index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    },
    {
      "repo": "rapp-user-engine",
      "capability_ids": [
        "capability.railiance.user-engine-package"
      ],
      "consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
      "native_raw_url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
      "index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
    }
  ],
  "negative_private_probe": "rapp-core-hub",
  "identity": {
    "forgejo_user": "reuse-surface-source",
    "forgejo_org": "coulomb",
    "forgejo_team": "reuse-surface-source-readers",
    "restricted": true,
    "is_admin": false,
    "visibility": "private",
    "password": "random value retained only in attended process memory; never stored in evidence",
    "team_permission": "read",
    "includes_all_repositories": false,
    "can_create_org_repo": false,
    "units_map": {
      "repo.code": "read",
      "repo.actions": "none",
      "repo.packages": "none",
      "repo.issues": "none",
      "repo.ext_issues": "none",
      "repo.wiki": "none",
      "repo.pulls": "none",
      "repo.releases": "none",
      "repo.projects": "none",
      "repo.ext_wiki": "none"
    },
    "team_repositories": [
      "coulomb/rapp-openbao",
      "coulomb/rapp-policy-nexus",
      "coulomb/rapp-postgres",
      "coulomb/rapp-sbom-nexus",
      "coulomb/rapp-telemetry",
      "coulomb/rapp-tenant-engine",
      "coulomb/rapp-user-engine"
    ],
    "token_scopes": [
      "read:repository"
    ],
    "token_name_prefix": "reuse-surface-source-read-",
    "reuse_other_workload_token": false,
    "fail_on_differing_existing_identity_or_team": true,
    "enforcement": "Verify complete team membership and all effective user repository grants; no other team, collaborator or organisation grants may provide extra private read access."
  },
  "delivery": {
    "kv_mount": "platform",
    "kv_path": "platform/workloads/reuse/reuse-surface/forgejo-source-read",
    "field": "FORGEJO_SOURCE_TOKEN",
    "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
    "eso_role": "reuse-surface-runtime-eso",
    "eso_identity": "reuse/reuse-surface-eso",
    "audience": "openbao",
    "ttl": "15m",
    "cluster_secret_store": "openbao-reuse",
    "store_namespace_condition": [
      "reuse"
    ],
    "external_secret": "reuse/reuse-surface-runtime",
    "target_secret": "reuse/reuse-surface-env",
    "existing_consumption": "Deployment reuse/reuse-surface envFrom secretRef reuse-surface-env; environment variable available only after controlled rollout. Existing image and resource requests retained.",
    "policy_delta": {
      "file": "railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl",
      "add_exact_stanza": "path \"platform/data/workloads/reuse/reuse-surface/forgejo-source-read\" { capabilities = [\"read\"] }",
      "retain_existing_paths": true,
      "do_not_change": "Caller-facing workload-kv-read-reuse-surface-runtime policy or writer OIDC role; those remain unable to read this new path."
    },
    "external_secret_data_delta": {
      "secretKey": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
      "remoteRef": {
        "key": "workloads/reuse/reuse-surface/forgejo-source-read",
        "property": "FORGEJO_SOURCE_TOKEN"
      }
    },
    "delivery_design_reason": "Uses the existing namespace-limited ESO store and identity plus the existing envFrom interface. Separate new KV path keeps scoped writer callers from also acquiring private-source access. No new static ESO token or new store is needed.",
    "native_source_auth": {
      "auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN",
      "auth_header": "Authorization",
      "header_behavior": "Native federation _auth_headers prefixes a bare token with Bearer; owner must verify accepted Forgejo raw API route with this actual native implementation."
    },
    "rollout_image": "Pending full consumer fix reviewed image digest; same-image rollout of current consumer is prohibited."
