diff --git a/.kaizen/agents/forge-reader-owner/supervision.json b/.kaizen/agents/forge-reader-owner/supervision.json new file mode 100644 index 0000000..4a7dce6 --- /dev/null +++ b/.kaizen/agents/forge-reader-owner/supervision.json @@ -0,0 +1,13 @@ +{ + "agent_id": "forge-reader-owner", + "repo": "railiance-forge", + "mode": "supervised", + "scope": "FORGE-WP-0007 independent CCR-2026-0046 preparation/review only", + "supervisor": "founder via root coordinating agent; no live grant delegated", + "runtime_enforcement": { + "verified": false, + "autopilot_granted": false + }, + "authority": "No custodian agent scope inherited; no admin credentials, live changes or approval recording authorized.", + "proposals": [] +} diff --git a/docs/proposals/cust81-private-reader/forge-owner-review-r1.json b/docs/proposals/cust81-private-reader/forge-owner-review-r1.json new file mode 100644 index 0000000..d6d9061 --- /dev/null +++ b/docs/proposals/cust81-private-reader/forge-owner-review-r1.json @@ -0,0 +1,58 @@ +{ + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "changes_requested", + "comment": "INTENT Core Principles 1/4/6 and Stable Handoffs require reliable exact grants and revocation evidence; FORGE-WP-0007-T01. Reviewed exact artifacts below. Public API version/schema supports identity/team/PAT contracts, but current pagination silently truncates server-capped lists; live grants/lifecycle remain unverified. No founder approval or target admission is recorded.", + "work_item": "FORGE-WP-0007-T01", + "reviewed_artifacts": { + "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "438f384215c7a1719c1e069dfa9723d5ddab4cfa9ceb64236acdb1cae4854f02", + "scripts/provision-reuse-surface-forgejo-source.py": "f7b4f2c7a0a85315d1229a1c96f8f0b255b9c17d77426d47f9b14df9a83787ae", + "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "1ca0192a5c066a1756f4d11a2fb840784c4a49088f77f575a6b2170f3a5ca47e", + "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b" + }, + "metadata_contract": "docs/proposals/cust81-private-reader/target-api-contract-r1.json", + "findings": [ + { + "id": "FORGE-CUST81-F01", + "severity": "blocking", + "status": "confirmed", + "summary": "Client.pages returns after first capped page because len(batch)<100; target default cap50. Extra private grant/otherteam/token on page2 escapes scope checks.", + "trace": "Client.pages -> limit=100 -> utils.GetListOptions -> convert.ToCorrectPageSize -> MaxResponseItems(default50).", + "fixture": { + "server_cap": 50, + "page1_items": 50, + "page2_items": 1, + "observed_items": 50, + "expected_items": 51, + "result": "confirmed_incomplete_inventory" + }, + "required_change": "Enumerate to authoritative empty page or reconcile X-Total-Count, bound pages/items, reject duplicate IDs/repeated pages, fail closed incomplete totals. Test 50+1 excluded grant and cap7 exact-repo case." + }, + { + "id": "FORGE-CUST81-F02", + "severity": "blocking", + "status": "contract_unverified_execution", + "summary": "Recovery/90day manual rotation has no exact executable revocation/CAS-update plan or dated operational record. PAT deletion requires Basic/reverse-proxy auth, not adminPAT alone.", + "trace": "api.go /users/{username}/tokens/{id} DELETE middleware reqBasicOrRevProxyAuth; user/app.go DeleteAccessToken binds ContextUser.ID.", + "required_change": "Prepare bounded exact-token recovery/revocation fixture and explicit rotation/due-date inventory. Keep manual90days as stated policy, not runtime expiry/enforcement." + }, + { + "id": "FORGE-CUST81-F03", + "severity": "blocking", + "status": "proof_missing", + "summary": "Source-contract evidence cannot prove existing target identities/grants or KeyCape federation/ephemeral machine issuer configuration.", + "required_change": "Before approval/execution, bind public expected targetversion and recheck; at approved attended execution use sanitized complete effective-grant proof incl sudo identity and token_last_eight; retain Q1\u2013Q3 confirmation gates." + } + ], + "rejected_preliminary_hypothesis": { + "summary": "Swagger /user/repos says owned, initially suspected missing collaborator grants.", + "resolution": "Not confirmed: ListMyRepos defaults Collaborate=None; model SearchRepositoryCondition unions ownership with UserAccessRepoCond and UserOrgTeamRepoCond. Keep /user/repos with source-proven semantics and complete pagination." + }, + "live_proof": { + "credentials_used": false, + "mutations": false, + "grants": null, + "token_issued": false, + "native_fetch": null + }, + "binding_correction": "Historical reviewed artifacts rebound to retained platform-r1 baseline and independent fixture rerun. Earlier temporary artifact hashing raced R2 script replacement; no approval relied on those interim bytes." +} diff --git a/docs/proposals/cust81-private-reader/forge-owner-review-r2-before-recovery.json b/docs/proposals/cust81-private-reader/forge-owner-review-r2-before-recovery.json new file mode 100644 index 0000000..18c8380 --- /dev/null +++ b/docs/proposals/cust81-private-reader/forge-owner-review-r2-before-recovery.json @@ -0,0 +1,54 @@ +{ + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "approved", + "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: provider owns target grant contract, dependable stable handoffs, and evidence reflecting current Forgejo runtime. Approve CCR-2026-0046 revision2 bounded design/preparation on exact artifact hashes below. Complete pagination defect is corrected and the versioned model proves effective /user/repos semantics. This is an owner review, not founder authorization or live target proof. Retain all declared pre-activation gates, especially bounded Basic-auth recovery helper/due-date task and separately reviewed consumer image+allowlist+apps rollout; no execution approval is inferred.", + "reviewed_revision": 2, + "reviewed_at": "2026-10-14T22:53:44.918962+00:00", + "work_item": "FORGE-WP-0007-T02", + "reviewed_artifacts": { + "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "1488d4c5928bf0af2735792855194c8c0d68cc738f1ae5c8a0fba947cd176a1d", + "scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b", + "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "bd235d93cdb1b4f432ae4b2755e0cb80da93a21f7feab115b2a61ea931d656f9", + "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b", + "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b" + }, + "validation": { + "targeted_unittest": "23 passed, independently rerun", + "independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible", + "fixture_receipt": "pagination-independent-fixture-results.json", + "static_target_contract": "target-api-contract-r1.json", + "live_credentials_used": false, + "live_mutations": false, + "live_effective_grants_verified": false, + "live_native_fetch_verified": false + }, + "r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success", + "contract_findings_resolved": [ + { + "id": "FORGE-CUST81-F01", + "resolution": "Bounded page-until-empty; duplicate/missingID and optional stable-total reconciliation; independent capped50 fixture includes excluded page2 grant; late-collaborator test rejects before mutation." + }, + { + "id": "FORGE-CUST81-F02", + "resolution": "CCR explicitly states manual quarterly policy lacks expiry enforcement and requires due-date owner task/receipt plus executable Basic recovery helper before activation. Deactivation now states exact-token reset+Basic deletion compatible with API; helper/approval remains gate, not claimed complete." + }, + { + "id": "FORGE-CUST81-F03", + "resolution": "Public deployed version/schema inspected; matching version source establishes contract support. Installed target grants, Sudoidentity, machinefederation/ephemeral issuance, and native consumer route behavior remain explicit attended verification gates." + } + ], + "sec_dsm_order": { + "Q1": "No direct Kubernetes identity accepted by current raw HTTP route is demonstrated.", + "Q2": "KeyCape human login does not establish machine API federation; no installed workload JWT trust demonstrated.", + "Q3": "Upstream Forgejo OAuth can issue expiring access tokens, but supports authorization_code/refresh_token only; no viable workload client_credentials/token_exchange demonstrated. Therefore static fallback is conditional, not universal target incapability claim.", + "Q4": "No automatic rotation demonstrated; manual90day policy and target owner due-date record required before activation.", + "Q5": "Dedicated read:repository PAT vault custody conditional fallback, exact7private grants; ESO15minute token is delivery authentication, not PATexpiry." + }, + "execution_boundary": [ + "Founder exact revision disposition and independent otherowner reviews remain required.", + "Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.", + "Executable exact-token Basic recovery helper plus due-date task/receipt required before