add 0052/SESSION-0052.0-TRANSCRIPT-2026-05-31T12-08--2026-05-31T20-42.md + replace placeholder/variant SESSION-0052.0-TRANSCRIPT-2026-05-31T12-08--2026-05-31T12-54.md

0052/SESSION-0052.0-TRANSCRIPT-2026-05-31T12-08--2026-05-31T20-42.md

@@ -8,8 +8,10 @@
 > self-scan radar layer (resolved-installed-env scan). Discovered the OHM
 > Gitea org repos went private (intentional) — which had silently broken
 > `pin check` / `deploy` / `plan` / `audit` app-layers. v1.6.0 wires
-> authenticated Gitea reads to restore them. One operator gesture remains:
+> authenticated Gitea reads to restore them. Closed the loop with the
-> `ohm-bot` lacks read on the two `ben.stull/*` repos.**
+> operator: a dedicated read token (NOT ohm-bot) now reads both `ben.stull/*`
+> repos — `pin check` resolves `0.31.3` and the full `audit` runs with ZERO
+> scanner_errors across all four layers. Blocker resolved; radar fully live.**
 
 ---
 
@@ -114,6 +116,34 @@ correct and complete — the only blocker is the per-repo access grant.
 
 Shipped **v1.6.0** (merge `70ba3b0`, tag `v1.6.0`), pushed main + tag.
 
+### Arc 5 — Closing the loop: a dedicated read token (post-publish)
+
+Worked through the token with the operator. The operator declined to extend
+the org bot to the personal-namespace repos and instead used a **separate read
+token**, stored in the secret `ohm-rfc-app-gitea-read-token` (wiggleverse-ohm).
+I located it (no `wiggleverse-rfc-app` secret exists; the read-token secret was
+already there) and repointed the deployment record at it:
+`gitea_read_secret_ref = wiggleverse-ohm/ohm-rfc-app-gitea-read-token`.
+
+First attempts 401'd: the secret held a stale **188-char** value that isn't a
+Gitea PAT (40 hex) and was rejected under `token`, `Bearer`, and `?token=`
+schemes alike — verified without ever printing the bytes. The operator replaced
+it with a working Gitea PAT whose identity reads both `ben.stull/ohm-rfc` and
+`ben.stull/rfc-app`.
+
+Result — fully restored:
+- `pin check ohm-rfc-app` → resolves `0.31.3` (matches deploys.id=51).
+- `audit ohm-rfc-app` → **9 findings, scanner_errors=[]** across all four
+  layers. The session-0049 fast-lane finding is confirmed live:
+  `[fast] high py-app/tqdm 4.9.0 → 4.11.2` (GHSA-r7q7-xcjw-qx8q, RCE). Also
+  surfaced: py-app/idna 3.9.0→3.15 (medium), py-app/tqdm CLI-injection + PYSEC
+  (routine), the flotilla/pip set, and os reboot-required. node-app scanned
+  clean.
+
+So v1.6.0's authenticated reads are proven end-to-end against the real private
+repos. No code change in this arc — the operator gesture (load a working token)
+was the last mile.
+
 ---
 
 ## Cut state (end of session)
@@ -122,9 +152,10 @@ Shipped **v1.6.0** (merge `70ba3b0`, tag `v1.6.0`), pushed main + tag.
 | --- | --- |
 | flotilla `main` | `70ba3b0` — v1.6.0 (authenticated Gitea reads) |
 | flotilla tags | `v1.5.0` (backfilled), `v1.5.1`, `v1.6.0` |
-| OHM deployment record | `gitea_read_secret_ref` = `wiggleverse-ohm/ohm-rfc-app-gitea-bot-token`; migration 008 applied to laptop DB |
+| OHM deployment record | `gitea_read_secret_ref` = `wiggleverse-ohm/ohm-rfc-app-gitea-read-token` (dedicated read token, NOT ohm-bot); migration 008 applied to laptop DB |
 | OHM live | untouched (read-only session; no deploy) |
-| ohm-rfc pin | `0.31.3` (unchanged) |
+| ohm-rfc pin | `0.31.3` (unchanged) — now readable via token |
+| OHM radar | `audit` runs clean: 9 findings, **0 scanner_errors**, fast=1 (tqdm RCE) |
 | Local CLI | editable install @ v1.6.0, suite 293 green |
 
 | Ledger | Status |
@@ -133,7 +164,7 @@ Shipped **v1.6.0** (merge `70ba3b0`, tag `v1.6.0`), pushed main + tag.
 | Backfill missing `v1.5.0` tag | ✅ |
 | Discover + diagnose private-repo breakage | ✅ |
 | Wire authenticated Gitea reads | ✅ v1.6.0 (code complete + proven live) |
-| Restore `pin check` / `deploy` / app-layer `audit` live | ⏸ blocked on ohm-bot repo access grant |
+| Restore `pin check` / `deploy` / app-layer `audit` live | ✅ dedicated read token loaded; audit clean |
 
 ---
 
@@ -151,14 +182,15 @@ Shipped **v1.6.0** (merge `70ba3b0`, tag `v1.6.0`), pushed main + tag.
 
