docs: review seven-source reader API and bounded recovery
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
parent
6e8f657e55
commit
35d966dacd
10 changed files with 523 additions and 0 deletions
13
.kaizen/agents/forge-reader-owner/supervision.json
Normal file
13
.kaizen/agents/forge-reader-owner/supervision.json
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"agent_id": "forge-reader-owner",
|
||||
"repo": "railiance-forge",
|
||||
"mode": "supervised",
|
||||
"scope": "FORGE-WP-0007 independent CCR-2026-0046 preparation/review only",
|
||||
"supervisor": "founder via root coordinating agent; no live grant delegated",
|
||||
"runtime_enforcement": {
|
||||
"verified": false,
|
||||
"autopilot_granted": false
|
||||
},
|
||||
"authority": "No custodian agent scope inherited; no admin credentials, live changes or approval recording authorized.",
|
||||
"proposals": []
|
||||
}
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
{
|
||||
"reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
|
||||
"decision": "changes_requested",
|
||||
"comment": "INTENT Core Principles 1/4/6 and Stable Handoffs require reliable exact grants and revocation evidence; FORGE-WP-0007-T01. Reviewed exact artifacts below. Public API version/schema supports identity/team/PAT contracts, but current pagination silently truncates server-capped lists; live grants/lifecycle remain unverified. No founder approval or target admission is recorded.",
|
||||
"work_item": "FORGE-WP-0007-T01",
|
||||
"reviewed_artifacts": {
|
||||
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "438f384215c7a1719c1e069dfa9723d5ddab4cfa9ceb64236acdb1cae4854f02",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "f7b4f2c7a0a85315d1229a1c96f8f0b255b9c17d77426d47f9b14df9a83787ae",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "1ca0192a5c066a1756f4d11a2fb840784c4a49088f77f575a6b2170f3a5ca47e",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b"
|
||||
},
|
||||
"metadata_contract": "docs/proposals/cust81-private-reader/target-api-contract-r1.json",
|
||||
"findings": [
|
||||
{
|
||||
"id": "FORGE-CUST81-F01",
|
||||
"severity": "blocking",
|
||||
"status": "confirmed",
|
||||
"summary": "Client.pages returns after first capped page because len(batch)<100; target default cap50. Extra private grant/otherteam/token on page2 escapes scope checks.",
|
||||
"trace": "Client.pages -> limit=100 -> utils.GetListOptions -> convert.ToCorrectPageSize -> MaxResponseItems(default50).",
|
||||
"fixture": {
|
||||
"server_cap": 50,
|
||||
"page1_items": 50,
|
||||
"page2_items": 1,
|
||||
"observed_items": 50,
|
||||
"expected_items": 51,
|
||||
"result": "confirmed_incomplete_inventory"
|
||||
},
|
||||
"required_change": "Enumerate to authoritative empty page or reconcile X-Total-Count, bound pages/items, reject duplicate IDs/repeated pages, fail closed incomplete totals. Test 50+1 excluded grant and cap7 exact-repo case."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F02",
|
||||
"severity": "blocking",
|
||||
"status": "contract_unverified_execution",
|
||||
"summary": "Recovery/90day manual rotation has no exact executable revocation/CAS-update plan or dated operational record. PAT deletion requires Basic/reverse-proxy auth, not adminPAT alone.",
|
||||
"trace": "api.go /users/{username}/tokens/{id} DELETE middleware reqBasicOrRevProxyAuth; user/app.go DeleteAccessToken binds ContextUser.ID.",
|
||||
"required_change": "Prepare bounded exact-token recovery/revocation fixture and explicit rotation/due-date inventory. Keep manual90days as stated policy, not runtime expiry/enforcement."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F03",
|
||||
"severity": "blocking",
|
||||
"status": "proof_missing",
|
||||
"summary": "Source-contract evidence cannot prove existing target identities/grants or KeyCape federation/ephemeral machine issuer configuration.",
|
||||
"required_change": "Before approval/execution, bind public expected targetversion and recheck; at approved attended execution use sanitized complete effective-grant proof incl sudo identity and token_last_eight; retain Q1\u2013Q3 confirmation gates."