activation; separately reviewed rotationCAS update before rotation.", + "No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.", + "Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven." + ] +} diff --git a/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh-receipt.json b/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh-receipt.json new file mode 100644 index 0000000..a265a1c --- /dev/null +++ b/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh-receipt.json @@ -0,0 +1,11 @@ +{ + "proposal": "CCR-2026-0046", + "revision": 2, + "work_item": "FORGE-WP-0007-T02", + "old_review_sha256": "ad4ca9e794d202af447a47d3e895afcfdec4c91f021d919fd205f882d7886292", + "new_review_sha256": "30d9233f9e0514f5f2b1ff4ca9c4fc0a7c1aa56679d3fcc9b452bc1f4ad007a1", + "refresh_diff_sha256": "21bad3a4e07984115680f7877610a8889af863ab4b5c0476c696f303063310fa", + "reason": "Platform added executable exact-PAT Basic-auth rollback after original R2 owner review; same revision refinement retained, original review bytes preserved.", + "decision": "approved", + "live_mutation": false +} diff --git a/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh.diff b/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh.diff new file mode 100644 index 0000000..c427355 --- /dev/null +++ b/docs/proposals/cust81-private-reader/forge-owner-review-r2-recovery-refresh.diff @@ -0,0 +1,57 @@ +--- forge-owner-review-r2-before-recovery.json ++++ forge-owner-review-r2.json +@@ -1,26 +1,29 @@ + { + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "approved", +- "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: provider owns target grant contract, dependable stable handoffs, and evidence reflecting current Forgejo runtime. Approve CCR-2026-0046 revision2 bounded design/preparation on exact artifact hashes below. Complete pagination defect is corrected and the versioned model proves effective /user/repos semantics. This is an owner review, not founder authorization or live target proof. Retain all declared pre-activation gates, especially bounded Basic-auth recovery helper/due-date task and separately reviewed consumer image+allowlist+apps rollout; no execution approval is inferred.", ++ "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.", + "reviewed_revision": 2, +- "reviewed_at": "2026-10-14T22:53:44.918962+00:00", ++ "reviewed_at": "2026-10-14T23:08:34.771501+00:00", + "work_item": "FORGE-WP-0007-T02", + "reviewed_artifacts": { +- "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "1488d4c5928bf0af2735792855194c8c0d68cc738f1ae5c8a0fba947cd176a1d", ++ "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643", + "scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b", +- "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "bd235d93cdb1b4f432ae4b2755e0cb80da93a21f7feab115b2a61ea931d656f9", ++ "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b", + "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b", +- "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b" ++ "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b", ++ "scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162", ++ "tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d" + }, + "validation": { +- "targeted_unittest": "23 passed, independently rerun", ++ "targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)", + "independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible", + "fixture_receipt": "pagination-independent-fixture-results.json", + "static_target_contract": "target-api-contract-r1.json", + "live_credentials_used": false, + "live_mutations": false, + "live_effective_grants_verified": false, +- "live_native_fetch_verified": false ++ "live_native_fetch_verified": false, ++ "recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token." + }, + "r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success", + "contract_findings_resolved": [ +@@ -30,7 +33,7 @@ + }, + { + "id": "FORGE-CUST81-F02", +- "resolution": "CCR explicitly states manual quarterly policy lacks expiry enforcement and requires due-date owner task/receipt plus executable Basic recovery helper before activation. Deactivation now states exact-token reset+Basic deletion compatible with API; helper/approval remains gate, not claimed complete." ++ "resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation." + }, + { + "id": "FORGE-CUST81-F03", +@@ -47,7 +50,7 @@ + "execution_boundary": [ + "Founder exact revision disposition and