d36fc463bc
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
70 lines
2.7 KiB
Markdown
70 lines
2.7 KiB
Markdown
---
|
|
id: REUSE-WP-0025
|
|
type: workplan
|
|
title: "Bind private source reader to consented metadata URLs"
|
|
domain: infotech
|
|
repo: reuse-surface
|
|
status: blocked
|
|
owner: reuse-surface-owner-preparation-worker
|
|
created: "2026-10-15"
|
|
updated: "2026-10-15"
|
|
flavor: implementation
|
|
depends_on: [CUST-WP-0081]
|
|
state_hub_workstream_id: "23c7bcf5-5f5d-524f-a06e-be5247ae1a98"
|
|
---
|
|
|
|
Prepared in an isolated owner checkout under the user's explicit worker-agent
|
|
request. This worker has supervised local preparation scope only; no founder
|
|
credential approval, permanent repo-owner authority, deployment, or source-owner
|
|
consent is inferred. The custodian integration agent handles hub synchronization
|
|
after accepting the proposed owner workitem. No State Hub mutation is performed
|
|
from this isolated checkout.
|
|
|
|
## Independent consumer review
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "1f841e28-fc55-5b12-bb51-bb3291f17d8b"
|
|
```
|
|
|
|
Reviewed consumer INTENT, native authenticated acquisition, public API registration
|
|
fields, and stale-cache behavior. The deployed baseline is unsuitable for a new
|
|
private reader: registered auth_env/URL can route runtime credentials to arbitrary
|
|
hosts; urllib's default redirect handler also forwards Authorization. Review is
|
|
`changes_requested`; metadata consent does not authorize reader provisioning.
|
|
See docs/assessments/cust81-private-reader/owner-review-r1.md.
|
|
|
|
## Prepare native boundary and verification helper
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a9e794f6-a894-52e6-bd93-4781e05c6a55"
|
|
```
|
|
|
|
Patch rejects authenticated cleartext URLs and all redirects, and requires an
|
|
operator-controlled exact env-to-URL allowlist before credential lookup. Receipt
|
|
helper invokes native fetch directly for all seven consented index/entry pairs,
|
|
checks exact hashes and entry schema, and never uses cached fallback. Fake
|
|
transport tests and local committed metadata validation are preparation evidence,
|
|
not live authenticated fetch receipts.
|
|
|
|
## Review, publish and verify deployed consumer
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
|
|
```
|
|
|
|
Owner review and exact credential/rollout disposition remain pending. Platform/apps
|
|
must inventory every existing authenticated dynamic registration without reading
|
|
Secret values, migrate approved exact URLs, and deliver a reviewed image containing
|
|
the fix plus the exact reader allowlist. Then run helper inside the hub environment
|
|
with the owner-provided packets, verify all seven sources fresh, and hand a
|
|
sanitized receipt to the custodian for registration and final 70-capability audit.
|
|
No new PAT is delivered to the current baseline consumer.
|