|
||||
}
|
||||
],
|
||||
"rejected_preliminary_hypothesis": {
|
||||
"summary": "Swagger /user/repos says owned, initially suspected missing collaborator grants.",
|
||||
"resolution": "Not confirmed: ListMyRepos defaults Collaborate=None; model SearchRepositoryCondition unions ownership with UserAccessRepoCond and UserOrgTeamRepoCond. Keep /user/repos with source-proven semantics and complete pagination."
|
||||
},
|
||||
"live_proof": {
|
||||
"credentials_used": false,
|
||||
"mutations": false,
|
||||
"grants": null,
|
||||
"token_issued": false,
|
||||
"native_fetch": null
|
||||
},
|
||||
"binding_correction": "Historical reviewed artifacts rebound to retained platform-r1 baseline and independent fixture rerun. Earlier temporary artifact hashing raced R2 script replacement; no approval relied on those interim bytes."
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
{
|
||||
"reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
|
||||
"decision": "approved",
|
||||
"comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: provider owns target grant contract, dependable stable handoffs, and evidence reflecting current Forgejo runtime. Approve CCR-2026-0046 revision2 bounded design/preparation on exact artifact hashes below. Complete pagination defect is corrected and the versioned model proves effective /user/repos semantics. This is an owner review, not founder authorization or live target proof. Retain all declared pre-activation gates, especially bounded Basic-auth recovery helper/due-date task and separately reviewed consumer image+allowlist+apps rollout; no execution approval is inferred.",
|
||||
"reviewed_revision": 2,
|
||||
"reviewed_at": "2026-10-14T22:53:44.918962+00:00",
|
||||
"work_item": "FORGE-WP-0007-T02",
|
||||
"reviewed_artifacts": {
|
||||
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "1488d4c5928bf0af2735792855194c8c0d68cc738f1ae5c8a0fba947cd176a1d",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "bd235d93cdb1b4f432ae4b2755e0cb80da93a21f7feab115b2a61ea931d656f9",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
||||
"tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b"
|
||||
},
|
||||
"validation": {
|
||||
"targeted_unittest": "23 passed, independently rerun",
|
||||
"independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible",
|
||||
"fixture_receipt": "pagination-independent-fixture-results.json",
|
||||
"static_target_contract": "target-api-contract-r1.json",
|
||||
"live_credentials_used": false,
|
||||
"live_mutations": false,
|
||||
"live_effective_grants_verified": false,
|
||||
"live_native_fetch_verified": false
|
||||
},
|
||||
"r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success",
|
||||
"contract_findings_resolved": [
|
||||
{
|
||||
"id": "FORGE-CUST81-F01",
|
||||
"resolution": "Bounded page-until-empty; duplicate/missingID and optional stable-total reconciliation; independent capped50 fixture includes excluded page2 grant; late-collaborator test rejects before mutation."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F02",
|
||||
"resolution": "CCR explicitly states manual quarterly policy lacks expiry enforcement and requires due-date owner task/receipt plus executable Basic recovery helper before activation. Deactivation now states exact-token reset+Basic deletion compatible with API; helper/approval remains gate, not claimed complete."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F03",
|
||||
"resolution": "Public deployed version/schema inspected; matching version source establishes contract support. Installed target grants, Sudoidentity, machinefederation/ephemeral issuance, and native consumer route behavior remain explicit attended verification gates."
|
||||
}
|
||||
],
|
||||
"sec_dsm_order": {
|
||||
"Q1": "No direct Kubernetes identity accepted by current raw HTTP route is demonstrated.",
|
||||
"Q2": "KeyCape human login does not establish machine API federation; no installed workload JWT trust demonstrated.",
|
||||
"Q3": "Upstream Forgejo OAuth can issue expiring access tokens, but supports authorization_code/refresh_token only; no viable workload client_credentials/token_exchange demonstrated. Therefore static fallback is conditional, not universal target incapability claim.",
|
||||
"Q4": "No automatic rotation demonstrated; manual90day policy and target owner due-date record required before activation.",
|
||||
"Q5": "Dedicated read:repository PAT vault custody conditional fallback, exact7private grants; ESO15minute token is delivery authentication, not PATexpiry."
