Protect authenticated federation sources with exact runtime URL bindings

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

workplans/REUSE-WP-0025-private-source-reader-boundary.md

@@ -0,0 +1,66 @@
+---
+id: REUSE-WP-0025
+type: workplan
+title: "Bind private source reader to consented metadata URLs"
+domain: infotech
+repo: reuse-surface
+status: blocked
+owner: reuse-surface-owner-preparation-worker
+created: "2026-10-15"
+updated: "2026-10-15"
+flavor: implementation
+depends_on: [CUST-WP-0081]
+---
+
+Prepared in an isolated owner checkout under the user's explicit worker-agent
+request. This worker has supervised local preparation scope only; no founder
+credential approval, permanent repo-owner authority, deployment, or source-owner
+consent is inferred. The custodian integration agent handles hub synchronization
+after accepting the proposed owner workitem. No State Hub mutation is performed
+from this isolated checkout.
+
+## Independent consumer review
+
+```task
+id: REUSE-WP-0025-T01
+status: done
+priority: high
+```
+
+Reviewed consumer INTENT, native authenticated acquisition, public API registration
+fields, and stale-cache behavior. The deployed baseline is unsuitable for a new
+private reader: registered auth_env/URL can route runtime credentials to arbitrary
+hosts; urllib's default redirect handler also forwards Authorization. Review is
+`changes_requested`; metadata consent does not authorize reader provisioning.
+See docs/assessments/cust81-private-reader/owner-review-r1.md.
+
+## Prepare native boundary and verification helper
+
+```task
+id: REUSE-WP-0025-T02
+status: done
+priority: high
+```
+
+Patch rejects authenticated cleartext URLs and all redirects, and requires an
+operator-controlled exact env-to-URL allowlist before credential lookup. Receipt
+helper invokes native fetch directly for all seven consented index/entry pairs,
+checks exact hashes and entry schema, and never uses cached fallback. Fake
+transport tests and local committed metadata validation are preparation evidence,
+not live authenticated fetch receipts.
+
+## Review, publish and verify deployed consumer
+
+```task
+id: REUSE-WP-0025-T03
+status: wait
+priority: high
+```
+
+Owner review and exact credential/rollout disposition remain pending. Platform/apps
+must inventory every existing authenticated dynamic registration without reading
+Secret values, migrate approved exact URLs, and deliver a reviewed image containing
+the fix plus the exact reader allowlist. Then run helper inside the hub environment
+with the owner-provided packets, verify all seven sources fresh, and hand a
+sanitized receipt to the custodian for registration and final 70-capability audit.
+No new PAT is delivered to the current baseline consumer.