 ## What lands on the operator's plate
 
-1. **Grant `ohm-bot` read on `ben.stull/ohm-rfc` and `ben.stull/rfc-app`** (add
+1. ~~Grant ohm-bot read on the two repos~~ — **DONE** (Arc 5): the operator
-   it as a read collaborator in Gitea), OR move those two repos into the
+   loaded a dedicated read token into `ohm-rfc-app-gitea-read-token` and the
-   `wiggleverse` org (where ohm-bot already has read). Either unblocks
+   record points at it. Radar fully live.
-   `pin check` / `deploy` / `plan` / app-layer `audit` immediately — the
-   deployment record already points at the token. No code change needed.
 2. (Optional) Reconcile [[reference_authoring_lane_token_scope]]: it assumed
    ohm-bot drives PRs on `ben.stull/ohm-rfc`, but ohm-bot can't currently even
    *read* it. Verify how PR-driving actually authenticates.
+3. The tqdm RCE (`GHSA-r7q7-xcjw-qx8q`, fix 4.11.2) is a real fast-lane pin-bump
+   candidate, but needs a fixed **rfc-app** tag to bump to first; the bump rides
+   Track Δ (#37–#42), not this session.
 
 ---
 
@@ -178,32 +210,29 @@ STATE (all pushed):
   the OHM org Gitea repos were made PRIVATE on 2026-05-31 (intentional) and
   every anonymous read started 404ing.
 
-BLOCKER (operator gesture — may already be done):
+BLOCKER: RESOLVED in session 0052.
-- The configured token identity `ohm-bot` has read on the wiggleverse ORG repos
+- The deployment record points at wiggleverse-ohm/ohm-rfc-app-gitea-read-token —
-  but NOT on ben.stull/ohm-rfc (pin) or ben.stull/rfc-app (lockfiles) — both
+  a DEDICATED read token (NOT ohm-bot, which lacks access to the ben.stull/*
-  404 even authed. Until ohm-bot is granted read there (or the repos move to
+  personal-namespace repos). Its identity reads both ben.stull/ohm-rfc (pin) and
-  the wiggleverse org), `flotilla pin check` / `deploy` / app-layer `audit`
+  ben.stull/rfc-app (lockfiles). `pin check` resolves 0.31.3; full `audit` runs
-  stay blind. The deployment record already points at
+  clean (9 findings, 0 scanner_errors). Nothing to do here — radar is live.
-  wiggleverse-ohm/ohm-rfc-app-gitea-bot-token, so it works the moment access
-  lands. FIRST THING: re-run `flotilla pin check ohm-rfc-app` — if it resolves
-  0.31.3, access was granted and the radar app-layers are live again.
 
 Run form (osv on PATH + pinned gcloud config):
   PATH="/opt/homebrew/bin:$PATH" CLOUDSDK_ACTIVE_CONFIG_NAME=wiggleverse \
     .venv/bin/ohm-rfc-app-flotilla audit ohm-rfc-app
 
-OTHER NEXT MOVES (independent of the blocker):
+NEXT MOVES:
-1. Live finding from session 0049 still stands: pinned rfc-app v0.31.3 ships
+1. tqdm RCE is live in the pin: py-app/tqdm 4.9.0 has a HIGH RCE
-   tqdm 4.9.0 with a HIGH RCE (GHSA-r7q7-xcjw-qx8q, fixed 4.11.2) — a fast-lane
+   (GHSA-r7q7-xcjw-qx8q, fixed 4.11.2) — fast-lane pin-bump candidate, but needs
-   pin-bump candidate once a fixed rfc-app tag ships; the bump rides Track Δ
+   a fixed rfc-app tag to bump to first; the bump rides Track Δ (#37-#42), not
-   (#37-#42), not the audit verb. (Re-confirm via audit once pin reads work.)
+   the audit verb. (Also live: py-app/idna 3.9.0→3.15, medium.)
 2. Patchwatch Phase 2: OS unattended-upgrades (security pocket) on the VM +
    the reboot-required the radar flagged (linux-image-6.1.0-49). Independent
-   of Track Δ and of the Gitea blocker.
+   of Track Δ.
 3. Patchwatch cloud runner (proposal §6): Cloud Scheduler → read-only Cloud Run
-   job running `flotilla audit … --json --fail-on`. NOTE it will need the same
+   job running `flotilla audit … --json --fail-on`. Now unblocked — the runner's
-   gitea token + a runner identity with Secret Manager access; gated on the
+   identity will need Secret Manager access to ohm-rfc-app-gitea-read-token (the
-   ohm-bot access grant for the app layers.
+   token approach is proven end-to-end).
 
 Do NOT build the auto-initiate tier (Phase 5) — depends on Track Δ existing.
 ```