|
||||
},
|
||||
"execution_boundary": [
|
||||
"Founder exact revision disposition and independent otherowner reviews remain required.",
|
||||
"Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.",
|
||||
"Executable exact-token Basic recovery helper plus due-date task/receipt required before activation; separately reviewed rotationCAS update before rotation.",
|
||||
"No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.",
|
||||
"Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"proposal": "CCR-2026-0046",
|
||||
"revision": 2,
|
||||
"work_item": "FORGE-WP-0007-T02",
|
||||
"old_review_sha256": "ad4ca9e794d202af447a47d3e895afcfdec4c91f021d919fd205f882d7886292",
|
||||
"new_review_sha256": "30d9233f9e0514f5f2b1ff4ca9c4fc0a7c1aa56679d3fcc9b452bc1f4ad007a1",
|
||||
"refresh_diff_sha256": "21bad3a4e07984115680f7877610a8889af863ab4b5c0476c696f303063310fa",
|
||||
"reason": "Platform added executable exact-PAT Basic-auth rollback after original R2 owner review; same revision refinement retained, original review bytes preserved.",
|
||||
"decision": "approved",
|
||||
"live_mutation": false
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
--- forge-owner-review-r2-before-recovery.json
|
||||
+++ forge-owner-review-r2.json
|
||||
@@ -1,26 +1,29 @@
|
||||
{
|
||||
"reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
|
||||
"decision": "approved",
|
||||
- "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: provider owns target grant contract, dependable stable handoffs, and evidence reflecting current Forgejo runtime. Approve CCR-2026-0046 revision2 bounded design/preparation on exact artifact hashes below. Complete pagination defect is corrected and the versioned model proves effective /user/repos semantics. This is an owner review, not founder authorization or live target proof. Retain all declared pre-activation gates, especially bounded Basic-auth recovery helper/due-date task and separately reviewed consumer image+allowlist+apps rollout; no execution approval is inferred.",
|
||||
+ "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.",
|
||||
"reviewed_revision": 2,
|
||||
- "reviewed_at": "2026-10-14T22:53:44.918962+00:00",
|
||||
+ "reviewed_at": "2026-10-14T23:08:34.771501+00:00",
|
||||
"work_item": "FORGE-WP-0007-T02",
|
||||
"reviewed_artifacts": {
|
||||
- "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "1488d4c5928bf0af2735792855194c8c0d68cc738f1ae5c8a0fba947cd176a1d",
|
||||
+ "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
- "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "bd235d93cdb1b4f432ae4b2755e0cb80da93a21f7feab115b2a61ea931d656f9",
|
||||
+ "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
||||
- "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b"
|
||||
+ "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b",
|
||||
+ "scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
|
||||
+ "tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d"
|
||||
},
|
||||
"validation": {
|
||||
- "targeted_unittest": "23 passed, independently rerun",
|
||||
+ "targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)",
|
||||
"independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible",
|
||||
"fixture_receipt": "pagination-independent-fixture-results.json",
|
||||
"static_target_contract": "target-api-contract-r1.json",
|
||||
"live_credentials_used": false,
|
||||
"live_mutations": false,
|
||||
"live_effective_grants_verified": false,
|
||||
- "live_native_fetch_verified": false
|
||||
+ "live_native_fetch_verified": false,
|
||||
+ "recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token."
|
||||
},
|
||||
"r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success",
|
||||
"contract_findings_resolved": [
|
||||
@@ -30,7 +33,7 @@
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F02",
|
||||
- "resolution": "CCR explicitly states manual quarterly policy lacks expiry enforcement and requires due-date owner task/receipt plus executable Basic recovery helper before activation. Deactivation now states exact-token reset+Basic deletion compatible with API; helper/approval remains gate, not claimed complete."
|
||||
+ "resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F03",
|
||||
@@ -47,7 +50,7 @@
|
||||
"execution_boundary": [
|
||||
"Founder exact revision disposition and independent otherowner reviews remain required.",
|
||||
"Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.",
|
||||
- "Executable exact-token Basic recovery helper plus due-date task/receipt required before activation; separately reviewed rotationCAS update before rotation.",
|
||||
+ "Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.",
|
||||
"No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.",
|
||||
"Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven."