independent otherowner reviews remain required.", + "Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.", +- "Executable exact-token Basic recovery helper plus due-date task/receipt required before activation; separately reviewed rotationCAS update before rotation.", ++ "Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.", + "No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.", + "Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven." + ] diff --git a/docs/proposals/cust81-private-reader/forge-owner-review-r2.json b/docs/proposals/cust81-private-reader/forge-owner-review-r2.json new file mode 100644 index 0000000..5490bdf --- /dev/null +++ b/docs/proposals/cust81-private-reader/forge-owner-review-r2.json @@ -0,0 +1,57 @@ +{ + "reviewer": "railiance-forge-owner (agent railiance-forge, codex)", + "decision": "approved", + "comment": "FORGE-WP-0007-T02; INTENT Core Principles 1/4/6: dependable provider-owned target grants and stable handoffs. Approve CCR-2026-0046 revision2 bounded design/preparation, refreshed against final exact artifacts including executable rollback. Page-completeness correction remains verified; recovery resets only dedicated user password, Basic-revokes exactly approved PAT ID/name after single-token inventory, read-only reconciles ambiguity, and never remints or changes KV/delivery. This owner review is not founder authorization or authenticated live proof. Preserve separate exact-token recovery authorization, manual due-date task/receipt and independently reviewed image/allowlist/apps rollout gates before activation. Same proposal/review workitem, not a new successful trial.", + "reviewed_revision": 2, + "reviewed_at": "2026-10-14T23:08:34.771501+00:00", + "work_item": "FORGE-WP-0007-T02", + "reviewed_artifacts": { + "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643", + "scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b", + "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b", + "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b", + "tests/test_reuse_surface_forgejo_source_provision.py": "0d06fd22596a0f17ecd8dd5ff6a12bb1b1782258d00126ad468661099d7d298b", + "scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162", + "tests/test_reuse_surface_forgejo_source_recovery.py": "08247129b220c198d8f7d1322ce63956203b9ffcaa0342e52990bb6520fd138d" + }, + "validation": { + "targeted_unittest": "28 passed independently rerun (23 provisioning + 5 recovery)", + "independent_capped_page_fixture": "R1 50/51, R2 51/51 and page2 excluded-private grant visible", + "fixture_receipt": "pagination-independent-fixture-results.json", + "static_target_contract": "target-api-contract-r1.json", + "live_credentials_used": false, + "live_mutations": false, + "live_effective_grants_verified": false, + "live_native_fetch_verified": false, + "recovery_contract": "Observed version-tag API requires Basic/reverse-proxy for DELETE. Recovery PATCH uses admin API then reader Basic DELETE exactly approved ID; current inventory checks matching name/scopes and fails on any additional token." + }, + "r1_disposition_preserved": "forge-owner-review-r1.json changes_requested; same CCR trial refined, not unchanged success", + "contract_findings_resolved": [ + { + "id": "FORGE-CUST81-F01", + "resolution": "Bounded page-until-empty; duplicate/missingID and optional stable-total reconciliation; independent capped50 fixture includes excluded page2 grant; late-collaborator test rejects before mutation." + }, + { + "id": "FORGE-CUST81-F02", + "resolution": "Executable separately approved recovery helper now supplied and reviewed: exact bounded single PAT inventory then dedicated password reset and Basic delete; ambiguous DELETE read-only reconciliation with no repeat; absent-token noop no mutations; no KV/delete/remint. CCR still requires manual due-date task/receipt and separate exact-token recovery approval before activation." + }, + { + "id": "FORGE-CUST81-F03", + "resolution": "Public deployed version/schema inspected; matching version source establishes contract support. Installed target grants, Sudoidentity, machinefederation/ephemeral issuance, and native consumer route behavior remain explicit attended verification gates." + } + ], + "sec_dsm_order": { + "Q1": "No direct Kubernetes identity accepted by current raw HTTP route is demonstrated.", + "Q2": "KeyCape human login does not establish machine API federation; no installed workload JWT trust