From b99e396283c5f18f6f990e0536852e816d561d91 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 19 Oct 2026 10:49:50 +0200 Subject: [PATCH] Record delivered temporary Forgejo public-client flow with retained confidential acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15302-b965-7d43-a9d8-42710914b24e --- workplans/NK-WP-0048-security-case-types.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index b6a0ecb..0c34342 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -331,6 +331,8 @@ state_hub_task_id: "d9b26bcf-a7c6-59a2-92a0-f913d76a203c" ### T06 — First KnownSecurityCase: Forgejo +19 October refinement: the separately approved temporary public-client development flow is delivered and recorded as T44 below. T06 retains the full confidential SecurityCaseType/materialization, secret delivery, governed execution and native security acceptance above; it remains open. T44 does not mark that case implemented or materialized. + Write `security-cases/forgejo-netkingdom-oidc.yaml` from the parameters the founder accepted in KEY-WP-0038-T01 (`key-cape/docs/forgejo-oidc-client-request.yaml`), so that acceptance carries over as the case acceptance. ops-mason materializes it; @@ -1891,3 +1893,20 @@ revocation coverage must match the final application profile. No source adapter, synthetic key, stale cached decision or Boolean callback constitutes authority. Evidence under Custodian apps-access-engine-integration-r1; live source/key/caller/ policy admission and full profile acceptance remain open under T06/T16/T37. + +## T44 — Record the approved temporary Forgejo public-client development flow + +```task +id: NK-WP-0048-T44 +status: done +priority: high +state_hub_task_id: "93d05845-dd12-52be-a146-79f4be2d4778" +``` + +Completed 19 October 2026; evidence recorded by Custodian coordinator, not a new owner approval. Existing independent NetKingdom review under T06 and founder decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c` approved exact CUST80-FORGEJO-PUBLIC-BUILD-20261018 r2 digest `fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3`. + +Source declaration published at `a7339fa60dc0fcf489811b4a32b785366d91e29c`; Apps declaration at `4d6a8dde21e3f800156c0aaa2bfe859c57908486`. Maintained keycape-client helper added only the exact public forgejo client, required MFA/S256 profile and HTTPS callback, validated live/proposed config, CAS-tested original registry revision and preserved unrelated bytes. Registry readback is revision 77451827; final inspection is exact-match/no change. One restart each of KeyCape and Forgejo completed Ready; images/resources/pod templates were unchanged except the restart annotation. Source ID 1 is netkingdom. Local sign-in remains available. The actual founder completed account linking, NetKingdom sign-in and same-account/repository/organisation continuity in under one minute (reported estimate). Supported workstation Git/API trial and cleanup passed. + +Evidence: [Custodian activation and human receipts](../../the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md), [native checks](../../the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json). + +This is the explicit temporary supervised build profile, not the original confidential SecurityCaseType acceptance. T06 and its existing dependencies retain that scope; full hardening remains CUST-WP-0082-T20 and the existing owner records. No new residual backlog, owner assent, permanent exception or runtime authority is inferred. One premature readiness observation failed before rollout completion; the later observation passed without repeating effects. No rollback occurred.