railiance-platform/docs/proposals/2026-10-15-reuse-private-reader

Seven private-source reader preparation

This bundle is prepared under platform's INTENT custody/Q1 remit. Nothing here records founder credential approval or another owner's review. The existing all-repository core-hub provisioner is precedent only and is never executed.

The exact bounded command, after approved CCR, independent reviews and binding confirmation, is:

warden access openbao-platform-admin-login --exec -- python3 scripts/provision-reuse-surface-forgejo-source.py --approval /absolute/path/approved-artifact-receipt.json --receipt /absolute/path/durable-0600-receipt.jsonl

An approval receipt must contain ccr_id: CCR-2026-0046, decision: approved, nonempty supervisor and decision_ref, and approved_artifacts mapping exactly these four relative paths to SHA256 digests of their approved bytes:

• credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml
• scripts/provision-reuse-surface-forgejo-source.py
• docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json
• openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl

CCR itself must be approved; preparation hashes do not satisfy that gate. This local check binds revisions and relies on attended platform lane/supervisor custody for authenticity; it is not a signed approval authority or an autopilot grant. Metadata apply is separately governed by existing credential-change CLI. Bootstrap never applies policy or changes cluster delivery.

apps-externalsecret-data-item.draft.yaml is a proposed insertion for apps owner, not a deployable manifest or an apps review. Existing ESO role reads only one new exact data path; caller writer policy is unchanged. Claim confirmation remains false until live owner survey. Consumer delivery must wait for the FULL reviewed image fixing redirects/HTTPS and runtime-controlled exact source URL allowlist, with fourteen consented pinned URLs in REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST.

Failure recovery: inspect sanitized journal and authoritative identity/team/PAT/ KV state quietly. A missing observation is not proof a request did not apply. The script refuses orphan PAT/KV state rather than reminting. Revoke only an identified dedicated PAT through Forgejo owner's attended recovery; if mint response lost, locate its exact recorded attempt-name prefix before revocation. Never delete unrelated token or shared runtime Secret. Rotation/recovery of an existing KV version requires a separately scoped CAS update plan; this create-only bootstrap does not overwrite or automatically rollback ambiguous writes.

Known execution gates: provisional IDs must be rechecked against current primary; Forgejo owner must confirm the API contracts (team organization username, complete sudo user inventory and token_last_eight metadata) on the deployed server; missing or differing metadata fails closed. Excluded-private rapp-core-hub must still be private. Native verification is a separate consumer-owned proof, not this API bootstrap's index-only custody check. New reader provisioning/production approval, apps config delta, fixed-image digest, live ESO survey and final70 audit all pending.

Revision2 refines the same CCR after a confirmed server-capped pagination defect. R1 patch and failed review evidence remain retained; no new scored trial is claimed. All list requests now continue until an observed empty page, reject duplicate IDs, and reconcile supplied total counts. Forgejo v11.0.3 source confirms user/repos includes effective direct/team grants. Stable ID sort is requested for that list. Version compatibility and live proof still precede apply.

Forgejo11.0.3 token DELETE requires Basic authentication, unlike token inventory GET. Admin PAT/Sudo alone is not a valid recovery implementation. The separate reviewed recovery must reset only this dedicated user password to fresh process-memory bytes, Basic-auth DELETE only the reviewed token ID, and verify absence. Recovery helper approval and manual rotation due-date task remain activation gates; no deployed quarterly expiry enforcement is claimed.

The separately reviewed executable credential rollback is:

warden access openbao-platform-admin-login --exec -- python3 scripts/revoke-reuse-surface-forgejo-source.py --approval /absolute/path/approved-exact-token-recovery.json --receipt /absolute/path/durable-0600-recovery.jsonl

Its independent approval record names action: revoke_exact_pat, the CCR, decision: approved, supervisor and decision_ref, target: {id: <reviewed id>, name: <exact recorded attempt name>}, and SHA256s in approved_artifacts for exactly recovery helper, bootstrap helper, CCR and bootstrap contract. This receipt also relies on attended supervisor custody; it is not signed authority. Different inventory stops before password mutation. Password stays in memory; DELETE uses Basic authorization captured only by the quiet client. Uncertain DELETE is followed only by read-only absence reconciliation, never another DELETE or mint. KV is deliberately preserved, so rotation needs its separate CAS plan. Credential rollback and apps delivery cleanup have independent receipts.