---
id: RPF-WP-0058
type: workplan
title: Prepare the exact seven private-source reader for reuse-surface
domain: financials
repo: railiance-platform
status: active
owner: codex
topic_slug: platform
created: '2026-10-15'
updated: '2026-10-15'
flavor: implementation
depends_on: []
state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
---

Custody/Q1 work under platform INTENT.md: dependable shared secret custody and
stable delivery with reviewed, delegated apply and revocation. Founder metadata
consent is recorded separately and grants no credential or live rollout authority.
Preparation began in an isolated clone; no own supervision record means supervised
preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in
the authoritative platform source: restricted-reader preparation at
6e8955fcd09b278a6f16c14beffd076b72d10c95 and attended-runner preparation at
635daec6b4265ccbd066b96b53228919ac4cbd79. Both exact commits were verified on
Forge main and the State Hub primary/railiance01 projection.

## Prepare bounded custody change

```task
id: RPF-WP-0058-T01
status: done
priority: high
state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"
```

Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded
provisioner, tests and exact ESO policy delta. Preparation itself performed no live action; the separately founder-attended
credential execution is now verified in T03 and its dated custody evidence.

## Independent owner review and founder disposition

```task
id: RPF-WP-0058-T02
status: done
priority: high
state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
```

Independent preparation reviews are recorded within their owner scopes:
platform custody and attended-runner R3; Forge restricted-reader R2 and
attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
apps release contract R2. These approve preparation/integration, not live action.
Founder execution decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e is resolved;
the approved exact credential revision executed through the attended owner lane.
Installed-role proof preceded conditional state transition, and CCR is approved
with confirmed claims at the exact prebound SHA256 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
This authority is separate from the earlier metadata disclosure consent.
The published hardened image digest is
sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
actual deployment of that reviewed image plus the exact URL allowlist and native
verification remain mandatory before reader delivery. The existing vulnerable
runtime cannot receive this credential.

## Execute and verify restricted reader custody

```task
id: RPF-WP-0058-T03
status: done
priority: high
state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"
```

After review and disposition, attended platform lane executes silent bootstrap.
Read-only preflight checks all seven private repos, restricted non-admin private
user, exact code-read team flags, no unrelated members/teams/private grants and
PAT/KV drift. Mutation intent and observed/ambiguous outcome are fsynced. No
uncertain mint is retried. CAS=0 never overwrites existing KV. Noop still verifies
PAT metadata binding, all seven pinned index digests and excluded-private/admin/
Actions denial. Raw provider output and credentials remain suppressed.

## Owner delivery and hosted completion

```task
id: RPF-WP-0058-T04
status: done
priority: high
state_hub_task_id: "9c483fd9-68a5-56b0-813d-c965a11b60d2"
```

Apps owner integrates proposed data item and exact fourteen approved URL config,
performs approved fixed-image rollout after CPU/PVC preflight and safe diff/dryrun.
Confirm existing ESO SA reuse/reuse-surface-eso, role, audience and namespace
condition from live metadata. Consumer owner native verification precedes private
registration; Custodian final fresh hosted audit must prove all70 exactly once.
Removing reader grants and delivery must preserve shared writer/webhook fields.

Completed and verified 2026-10-15. The actual hardened phase-B runtime was Ready
on image sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
with reader key present and the exact allowlist verified. Native authenticated
fetch at03:30:20Z verified all seven pinned index hashes and seven entry hashes
without cache. All seven private registrations were applied and fully read back.
Forced-fresh hosted composition at03:31:48Z proves all70 reviewed IDs exactly
once, correct source repository, no missing/duplicate IDs and no federation
warning. Scoped writer attempt 8f23bb90-aef9-405d-81b6-bf550400dd93 ended with
Warden0 and confirmed revocation.

Authoritative external evidence is published in the-custodian commit
e5aaa0db51edc4c9f935d03ab58808b86e340823, under
`docs/assessments/netkingdom-2026-10-14/`: `phase-b-runtime-verification-r1.json`,
`private-native-fetch-verification-r1.json` and
`hosted-private-registration-verification-r1.json`. Their hashes and checked
results are retained locally in
`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json`.
The root architecture/reuse goal is closed; root residual CUST-IN-0018 is live
separately. This platform workplan remains active solely for the existing manual
maintenance task T05, which stays wait with the actual Jan13 deadline. No rotation,
reprovisioning, new testing or live change is performed by this closeout.


Revision2 of the same CCR preserves R1 capped-page failure and the independently
corrected preliminary owned-only endpoint concern. Twenty bounded pages until
empty, duplicate IDs and supplied total-count consistency prevent silent short
page acceptance. No live complete-grant proof is claimed by these mocks.


Attended execution preparation R3 was followed by actual founder execution.
T03 is now done: policy attempt 93578ba93d6153fdb07c65db ended successfully
at 2026-10-15T03:06:13.283133Z; bootstrap attempt bb2693a7640f00b4e401467e
ended provisioned/verified with delivery pending at 03:06:12.816932Z.
The quiet owner runner captures hash-verified policy bytes for stdin, preserves
the existing ESO role, and verifies the actual immutable role/desired ACL before
and after bootstrap, including idempotent runs. A conditional CCR candidate binds
only approved/confirmed state transitions; these fields are not observed facts
until actual founder disposition and installed-role proof satisfy the rule.
Independent Forge preparation review R3 approved the exact runner; its receipt
SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
Forty-five targeted reader tests passed (17 attended-runner boundary cases).
The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
OpenBao/Forgejo routes. Actual silent founder execution verified exact seven-source
reader scope, created PAT metadata ID72/team5, and stored the reader at its separate
KV path. Credentials stayed inside the reviewed process; no value was printed.
Warden audits at03:06:13Z report outcome ok/exit0, including session revocation
and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json.


## Rotate or revoke dedicated seven-source reader within 90 days

```task
id: RPF-WP-0058-T05
status: wait
priority: high
due_date: "2027-01-13"
state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c"
```

Manual platform-owned maintenance for Forgejo identity `reuse-surface-source`,
team `reuse-surface-source-readers`, its exact named seven-repository PAT and
OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
`FORGEJO_SOURCE_TOKEN`. Forgejo PATs do not expire automatically; this live task
is a human-attended rotation/revocation obligation, not an expiry mechanism or
scheduled automation.

The deadline is now bound to actual verified custody activation, not an assumed
date: 2026-10-15T03:06:09.579844+00:00. The manual deadline is exactly
2027-01-13T03:06:09.579844+00:00 (task due_date 2027-01-13), actual activation plus 90 days.
Activation proof is bootstrap attempt bb2693a7640f00b4e401467e, verified kv_create;
receipt SHA256 f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171.
The owner/task binding is RPF-WP-0058-T05, UUID
f0780e75-b0bd-5bf5-b926-c8413abb885c, and is retained in the dated custody receipt.
Source and indexed task description must carry this actual date before delivery.
The structured Hub due_date cache remains a documented limitation; no automatic
reminder or server-side expiry is claimed.

At maintenance time prepare a separately approved bounded rotation/CAS plan,
including expected existing KV version, sibling preservation, exact dedicated
PAT identity, predecessor retention/cutover and native verification. Alternatively
use the separately approved exact-token recovery helper for Basic-auth revocation
with process-memory password and verified token inventory absence. Preserve the
shared runtime writer/webhook fields and public registrations. Never remint or
recover orphan/ambiguous requests automatically; reconcile authoritative state
before any new approved action. No rotation/revocation is executed by this record.