|
||||
]
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
{
|
||||
"reviewer": "railiance-forge-owner (agent railiance-forge, codex)",
|
||||
"decision": "approved",
|
||||
"comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.",
|
||||
"reviewed_revision": 2,
|
||||
"reviewed_at": "2026-10-14T23:08:34.771501+00:00",
|
||||
"work_item": "FORGE-WP-0007-T02",
|
||||
"reviewed_artifacts": {
|
||||
"credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
|
||||
"scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
"docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
|
||||
"openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b",
|
||||
"tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b",
|
||||
"scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
|
||||
"tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d"
|
||||
},
|
||||
"validation": {
|
||||
"targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)",
|
||||
"independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible",
|
||||
"fixture_receipt": "pagination-independent-fixture-results.json",
|
||||
"static_target_contract": "target-api-contract-r1.json",
|
||||
"live_credentials_used": false,
|
||||
"live_mutations": false,
|
||||
"live_effective_grants_verified": false,
|
||||
"live_native_fetch_verified": false,
|
||||
"recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token."
|
||||
},
|
||||
"r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success",
|
||||
"contract_findings_resolved": [
|
||||
{
|
||||
"id": "FORGE-CUST81-F01",
|
||||
"resolution": "Bounded page-until-empty; duplicate/missingID and optional stable-total reconciliation; independent capped50 fixture includes excluded page2 grant; late-collaborator test rejects before mutation."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F02",
|
||||
"resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation."
|
||||
},
|
||||
{
|
||||
"id": "FORGE-CUST81-F03",
|
||||
"resolution": "Public deployed version/schema inspected; matching version source establishes contract support. Installed target grants, Sudoidentity, machinefederation/ephemeral issuance, and native consumer route behavior remain explicit attended verification gates."
|
||||
}
|
||||
],
|
||||
"sec_dsm_order": {
|
||||
"Q1": "No direct Kubernetes identity accepted by current raw HTTP route is demonstrated.",
|
||||
"Q2": "KeyCape human login does not establish machine API federation; no installed workload JWT trust demonstrated.",
|
||||
"Q3": "Upstream Forgejo OAuth can issue expiring access tokens, but supports authorization_code/refresh_token only; no viable workload client_credentials/token_exchange demonstrated. Therefore static fallback is conditional, not universal target incapability claim.",
|
||||
"Q4": "No automatic rotation demonstrated; manual90day policy and target owner due-date record required before activation.",
|
||||
"Q5": "Dedicated read:repository PAT vault custody conditional fallback, exact7private grants; ESO15minute token is delivery authentication, not PATexpiry."
|
||||
},
|
||||
"execution_boundary": [
|
||||
"Founder exact revision disposition and independent otherowner reviews remain required.",
|
||||
"Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.",
|
||||
"Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.",
|
||||
"No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.",
|
||||
"Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven."