demonstrated.", + "Q3": "Upstream Forgejo OAuth can issue expiring access tokens, but supports authorization_code/refresh_token only; no viable workload client_credentials/token_exchange demonstrated. Therefore static fallback is conditional, not universal target incapability claim.", + "Q4": "No automatic rotation demonstrated; manual90day policy and target owner due-date record required before activation.", + "Q5": "Dedicated read:repository PAT vault custody conditional fallback, exact7private grants; ESO15minute token is delivery authentication, not PATexpiry." + }, + "execution_boundary": [ + "Founder exact revision disposition and independent otherowner reviews remain required.", + "Before any mutation revalidate public expected version/schema; quiet attended Sudo /user identity and complete grant inventory must prove restricted targetreader rather than administrator.", + "Manual due-date task/receipt and separate exact-token recovery approval remain required before activation; executable recovery helper is prepared, not live-tested. Separately reviewed scoped CAS update before rotation.", + "No credential delivery until verified consumer redirect/HTTPS/exact14URL allowlist image and appsowner rollout.", + "Target token inventory IDs/token_last_eight and actual grants are only claimed after authenticated sanitized receipts; final nativefetch and hosted70/70 remain unproven." + ] +} diff --git a/docs/proposals/cust81-private-reader/pagination-independent-fixture-results.json b/docs/proposals/cust81-private-reader/pagination-independent-fixture-results.json new file mode 100644 index 0000000..88998d2 --- /dev/null +++ b/docs/proposals/cust81-private-reader/pagination-independent-fixture-results.json @@ -0,0 +1,22 @@ +{ + "r1": { + "script_sha256": "f7b4f2c7a0a85315d1229a1c96f8f0b255b9c17d77426d47f9b14df9a83787ae", + "observed_items": 50, + "expected_items": 51, + "later_private_grant_seen": false, + "calls": [ + "/user/repos?limit=100&page=1" + ] + }, + "r2": { + "script_sha256": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b", + "observed_items": 51, + "expected_items": 51, + "later_private_grant_seen": true, + "calls": [ + "/user/repos?limit=100&page=1", + "/user/repos?limit=100&page=2", + "/user/repos?limit=100&page=3" + ] + } +} diff --git a/docs/proposals/cust81-private-reader/target-api-contract-r1.json b/docs/proposals/cust81-private-reader/target-api-contract-r1.json new file mode 100644 index 0000000..b03d615 --- /dev/null +++ b/docs/proposals/cust81-private-reader/target-api-contract-r1.json @@ -0,0 +1,122 @@ +{ + "observed_at": "2026-10-14T22:51:05.088367+00:00", + "authenticated": false, + "mutations": false, + "endpoint": "https://forgejo.coulomb.social", + "version_response": "11.0.3+gitea-1.22.0", + "swagger_version": "11.0.3+gitea-1.22.0", + "swagger_sha256": "fe7b5f952d860dfe2b0d423b66762d5d6df1ea06655c34228316c485a0ce999e", + "swagger_routes": 291, + "source_tag": "v11.0.3", + "source_caveat": "Upstream tag matching reported version is contract evidence, not proof deployed binary/config identity or authenticated grants.", + "source_files": [ + { + "upstream_path": "services/auth/oauth2.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/auth/oauth2.go", + "sha256": "cea158f620221a706643e7e3d3ae070d695c2eba9d51f886ed0aefa0f23a9bd0", + "local_cache": "/tmp/cust81-forge-contract-source/source-services_auth_oauth2.go" + }, + { + "upstream_path": "models/unit/unit.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/unit/unit.go", + "sha256": "338b7b84e24ddca589b1b4f2c0f5d55ee3c7d58b83c6119153e27ed275f0a404", + "local_cache": "/tmp/cust81-forge-contract-source/source-models_unit_unit.go" + }, + { + "upstream_path": "modules/structs/repo.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/structs/repo.go", + "sha256": "15a68b0af0f6bd97bf0631f2e7e9d92ccef673cf0cf04c04ae890e9307cec27f", + "local_cache": "/tmp/cust81-forge-contract-source/source-modules_structs_repo.go" + }, + { + "upstream_path": "routers/api/v1/repo/repo.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/repo/repo.go", + "sha256": "9a173231b982140e5d1794cacb9589ce7be71635e4f7e7f2b4a1a826250b7015", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_repo_repo.go" + }, + { + "upstream_path": "services/convert/convert.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/convert.go", + "sha256": "921c52da59223e563f1f372536b0187aa01d149b4f8bb245adacdb2d2f5fc206", + "local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_convert.go" + }, + { + "upstream_path": "models/user/user.