railiance-platform/workplans/RPF-WP-0058-reuse-private-source-reader.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
RPF-WP-0058	workplan	Prepare the exact seven private-source reader for reuse-surface	financials	railiance-platform	proposed	codex	platform	2026-10-15	2026-10-15	implementation		b55a8aec-7457-563b-990b-4a55ca04d2f6

Custody/Q1 work under platform INTENT.md: dependable shared secret custody and stable delivery with reviewed, delegated apply and revocation. Founder metadata consent is recorded separately and grants no credential or live rollout authority. Preparation began in an isolated clone; no own supervision record means supervised preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in the authoritative platform source: restricted-reader preparation at 6e8955fcd0 and attended-runner preparation at 635daec6b4. Both exact commits were verified on Forge main and the State Hub primary/railiance01 projection.

Prepare bounded custody change

id: RPF-WP-0058-T01
status: done
priority: high
state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"

Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded provisioner, tests and exact ESO policy delta. No provisioner invocation against live service, token read, policy apply, or cluster change has occurred.

Independent owner review and founder disposition

id: RPF-WP-0058-T02
status: wait
priority: high
state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"

Independent preparation reviews are recorded within their owner scopes: platform custody and attended-runner R3; Forge restricted-reader R2 and attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer; apps release contract R2. These approve preparation/integration, not live action. Founder credential provisioning and rollout decisions remain pending and must bind exact artifacts and actual installed-role proof. No approval is inferred from metadata disclosure. CCR remains proposed and its claims unconfirmed. The published hardened image digest is sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0; actual deployment of that reviewed image plus the exact URL allowlist and native verification remain mandatory before reader delivery. The existing vulnerable runtime cannot receive this credential.

Execute and verify restricted reader custody

id: RPF-WP-0058-T03
status: wait
priority: high
state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"

After review and disposition, attended platform lane executes silent bootstrap. Read-only preflight checks all seven private repos, restricted non-admin private user, exact code-read team flags, no unrelated members/teams/private grants and PAT/KV drift. Mutation intent and observed/ambiguous outcome are fsynced. No uncertain mint is retried. CAS=0 never overwrites existing KV. Noop still verifies PAT metadata binding, all seven pinned index digests and excluded-private/admin/ Actions denial. Raw provider output and credentials remain suppressed.

Owner delivery and hosted completion

id: RPF-WP-0058-T04
status: wait
priority: high
state_hub_task_id: "9c483fd9-68a5-56b0-813d-c965a11b60d2"

Apps owner integrates proposed data item and exact fourteen approved URL config, performs approved fixed-image rollout after CPU/PVC preflight and safe diff/dryrun. Confirm existing ESO SA reuse/reuse-surface-eso, role, audience and namespace condition from live metadata. Consumer owner native verification precedes private registration; Custodian final fresh hosted audit must prove all70 exactly once. Removing reader grants and delivery must preserve shared writer/webhook fields.

Revision2 of the same CCR preserves R1 capped-page failure and the independently corrected preliminary owned-only endpoint concern. Twenty bounded pages until empty, duplicate IDs and supplied total-count consistency prevent silent short page acceptance. No live complete-grant proof is claimed by these mocks.

Attended execution preparation R3 is complete, while T03 stays wait because no founder credential decision, login, installed-claim proof or live write has run. The quiet owner runner captures hash-verified policy bytes for stdin, preserves the existing ESO role, and verifies the actual immutable role/desired ACL before and after bootstrap, including idempotent runs. A conditional CCR candidate binds only approved/confirmed state transitions; these fields are not observed facts until actual founder disposition and installed-role proof satisfy the rule. Independent Forge preparation review R3 approved the exact runner; its receipt SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040. Forty-five targeted reader tests passed (17 attended-runner boundary cases). The handoff binds the owner-prepared task-local WSL opener and existing sanctioned OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.

Rotate or revoke dedicated seven-source reader within 90 days

id: RPF-WP-0058-T05
status: wait
priority: high
due_date: "2027-01-13"
state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c"

Manual platform-owned maintenance for Forgejo identity reuse-surface-source, team reuse-surface-source-readers, its exact named seven-repository PAT and OpenBao KV platform/workloads/reuse/reuse-surface/forgejo-source-read, field FORGEJO_SOURCE_TOKEN. Forgejo PATs do not expire automatically; this live task is a human-attended rotation/revocation obligation, not an expiry mechanism or scheduled automation.

The recorded date is provisional operational planning: 2027-01-13 is 90 days after an assumed activation on 2026-10-15, and no activation has occurred. Before delivering the credential, record the actual activation receipt/date, reset this task's due date to that actual date plus 90 days, and retain the owner/due-date binding in the activation receipt. If the actual deadline cannot be bound, do not activate delivery.

At maintenance time prepare a separately approved bounded rotation/CAS plan, including expected existing KV version, sibling preservation, exact dedicated PAT identity, predecessor retention/cutover and native verification. Alternatively use the separately approved exact-token recovery helper for Basic-auth revocation with process-memory password and verified token inventory absence. Preserve the shared runtime writer/webhook fields and public registrations. Never remint or recover orphan/ambiguous requests automatically; reconcile authoritative state before any new approved action. No rotation/revocation is executed by this record.