061d98b66e
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
181 lines
9 KiB
Markdown
181 lines
9 KiB
Markdown
---
|
|
id: RPF-WP-0058
|
|
type: workplan
|
|
title: Prepare the exact seven private-source reader for reuse-surface
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
owner: codex
|
|
topic_slug: platform
|
|
created: '2026-10-15'
|
|
updated: '2026-10-15'
|
|
flavor: implementation
|
|
depends_on: []
|
|
state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
|
|
---
|
|
|
|
Custody/Q1 work under platform INTENT.md: dependable shared secret custody and
|
|
stable delivery with reviewed, delegated apply and revocation. Founder metadata
|
|
consent is recorded separately and grants no credential or live rollout authority.
|
|
Preparation began in an isolated clone; no own supervision record means supervised
|
|
preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in
|
|
the authoritative platform source: restricted-reader preparation at
|
|
6e8955fcd09b278a6f16c14beffd076b72d10c95 and attended-runner preparation at
|
|
635daec6b4265ccbd066b96b53228919ac4cbd79. Both exact commits were verified on
|
|
Forge main and the State Hub primary/railiance01 projection.
|
|
|
|
## Prepare bounded custody change
|
|
|
|
```task
|
|
id: RPF-WP-0058-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f9b738e1-6d88-5dde-9fc5-b05b3adf2549"
|
|
```
|
|
|
|
Prepare CCR-2026-0046, exact seven-source bootstrap contract, silent bounded
|
|
provisioner, tests and exact ESO policy delta. Preparation itself performed no live action; the separately founder-attended
|
|
credential execution is now verified in T03 and its dated custody evidence.
|
|
|
|
## Independent owner review and founder disposition
|
|
|
|
```task
|
|
id: RPF-WP-0058-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
|
|
```
|
|
|
|
Independent preparation reviews are recorded within their owner scopes:
|
|
platform custody and attended-runner R3; Forge restricted-reader R2 and
|
|
attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
|
|
apps release contract R2. These approve preparation/integration, not live action.
|
|
Founder execution decision 9833715e-a22a-45c0-ab6c-881f0f4f1a0e is resolved;
|
|
the approved exact credential revision executed through the attended owner lane.
|
|
Installed-role proof preceded conditional state transition, and CCR is approved
|
|
with confirmed claims at the exact prebound SHA256 23039fae6137e7bdd71de0ed3278596b1ed60ae636018eb4bfcc83e53c4ada02.
|
|
This authority is separate from the earlier metadata disclosure consent.
|
|
The published hardened image digest is
|
|
sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
|
|
actual deployment of that reviewed image plus the exact URL allowlist and native
|
|
verification remain mandatory before reader delivery. The existing vulnerable
|
|
runtime cannot receive this credential.
|
|
|
|
## Execute and verify restricted reader custody
|
|
|
|
```task
|
|
id: RPF-WP-0058-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "58caf089-9af1-51fd-a94d-aba9abf14a53"
|
|
```
|
|
|
|
After review and disposition, attended platform lane executes silent bootstrap.
|
|
Read-only preflight checks all seven private repos, restricted non-admin private
|
|
user, exact code-read team flags, no unrelated members/teams/private grants and
|
|
PAT/KV drift. Mutation intent and observed/ambiguous outcome are fsynced. No
|
|
uncertain mint is retried. CAS=0 never overwrites existing KV. Noop still verifies
|
|
PAT metadata binding, all seven pinned index digests and excluded-private/admin/
|
|
Actions denial. Raw provider output and credentials remain suppressed.
|
|
|
|
## Owner delivery and hosted completion
|
|
|
|
```task
|
|
id: RPF-WP-0058-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "9c483fd9-68a5-56b0-813d-c965a11b60d2"
|
|
```
|
|
|
|
Apps owner integrates proposed data item and exact fourteen approved URL config,
|
|
performs approved fixed-image rollout after CPU/PVC preflight and safe diff/dryrun.
|
|
Confirm existing ESO SA reuse/reuse-surface-eso, role, audience and namespace
|
|
condition from live metadata. Consumer owner native verification precedes private
|
|
registration; Custodian final fresh hosted audit must prove all70 exactly once.
|
|
Removing reader grants and delivery must preserve shared writer/webhook fields.
|
|
|
|
Completed and verified 2026-10-15. The actual hardened phase-B runtime was Ready
|
|
on image sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
|
|
with reader key present and the exact allowlist verified. Native authenticated
|
|
fetch at03:30:20Z verified all seven pinned index hashes and seven entry hashes
|
|
without cache. All seven private registrations were applied and fully read back.
|
|
Forced-fresh hosted composition at03:31:48Z proves all70 reviewed IDs exactly
|
|
once, correct source repository, no missing/duplicate IDs and no federation
|
|
warning. Scoped writer attempt 8f23bb90-aef9-405d-81b6-bf550400dd93 ended with
|
|
Warden0 and confirmed revocation.