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/user/user.go", + "sha256": "ca81982afdf8775a3d1ab8965368da69a48f515daaf39e60212440dbf090447d", + "local_cache": "/tmp/cust81-forge-contract-source/source-models_user_user.go" + }, + { + "upstream_path": "services/context/api.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/context/api.go", + "sha256": "c1acaf81c7df31d17fdcc9b4ab504dec1d32b52ef9558ffe19237d38b468e78f", + "local_cache": "/tmp/cust81-forge-contract-source/source-services_context_api.go" + }, + { + "upstream_path": "models/auth/access_token.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/auth/access_token.go", + "sha256": "c3131e03c24356fb09fdd600efd17d8054063534355a4c5a3b769f840a58c8ac", + "local_cache": "/tmp/cust81-forge-contract-source/source-models_auth_access_token.go" + }, + { + "upstream_path": "models/repo/repo_list.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/models/repo/repo_list.go", + "sha256": "bb7833badf0fe7f6a2c800c2f301cb846b5968ce3f9e9bd29c3f1677db42acd9", + "local_cache": "/tmp/cust81-forge-contract-source/source-models_repo_repo_list.go" + }, + { + "upstream_path": "routers/api/v1/utils/page.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/utils/page.go", + "sha256": "1d286f60b5571513fb5a26a9243c22eae65f05d7be32dfe5d0f0b15d20550954", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_utils_page.go" + }, + { + "upstream_path": "services/convert/utils.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/services/convert/utils.go", + "sha256": "2689ffc579ea1df69457fbe84410fef101ae4a9580f0e56dcc3113a2988626b3", + "local_cache": "/tmp/cust81-forge-contract-source/source-services_convert_utils.go" + }, + { + "upstream_path": "routers/api/v1/user/app.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/app.go", + "sha256": "14f5788e3b990b166004bd734c425f6da14d02b609a0034072455d9e6f6688b7", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_app.go" + }, + { + "upstream_path": "routers/api/v1/org/team.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/org/team.go", + "sha256": "14a2e9781185d852676cbf49ee27e9ddc4430d5482e41f37197d72c47d1480a2", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_org_team.go" + }, + { + "upstream_path": "routers/api/v1/api.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/api.go", + "sha256": "82d04743f1a5f80f6e818f5a45cdd789963e4b73f235d50cc3043dd8d8e090ef", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_api.go" + }, + { + "upstream_path": "modules/setting/api.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/setting/api.go", + "sha256": "1f640ed884afaa6454c4bf427eccd2d6bb9a092fe37ac1aedfdc5eb85de4f7ba", + "local_cache": "/tmp/cust81-forge-contract-source/source-modules_setting_api.go" + }, + { + "upstream_path": "routers/api/v1/user/repo.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/user/repo.go", + "sha256": "adee62e6671aadd95b5013a64dbb690f2d81a0b9b4de0350c70b4153074ca6ec", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_user_repo.go" + }, + { + "upstream_path": "routers/api/v1/admin/user.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/api/v1/admin/user.go", + "sha256": "b0b0453ac4f09da7a95f4b3fc369d2c8fe4b2c10c67796a65bf90af5287a9b6f", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_api_v1_admin_user.go" + }, + { + "upstream_path": "routers/web/auth/oauth.go", + "url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/routers/web/auth/oauth.go", + "sha256": "6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b", + "local_cache": "/tmp/cust81-forge-contract-source/source-routers_web_auth_oauth.go" + } + ] +} diff --git a/docs/proposals/cust81-private-reader/target-contract-verification-plan.md b/docs/proposals/cust81-private-reader/target-contract-verification-plan.md new file mode 100644 index 0000000..cb19583 --- /dev/null +++ b/docs/proposals/cust81-private-reader/target-contract-verification-plan.md @@ -0,0 +1,69 @@ +# Forge owner contract and execution evidence boundary + +Public metadata was read without credentials or mutations at +`https://forgejo.coulomb.social/api/v1/version` and `/swagger.v1.json`. +Both report `11.0.3+gitea-1.22.0`. The matching upstream tag is contractual +support; it does not establish deployed image bytes/configuration or grants. +The exact public schema/source hashes are in `target-api-contract-r1.json`. + +The