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"r1": {
|
||||
"script_sha256": "f7b4f2c7a0a85315d1229a1c96f8f0b255b9c17d77426d47f9b14df9a83787ae",
|
||||
"observed_items": 50,
|
||||
"expected_items": 51,
|
||||
"later_private_grant_seen": false,
|
||||
"calls": [
|
||||
"/user/repos?limit=100&page=1"
|
||||
]
|
||||
},
|
||||
"r2": {
|
||||
"script_sha256": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
|
||||
"observed_items": 51,
|
||||
"expected_items": 51,
|
||||
"later_private_grant_seen": true,
|
||||
"calls": [
|
||||
"/user/repos?limit=100&page=1",
|
||||
"/user/repos?limit=100&page=2",
|
||||
"/user/repos?limit=100&page=3"
|
||||
]
|
||||
}
|
||||
}
|
||||
122
docs/proposals/cust81-private-reader/target-api-contract-r1.json
Normal file
122
docs/proposals/cust81-private-reader/target-api-contract-r1.json
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
{
|
||||
"observed_at": "2026-10-14T22:51:05.088367+00:00",
|
||||
"authenticated": false,
|
||||
"mutations": false,
|
||||
"endpoint": "https://forgejo.coulomb.social",
|
||||
"version_response": "11.0.3+gitea-1.22.0",
|
||||
"swagger_version": "11.0.3+gitea-1.22.0",
|
||||
"swagger_sha256": "fe7b5f952d860dfe2b0d423b66762d5d6df1ea06655c34228316c485a0ce999e",
|
||||
"swagger_routes": 291,
|
||||
"source_tag": "v11.0.3",
|
||||
"source_caveat": "Upstream tag matching reported version is contract evidence, not proof deployed binary/config identity or authenticated grants.",
|
||||
"source_files": [
|
||||
{
|
||||
"upstream_path": "services/auth/oauth2.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/auth/oauth2.go",
|
||||
"sha256": "cea158f620221a706643e7e3d3ae070d695c2eba9d51f886ed0aefa0f23a9bd0",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-services_auth_oauth2.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "models/unit/unit.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/unit/unit.go",
|
||||
"sha256": "338b7b84e24ddca589b1b4f2c0f5d55ee3c7d58b83c6119153e27ed275f0a404",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-models_unit_unit.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "modules/structs/repo.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/structs/repo.go",
|
||||
"sha256": "15a68b0af0f6bd97bf0631f2e7e9d92ccef673cf0cf04c04ae890e9307cec27f",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-modules_structs_repo.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/repo/repo.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/repo/repo.go",
|
||||
"sha256": "9a173231b982140e5d1794cacb9589ce7be71635e4f7e7f2b4a1a826250b7015",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_repo_repo.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "services/convert/convert.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/convert.go",
|
||||
"sha256": "921c52da59223e563f1f372536b0187aa01d149b4f8bb245adacdb2d2f5fc206",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_convert.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "models/user/user.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/user/user.go",
|
||||
"sha256": "ca81982afdf8775a3d1ab8965368da69a48f515daaf39e60212440dbf090447d",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-models_user_user.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "services/context/api.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/context/api.go",
|
||||
"sha256": "c1acaf81c7df31d17fdcc9b4ab504dec1d32b52ef9558ffe19237d38b468e78f",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-services_context_api.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "models/auth/access_token.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/auth/access_token.go",
|
||||
"sha256": "c3131e03c24356fb09fdd600efd17d8054063534355a4c5a3b769f840a58c8ac",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-models_auth_access_token.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "models/repo/repo_list.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/repo/repo_list.go",
|
||||
"sha256": "bb7833badf0fe7f6a2c800c2f301cb846b5968ce3f9e9bd29c3f1677db42acd9",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-models_repo_repo_list.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/utils/page.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/utils/page.go",
|
||||
"sha256": "1d286f60b5571513fb5a26a9243c22eae65f05d7be32dfe5d0f0b15d20550954",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_utils_page.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "services/convert/utils.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/utils.go",
|
||||
"sha256": "2689ffc579ea1df69457fbe84410fef101ae4a9580f0e56dcc3113a2988626b3",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_utils.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/user/app.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/app.go",
|
||||
"sha256": "14f5788e3b990b166004bd734c425f6da14d02b609a0034072455d9e6f6688b7",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_app.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/org/team.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/org/team.go",
|
||||
"sha256": "14a2e9781185d852676cbf49ee27e9ddc4430d5482e41f37197d72c47d1480a2",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_org_team.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/api.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/api.go",
|
||||
"sha256": "82d04743f1a5f80f6e818f5a45cdd789963e4b73f235d50cc3043dd8d8e090ef",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_api.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "modules/setting/api.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/setting/api.go",
|
||||
"sha256": "1f640ed884afaa6454c4bf427eccd2d6bb9a092fe37ac1aedfdc5eb85de4f7ba",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-modules_setting_api.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/user/repo.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/repo.go",
|
||||
"sha256": "adee62e6671aadd95b5013a64dbb690f2d81a0b9b4de0350c70b4153074ca6ec",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_repo.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/api/v1/admin/user.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/admin/user.go",
|
||||
"sha256": "b0b0453ac4f09da7a95f4b3fc369d2c8fe4b2c10c67796a65bf90af5287a9b6f",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_admin_user.go"
|
||||
},
|
||||
{
|
||||
"upstream_path": "routers/web/auth/oauth.go",
|
||||
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/web/auth/oauth.go",
|
||||
"sha256": "6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b",
|
||||
"local_cache": "/tmp/cust81-forge-contract-source/source-routers_web_auth_oauth.go"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
# Forge owner contract and execution evidence boundary
|
||||
|
||||
Public metadata was read without credentials or mutations at
|
||||
`https://forgejo.coulomb.social/api/v1/version` and `/swagger.v1.json`.