|
|
|
|
Authoritative external evidence is published in the-custodian commit
|
|
e5aaa0db51edc4c9f935d03ab58808b86e340823, under
|
|
`docs/assessments/netkingdom-2026-10-14/`: `phase-b-runtime-verification-r1.json`,
|
|
`private-native-fetch-verification-r1.json` and
|
|
`hosted-private-registration-verification-r1.json`. Their hashes and checked
|
|
results are retained locally in
|
|
`docs/evidence/2026-10-15-reuse-private-reader-hosted-establishment-r1.json`.
|
|
The root architecture/reuse goal is closed; root residual CUST-IN-0018 is live
|
|
separately. This platform workplan remains active solely for the existing manual
|
|
maintenance task T05, which stays wait with the actual Jan13 deadline. No rotation,
|
|
reprovisioning, new testing or live change is performed by this closeout.
|
|
|
|
|
|
Revision2 of the same CCR preserves R1 capped-page failure and the independently
|
|
corrected preliminary owned-only endpoint concern. Twenty bounded pages until
|
|
empty, duplicate IDs and supplied total-count consistency prevent silent short
|
|
page acceptance. No live complete-grant proof is claimed by these mocks.
|
|
|
|
|
|
Attended execution preparation R3 was followed by actual founder execution.
|
|
T03 is now done: policy attempt 93578ba93d6153fdb07c65db ended successfully
|
|
at 2026-10-15T03:06:13.283133Z; bootstrap attempt bb2693a7640f00b4e401467e
|
|
ended provisioned/verified with delivery pending at 03:06:12.816932Z.
|
|
The quiet owner runner captures hash-verified policy bytes for stdin, preserves
|
|
the existing ESO role, and verifies the actual immutable role/desired ACL before
|
|
and after bootstrap, including idempotent runs. A conditional CCR candidate binds
|
|
only approved/confirmed state transitions; these fields are not observed facts
|
|
until actual founder disposition and installed-role proof satisfy the rule.
|
|
Independent Forge preparation review R3 approved the exact runner; its receipt
|
|
SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
|
|
Forty-five targeted reader tests passed (17 attended-runner boundary cases).
|
|
The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
|
|
OpenBao/Forgejo routes. Actual silent founder execution verified exact seven-source
|
|
reader scope, created PAT metadata ID72/team5, and stored the reader at its separate
|
|
KV path. Credentials stayed inside the reviewed process; no value was printed.
|
|
Warden audits at03:06:13Z report outcome ok/exit0, including session revocation
|
|
and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json.
|
|
|
|
|
|
## Rotate or revoke dedicated seven-source reader within 90 days
|
|
|
|
```task
|
|
id: RPF-WP-0058-T05
|
|
status: wait
|
|
priority: high
|
|
due_date: "2027-01-13"
|
|
state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c"
|
|
```
|
|
|
|
Manual platform-owned maintenance for Forgejo identity `reuse-surface-source`,
|
|
team `reuse-surface-source-readers`, its exact named seven-repository PAT and
|
|
OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
|
|
`FORGEJO_SOURCE_TOKEN`. Forgejo PATs do not expire automatically; this live task
|
|
is a human-attended rotation/revocation obligation, not an expiry mechanism or
|
|
scheduled automation.
|
|
|
|
The deadline is now bound to actual verified custody activation, not an assumed
|
|
date: 2026-10-15T03:06:09.579844+00:00. The manual deadline is exactly
|
|
2027-01-13T03:06:09.579844+00:00 (task due_date 2027-01-13), actual activation plus 90 days.
|
|
Activation proof is bootstrap attempt bb2693a7640f00b4e401467e, verified kv_create;
|
|
receipt SHA256 f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171.
|
|
The owner/task binding is RPF-WP-0058-T05, UUID
|
|
f0780e75-b0bd-5bf5-b926-c8413abb885c, and is retained in the dated custody receipt.
|
|
Source and indexed task description must carry this actual date before delivery.
|
|
The structured Hub due_date cache remains a documented limitation; no automatic
|
|
reminder or server-side expiry is claimed.
|
|
|
|
At maintenance time prepare a separately approved bounded rotation/CAS plan,
|
|
including expected existing KV version, sibling preservation, exact dedicated
|
|
PAT identity, predecessor retention/cutover and native verification. Alternatively
|
|
use the separately approved exact-token recovery helper for Basic-auth revocation
|
|
with process-memory password and verified token inventory absence. Preserve the
|
|
shared runtime writer/webhook fields and public registrations. Never remint or
|
|
recover orphan/ambiguous requests automatically; reconcile authoritative state
|
|
before any new approved action. No rotation/revocation is executed by this record.
|