coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record exact-image lifecycle acceptance and production gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 13:35:21 +02:00
parent d2d87cad51
commit 11767e5bf0
1 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/FORGE-WP-0006-independent-secret-detection.md
View file

@ -86,6 +86,30 @@ outside this activation. T02 stays progress: ordinary clean acceptance,
HTTP/frontend writes, restart/regeneration and new-repository reconciliation
remain native acceptance gates. No full coverage or owner approval is inferred.
2026-10-13 acceptance follow-through: ordinary source pushes of Custodian
`eb93eee` and railiance-forge `d2d87ca` passed the installed native profile and
remote heads were verified. Exact-image local Forgejo acceptance passes 23
boolean checks with SQLite, no external network and no host mounts: HTTP
clean/detection/quarantine, real content API, secret-bearing merge message refusal
with detector evidence, clean merge, native hook regeneration, Git-template
inheritance at auto-initialized repository creation, container restart and
subsequent content refusal. Custodian receipt summary:
`docs/evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json`;
executor: `docs/changes/CUST-WP-0080/verify_forge_lifecycle.py`. Seven incomplete
preparation/assertion attempts remain visible; they are not successful trials.
The native test reproduces absence of the scanner on new repositories before
configuring `init.templateDir`; a template containing only the additive hook
repairs this in isolation and survives hook regeneration/restart. Production
adoption must persist both the template and `git.config` setting through the
actual release source (`railiance-apps/helm/forgejo-values.yaml`) with exact binary
admission, reversible proposal and deployed verification. Do not reapply the
original immutable activation proposal to already installed repositories.
The 143 other repositories, deployed HTTP/SSO/UI paths and Kubernetes lifecycle
remain open. Upstream import/mirror paths use clone/fetch, not receive-pack, so
template inheritance alone cannot prove those content paths covered. T02/T03
remain open; Custodian close-down checklist row 21 retains the uncovered control.
## Verify CI independence, detection response and complete coverage
```task