|
||||
Both report `11.0.3+gitea-1.22.0`. The matching upstream tag is contractual
|
||||
support; it does not establish deployed image bytes/configuration or grants.
|
||||
The exact public schema/source hashes are in `target-api-contract-r1.json`.
|
||||
|
||||
The current `/user/repos` endpoint is usable for effective grants: upstream
|
||||
`routers/api/v1/user/repo.go` defaults `Collaborate=None`, and
|
||||
`models/repo/repo_list.go` SearchRepositoryCondition combines ownership,
|
||||
UserAccessRepoCond and UserOrgTeamRepoCond. Swagger's "owns" description alone
|
||||
is insufficient. This corrects the initial owned-only hypothesis.
|
||||
|
||||
Every organization/team/member/repository/PAT list must be read completely.
|
||||
Upstream `routers/api/v1/utils/page.go` calls
|
||||
`services/convert/utils.go` ToCorrectPageSize; `modules/setting/api.go` defaults
|
||||
MaxResponseItems to 50. A request for limit100 can return50 with further pages.
|
||||
Read bounded pages until an empty terminal result or reconcile a valid stable
|
||||
X-Total-Count. Never infer completion from a short page relative to requested
|
||||
limit; reject duplicate identities/repeated pages, cap exhaustion and changing
|
||||
or invalid totals. Test page2 excluded private grant, unrelated team/token,
|
||||
server-cap7 and repeated/incomplete pages with synthetic fixtures.
|
||||
|
||||
GET token inventory supports administrator context: API router self-or-admin
|
||||
gate; ListAccessTokens reads ContextUser.ID and returns token_last_eight without
|
||||
the token. Create and DELETE additionally require Basic or reverse-proxy auth.
|
||||
Exact token revocation therefore needs a reviewed method compatible with that
|
||||
auth contract (e.g. attended admin resets only dedicated user's random memory-only
|
||||
password, then user Basic deletes exact reviewed tokenID). An admin PAT alone
|
||||
cannot satisfy the Basic-only DELETE gate. The original tokenID and ambiguity
|
||||
must remain durable; an observation timeout never authorizes a remint.
|
||||
|
||||
The intended team code-read flags and restricted private non-admin user fields
|
||||
exist in the observed API schema. Non-code units none are valid; upstream
|
||||
MinUnitAccessMode deliberately ignores none while finding a positive minimum.
|
||||
Bearer PAT headers are accepted by services/auth/oauth2.go parseToken. Still,
|
||||
only actual native fetch after approved provisioning can prove installed route
|
||||
behavior and consented index/entry hashes.
|
||||
|
||||
SEC-DSM §37 is evaluated in order:
|
||||
|
||||
1. Q1: Current native HTTP interface does not demonstrate direct projected SA
|
||||
identity at the forge; changing visibility or transport is outside scope.
|
||||
2. Q2: Human KeyCape OIDC login is not machine-token exchange. Matching upstream
|
||||
authentication validates Forgejo-owned OAuth tokens; no installed trust of
|
||||
arbitrary KeyCape workload JWTs is established.
|
||||
3. Q3: Forgejo supports expiring OAuth access tokens, so do not state it cannot
|
||||
issue ephemeral credentials. Matching token grant handler accepts only
|
||||
authorization_code and refresh_token, not client_credentials/token_exchange.
|
||||
Unattended refresh requires persistent authority; no viable installed
|
||||
workload-native ephemeral path is demonstrated. Keep target-owner execution
|
||||
confirmation gate and prefer a viable higher mechanism if surfaced.
