From 11767e5bf0cbba1e785b0b479c5a3edf172044e4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 13:35:21 +0200 Subject: [PATCH] security: record exact-image lifecycle acceptance and production gates Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 --- ...GE-WP-0006-independent-secret-detection.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md index a1dbc45..202c510 100644 --- a/workplans/FORGE-WP-0006-independent-secret-detection.md +++ b/workplans/FORGE-WP-0006-independent-secret-detection.md @@ -86,6 +86,30 @@ outside this activation. T02 stays progress: ordinary clean acceptance, HTTP/frontend writes, restart/regeneration and new-repository reconciliation remain native acceptance gates. No full coverage or owner approval is inferred. +2026-10-13 acceptance follow-through: ordinary source pushes of Custodian +`eb93eee` and railiance-forge `d2d87ca` passed the installed native profile and +remote heads were verified. Exact-image local Forgejo acceptance passes 23 +boolean checks with SQLite, no external network and no host mounts: HTTP +clean/detection/quarantine, real content API, secret-bearing merge message refusal +with detector evidence, clean merge, native hook regeneration, Git-template +inheritance at auto-initialized repository creation, container restart and +subsequent content refusal. Custodian receipt summary: +`docs/evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json`; +executor: `docs/changes/CUST-WP-0080/verify_forge_lifecycle.py`. Seven incomplete +preparation/assertion attempts remain visible; they are not successful trials. + +The native test reproduces absence of the scanner on new repositories before +configuring `init.templateDir`; a template containing only the additive hook +repairs this in isolation and survives hook regeneration/restart. Production +adoption must persist both the template and `git.config` setting through the +actual release source (`railiance-apps/helm/forgejo-values.yaml`) with exact binary +admission, reversible proposal and deployed verification. Do not reapply the +original immutable activation proposal to already installed repositories. +The 143 other repositories, deployed HTTP/SSO/UI paths and Kubernetes lifecycle +remain open. Upstream import/mirror paths use clone/fetch, not receive-pack, so +template inheritance alone cannot prove those content paths covered. T02/T03 +remain open; Custodian close-down checklist row 21 retains the uncovered control. + ## Verify CI independence, detection response and complete coverage ```task