tegwick
39583d0b85
Decision 81c8535a is resolved; the remaining gate is the requested platform rollout (hub message f8f142bc). Clears C-40. Carries the refreshed custodian brief. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 803894@bnt-lap001 Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
84 lines
3.7 KiB
Markdown
84 lines
3.7 KiB
Markdown
---
|
|
id: REUSE-WP-0025
|
|
type: workplan
|
|
title: "Bind private source reader to consented metadata URLs"
|
|
domain: infotech
|
|
repo: reuse-surface
|
|
status: blocked
|
|
owner: reuse-surface-owner-preparation-worker
|
|
created: "2026-10-15"
|
|
updated: "2026-10-21"
|
|
flavor: implementation
|
|
depends_on: [CUST-WP-0081]
|
|
state_hub_workstream_id: "23c7bcf5-5f5d-524f-a06e-be5247ae1a98"
|
|
---
|
|
|
|
Prepared in an isolated owner checkout under the user's explicit worker-agent
|
|
request. This worker has supervised local preparation scope only; no founder
|
|
credential approval, permanent repo-owner authority, deployment, or source-owner
|
|
consent is inferred. The custodian integration agent handles hub synchronization
|
|
after accepting the proposed owner workitem. No State Hub mutation is performed
|
|
from this isolated checkout.
|
|
|
|
## Independent consumer review
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "1f841e28-fc55-5b12-bb51-bb3291f17d8b"
|
|
```
|
|
|
|
Reviewed consumer INTENT, native authenticated acquisition, public API registration
|
|
fields, and stale-cache behavior. The deployed baseline is unsuitable for a new
|
|
private reader: registered auth_env/URL can route runtime credentials to arbitrary
|
|
hosts; urllib's default redirect handler also forwards Authorization. Review is
|
|
`changes_requested`; metadata consent does not authorize reader provisioning.
|
|
See docs/assessments/cust81-private-reader/owner-review-r1.md.
|
|
|
|
## Prepare native boundary and verification helper
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a9e794f6-a894-52e6-bd93-4781e05c6a55"
|
|
```
|
|
|
|
Patch rejects authenticated cleartext URLs and all redirects, and requires an
|
|
operator-controlled exact env-to-URL allowlist before credential lookup. Receipt
|
|
helper invokes native fetch directly for all seven consented index/entry pairs,
|
|
checks exact hashes and entry schema, and never uses cached fallback. Fake
|
|
transport tests and local committed metadata validation are preparation evidence,
|
|
not live authenticated fetch receipts.
|
|
|
|
## Review, publish and verify deployed consumer
|
|
|
|
```task
|
|
id: REUSE-WP-0025-T03
|
|
status: wait
|
|
priority: high
|
|
blocked_on: message-from:railiance-apps
|
|
blocking_reason: "Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao"
|
|
state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
|
|
```
|
|
|
|
Owner review and exact credential/rollout disposition remain pending. Platform/apps
|
|
must inventory every existing authenticated dynamic registration without reading
|
|
Secret values, migrate approved exact URLs, and deliver a reviewed image containing
|
|
the fix plus the exact reader allowlist. Then run helper inside the hub environment
|
|
with the owner-provided packets, verify all seven sources fresh, and hand a
|
|
sanitized receipt to the custodian for registration and final 70-capability audit.
|
|
No new PAT is delivered to the current baseline consumer.
|
|
|
|
2026-10-21: decision 81c8535a resolved by Bernd — approved (1) the native
|
|
boundary fix, (2A) a dedicated Forgejo machine user (e.g. `reuse-surface-reader`)
|
|
with read access to exactly the seven consented repos and a `read:repository`
|
|
PAT on its own OpenBao KV path, delivered via ESO as
|
|
`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` and allowlisted to the 14 commit-pinned
|
|
URLs, and (3) the platform/apps rollout as described above. Remaining: create the
|
|
bot user and token (human/operator — agents do not handle the secret value), roll
|
|
out, run the helper, hand over the receipt. Follow-up: define how allowlist pins
|
|
are refreshed and re-approved when the source repos update their metadata.
|
|
Rollout requested from railiance-apps via hub message f8f142bc; T03 now waits
|
|
on that reply (image digest, Helm revision, sanitized helper receipt).
|