|
||||
4. Q4: Proposed bootstrap can mint a dedicated reader but is not an automatic
|
||||
rotation controller. No automatic90day enforcement is demonstrated.
|
||||
5. Q5: A dedicated centrally vaulted PAT is a conditional static fallback with
|
||||
restricted target grants and owned manual rotation/revocation. ESO15minute
|
||||
Bao tokens expire delivery authority, not the PAT.
|
||||
|
||||
Approved attended verification must quietly prove `/user` under Sudo is the
|
||||
exact restricted reader; complete identities/organizations/teams/repos/PATs;
|
||||
exact seven private repos, no extra private effective grants, read permission;
|
||||
one PAT read:repository and token_last_eight binding to custody; native Bearer
|
||||
fetch matching consented hashes; excluded private repo/admin/actions denial.
|
||||
Only booleans/counts/IDs/hashes survive. No private source/error/token output.
|
||||
Record GENERATED_AT, rotation due_at<=90days, target tokenID, owner/recovery task
|
||||
and observed custody version; retain manual policy as manual. Revalidate public
|
||||
version/schema before mutation and halt drift until reviewed. No such attended
|
||||
proof or credential approval exists in this preparation.
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
---
|
||||
id: FORGE-WP-0007
|
||||
type: workplan
|
||||
title: "Review exact seven-source Reuse Surface Forgejo reader contract"
|
||||
domain: financials
|
||||
repo: railiance-forge
|
||||
status: active
|
||||
owner: codex
|
||||
created: "2026-10-15"
|
||||
updated: "2026-10-15"
|
||||
flavor: planning
|
||||
depends_on: []
|
||||
---
|
||||
|
||||
Review CCR-2026-0046 independently under railiance-forge INTENT Core Principles
|
||||
1, 4 and 6 (forge operation, stable handoffs, current/future forge contract).
|
||||
Preparation only; source disclosure consent does not grant credential issuance.
|
||||
This isolated checkout has its own supervised record and no autopilot or live
|
||||
credential authority. No hub task writes or integration commits occur here.
|
||||
|
||||
## Independently review target API and exact grant/lifecycle contract
|
||||
|
||||
```task
|
||||
id: FORGE-WP-0007-T01
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Public unauthenticated target metadata reports Forgejo 11.0.3+gitea-1.22.0.
|
||||
Matched Swagger and versioned upstream source were inspected. Initial suspicion
|
||||
that /user/repos omitted collaborators was disproven by the downstream model
|
||||
union; retain that correction in the owner review. Confirmed capped-pagination
|
||||
fixture truncates 51 effective grants to 50. Exact artifact-bound owner review is
|
||||
`docs/proposals/cust81-private-reader/forge-owner-review-r1.json`, disposition
|
||||
changes_requested. No authenticated target-state proof is claimed.
|
||||
|
||||
## Review platform correction and hand off final owner entry
|
||||
|
||||
```task
|
||||
id: FORGE-WP-0007-T02
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Review complete pagination and exact lifecycle recovery changes when platform
|
||||
worker delivers the revised bytes. Required deployment/credential evidence stays
|
||||
explicit as execution gates; approval of preparation does not assert target state
|
||||
or authorize runtime changes. Parent integrates file-bound owner entries.
|
||||
|
||||
Independent R2 owner design review is approved, exact artifact-bound in
|
||||
`forge-owner-review-r2.json`. Targeted23tests pass; independent cap50 fixture
|
||||
now observes51/51. Historical R1 changes_requested and artifact timing correction
|
||||
remain preserved. Preparation review is finished; approved attended activation
|
||||
proof/recovery/helper and rollout gates remain with owner execution work.
|
||||
|
||||
Final R2 refresh includes executable Basic-auth exact-PAT recovery; independently
|
||||
rerun28tests pass. Original R2 review preserved verbatim in
|
||||
`forge-owner-review-r2-before-recovery.json` with exact refresh diff/receipt.
|
||||
Recovery approval, manual due-date record and authenticated execution proof stay
|
||||
pending owner execution; no KV removal or remint is part of recovery.
|
||||
Loading…
Add table
Add a link
Reference in a new issue