352aeea5e9
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
146 lines
6.6 KiB
Markdown
146 lines
6.6 KiB
Markdown
---
|
|
id: RPF-WP-0058
|
|
type: workplan
|
|
title: Prepare the exact seven private-source reader for reuse-surface
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: proposed
|
|
owner: codex
|
|
topic_slug: platform
|
|
created: '2026-10-15'
|
|
updated: '2026-10-15'
|
|
flavor: implementation
|
|
depends_on: []
|
|
state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
|
|
---
|
|
|
|
Custody/Q1 work under platform INTENT.md: dependable shared secret custody and
|
|
stable delivery with reviewed, delegated apply and revocation. Founder metadata
|
|
consent is recorded separately and grants no credential or live rollout authority.
|
|
Preparation began in an isolated clone; no own supervision record means supervised
|
|
preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in
|
|
the authoritative platform source: restricted-reader preparation at
|
|
6e8955fcd09b278a6f16c14beffd076b72d10c95 and attended-runner preparation at
|
|
635daec6b4265ccbd066b96b53228919ac4cbd79. Both exact commits were verified on
|
|
Forge main and the State Hub primary/railiance01 projection.
|
|
|
|
## Prepare bounded custody change
|
|
|
|
```task
|
|
id: RPF-WP-0058-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"
|
|
```
|
|
|
|
Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded
|
|
provisioner, tests and exact ESO policy delta. No provisioner invocation against
|
|
live service, token read, policy apply, or cluster change has occurred.
|
|
|
|
## Independent owner review and founder disposition
|
|
|
|
```task
|
|
id: RPF-WP-0058-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
|
|
```
|
|
|
|
Independent preparation reviews are recorded within their owner scopes:
|
|
platform custody and attended-runner R3; Forge restricted-reader R2 and
|
|
attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
|
|
apps release contract R2. These approve preparation/integration, not live action.
|
|
Founder credential provisioning and rollout decisions remain pending and must
|
|
bind exact artifacts and actual installed-role proof. No approval is inferred
|
|
from metadata disclosure. CCR remains proposed and its claims unconfirmed.
|
|
The published hardened image digest is
|
|
sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
|
|
actual deployment of that reviewed image plus the exact URL allowlist and native
|
|
verification remain mandatory before reader delivery. The existing vulnerable
|
|
runtime cannot receive this credential.
|
|
|
|
## Execute and verify restricted reader custody
|
|
|
|
```task
|
|
id: RPF-WP-0058-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"
|
|
```
|
|
|
|
After review and disposition, attended platform lane executes silent bootstrap.
|
|
Read-only preflight checks all seven private repos, restricted non-admin private
|
|
user, exact code-read team flags, no unrelated members/teams/private grants and
|
|
PAT/KV drift. Mutation intent and observed/ambiguous outcome are fsynced. No
|
|
uncertain mint is retried. CAS=0 never overwrites existing KV. Noop still verifies
|
|
PAT metadata binding, all seven pinned index digests and excluded-private/admin/
|
|
Actions denial. Raw provider output and credentials remain suppressed.
|
|
|
|
## Owner delivery and hosted completion
|
|
|
|
```task
|
|
id: RPF-WP-0058-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "9c483fd9-68a5-56b0-813d-c965a11b60d2"
|
|
```
|
|
|
|
Apps owner integrates proposed data item and exact fourteen approved URL config,
|
|
performs approved fixed-image rollout after CPU/PVC preflight and safe diff/dryrun.
|
|
Confirm existing ESO SA reuse/reuse-surface-eso, role, audience and namespace
|
|
condition from live metadata. Consumer owner native verification precedes private
|
|
registration; Custodian final fresh hosted audit must prove all70 exactly once.
|
|
Removing reader grants and delivery must preserve shared writer/webhook fields.
|
|
|
|
Revision2 of the same CCR preserves R1 capped-page failure and the independently
|
|
corrected preliminary owned-only endpoint concern. Twenty bounded pages until
|
|
empty, duplicate IDs and supplied total-count consistency prevent silent short
|
|
page acceptance. No live complete-grant proof is claimed by these mocks.
|
|
|
|
|
|
Attended execution preparation R3 is complete, while T03 stays `wait` because no
|
|
founder credential decision, login, installed-claim proof or live write has run.
|
|
The quiet owner runner captures hash-verified policy bytes for stdin, preserves
|
|
the existing ESO role, and verifies the actual immutable role/desired ACL before
|
|
and after bootstrap, including idempotent runs. A conditional CCR candidate binds
|
|
only approved/confirmed state transitions; these fields are not observed facts
|
|
until actual founder disposition and installed-role proof satisfy the rule.
|
|
Independent Forge preparation review R3 approved the exact runner; its receipt
|
|
SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
|
|
Forty-five targeted reader tests passed (17 attended-runner boundary cases).
|
|
The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
|
|
OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.
|
|
|
|
|
|
## Rotate or revoke dedicated seven-source reader within 90 days
|
|
|
|
```task
|
|
id: RPF-WP-0058-T05
|
|
status: wait
|
|
priority: high
|
|
due_date: "2027-01-13"
|
|
state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c"
|
|
```
|
|
|
|
Manual platform-owned maintenance for Forgejo identity `reuse-surface-source`,
|
|
team `reuse-surface-source-readers`, its exact named seven-repository PAT and
|
|
OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
|
|
`FORGEJO_SOURCE_TOKEN`. Forgejo PATs do not expire automatically; this live task
|
|
is a human-attended rotation/revocation obligation, not an expiry mechanism or
|
|
scheduled automation.
|
|
|
|
The recorded date is provisional operational planning: 2027-01-13 is 90 days
|
|
after an assumed activation on 2026-10-15, and no activation has occurred.
|
|
Before delivering the credential, record the actual activation receipt/date,
|
|
reset this task's due date to that actual date plus 90 days, and retain the
|
|
owner/due-date binding in the activation receipt. If the actual deadline cannot
|
|
be bound, do not activate delivery.
|
|
|
|
At maintenance time prepare a separately approved bounded rotation/CAS plan,
|
|
including expected existing KV version, sibling preservation, exact dedicated
|
|
PAT identity, predecessor retention/cutover and native verification. Alternatively
|
|
use the separately approved exact-token recovery helper for Basic-auth revocation
|
|
with process-memory password and verified token inventory absence. Preserve the
|
|
shared runtime writer/webhook fields and public registrations. Never remint or
|
|
recover orphan/ambiguous requests automatically; reconcile authoritative state
|
|
before any new approved action. No rotation/revocation is executed by this record.
|