  },
  "consumer_gate": "Reader must not be delivered until reuse-surface owner supplies verified image digest containing BOTH authenticated redirect rejection/HTTPS enforcement AND runtime-controlled exact URL allowlist checked before credential lookup. Apps owner must deploy REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST mapping the reader environment to exactly fourteen consented pinned index/entry URLs and inventory existing authenticated sources for migration. Current image and redirect-only fix are not approved. Native owner helper must verify all seven pinned indexes and entry hashes after rollout.",
  "approval": "No approval recorded. External supervisor approval receipt must bind exactly CCR, script, contract and ESO policy bytes; CCR must be approved. Additional forge/apps/reuse owner reviews and rollout approval remain required.",
  "metadata_consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
  "preparation_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
  "recovery": "On ambiguous mutation stop. Reconcile complete Forgejo identity/team/repository/PAT metadata and exact KV field through suppressed helper before retry. Token without KV or reverse refuses automatically; revoke identified dedicated PAT through attended Forgejo owner recovery before retry. Never remint on observation timeout. KV CAS=0 prevents overwrites. Do not delete shared runtime Secret.",
  "consumer_preparation": {
    "owner": "reuse-surface",
    "allowlist_artifact": "/tmp/cust81-reuse-reader-owner/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json",
    "allowlist_sha256": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
    "federation_py_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
    "integration_patch_sha256": "da9634481ce80658dfce815d3539ba023234938dc76163dfd93d7677be95ed51",
    "review_state": "changes_requested for current consumer; preparation patch alone is not deployed-image evidence"
  },
  "pagination_contract": "All list endpoints page until observed empty, max20pages; reject duplicate/missing IDs, reconcile X-Total-Count when supplied, reject changed/mismatched counts and bound exhaustion. Never infer completion from requestedlimit100 versus server-capped50.",
  "effective_grants_contract": "Forgejo11.0.3 /user/repos?order_by=id with Sudo reader uses OwnerID=reader and Collaborate=None; SearchRepositoryCondition defaults collaborations true and includes direct UserAccessRepoCond plus UserOrgTeamRepoCond. It is not owned-only despite Swagger summary. Independent deployed-version compatibility and live inventory proof pending.",
  "r1_review_failure": {
    "patch_sha256": "a94547b419b87e38dc178b02d1d31af61cc11a71e3734052a190167668db8e30",
    "confirmed_defect": "R1 len(batch)<100 stopped after server-capped50, omitting later grants",
    "corrected_preliminary_claim": "Owned-only endpoint claim disproved by Forgejo11.0.3 model defaults; no endpoint replacement based on false premise",
    "same_proposal": "CCR-2026-0046; revision2 is refinement, not a new successful trial"
  },
  "api_source_evidence": [
    {
      "upstream_path": "models/repo/repo/list.go",
      "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/repo/repo/list.go",
      "sha256": "bb7833badf0fe7f6a2c800c2f301cb846b5968ce3f9e9bd29c3f1677db42acd9",
      "local_cache": "/tmp/cust81-forge-contract-source/source-models_repo_repo_list.go"
    },
    {
      "upstream_path": "routers/api/v1/utils/page.go",
      "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/utils/page.go",
      "sha256": "1d286f60b5571513fb5a26a9243c22eae65f05d7be32dfe5d0f0b15d20550954",
      "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_utils_page.go"
    },
    {
      "upstream_path": "services/convert/utils.go",
      "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/utils.go",
      "sha256": "2689ffc579ea1df69457fbe84410fef101ae4a9580f0e56dcc3113a2988626b3",
      "local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_utils.go"
    },
    {
      "upstream_path": "modules/setting/api.go",
      "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/setting/api.go",
      "sha256": "1f640ed884afaa6454c4bf427eccd2d6bb9a092fe37ac1aedfdc5eb85de4f7ba",
      "local_cache": "/tmp/cust81-forge-contract-source/source-modules_setting_api.go"
    },
    {
      "upstream_path": "routers/api/v1/user/repo.go",
      "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/repo.go",
      "sha256": "adee62e6671aadd95b5013a64dbb690f2d81a0b9b4de0350c70b4153074ca6ec",
      "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_repo.go"
    }
  ],
  "rollback_helper": {
    "path": "scripts/revoke-reuse-surface-forgejo-source.py",
    "scope": "Separate approval binds exact PAT id/name and artifact bytes; Basic-auth revocation after dedicated-user memory-only password reset. Preserve KV/sharedruntime; no remint. Reconcile uncertain DELETE by inventory absence."
  }
}