current `/user/repos` endpoint is usable for effective grants: upstream +`routers/api/v1/user/repo.go` defaults `Collaborate=None`, and +`models/repo/repo_list.go` SearchRepositoryCondition combines ownership, +UserAccessRepoCond and UserOrgTeamRepoCond. Swagger's "owns" description alone +is insufficient. This corrects the initial owned-only hypothesis. + +Every organization/team/member/repository/PAT list must be read completely. +Upstream `routers/api/v1/utils/page.go` calls +`services/convert/utils.go` ToCorrectPageSize; `modules/setting/api.go` defaults +MaxResponseItems to 50. A request for limit100 can return50 with further pages. +Read bounded pages until an empty terminal result or reconcile a valid stable +X-Total-Count. Never infer completion from a short page relative to requested +limit; reject duplicate identities/repeated pages, cap exhaustion and changing +or invalid totals. Test page2 excluded private grant, unrelated team/token, +server-cap7 and repeated/incomplete pages with synthetic fixtures. + +GET token inventory supports administrator context: API router self-or-admin +gate; ListAccessTokens reads ContextUser.ID and returns token_last_eight without +the token. Create and DELETE additionally require Basic or reverse-proxy auth. +Exact token revocation therefore needs a reviewed method compatible with that +auth contract (e.g. attended admin resets only dedicated user's random memory-only +password, then user Basic deletes exact reviewed tokenID). An admin PAT alone +cannot satisfy the Basic-only DELETE gate. The original tokenID and ambiguity +must remain durable; an observation timeout never authorizes a remint. + +The intended team code-read flags and restricted private non-admin user fields +exist in the observed API schema. Non-code units none are valid; upstream +MinUnitAccessMode deliberately ignores none while finding a positive minimum. +Bearer PAT headers are accepted by services/auth/oauth2.go parseToken. Still, +only actual native fetch after approved provisioning can prove installed route +behavior and consented index/entry hashes. + +SEC-DSM ยง37 is evaluated in order: + +1. Q1: Current native HTTP interface does not demonstrate direct projected SA + identity at the forge; changing visibility or transport is outside scope. +2. Q2: Human KeyCape OIDC login is not machine-token exchange. Matching upstream + authentication validates Forgejo-owned OAuth tokens; no installed trust of + arbitrary KeyCape workload JWTs is established. +3. Q3: Forgejo supports expiring OAuth access tokens, so do not state it cannot + issue ephemeral credentials. Matching token grant handler accepts only + authorization_code and refresh_token, not client_credentials/token_exchange. + Unattended refresh requires persistent authority; no viable installed + workload-native ephemeral path is demonstrated. Keep target-owner execution + confirmation gate and prefer a viable higher mechanism if surfaced. +4. Q4: Proposed bootstrap can mint a dedicated reader but is not an automatic + rotation controller. No automatic90day enforcement is demonstrated. +5. Q5: A dedicated centrally vaulted PAT is a conditional static fallback with + restricted target grants and owned manual rotation/revocation. ESO15minute + Bao tokens expire delivery authority, not the PAT. + +Approved attended verification must quietly prove `/user` under Sudo is the +exact restricted reader; complete identities/organizations/teams/repos/PATs; +exact seven private repos, no extra private effective grants, read permission; +one PAT read:repository and token_last_eight binding to custody; native Bearer +fetch matching consented hashes; excluded private repo/admin/actions denial. +Only booleans/counts/IDs/hashes survive. No private source/error/token output. +Record GENERATED_AT, rotation due_at<=90days, target tokenID, owner/recovery task +and observed custody version; retain manual policy as manual. Revalidate public +version/schema before mutation and halt drift until reviewed. No such attended +proof or credential approval exists in this preparation. diff --git a/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md b/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md new file mode 100644 index 0000000..d5b79a4 --- /dev/null +++ b/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md @@ -0,0 +1,60 @@ +--- +id: FORGE-WP-0007 +type: workplan +title: "Review exact seven-source Reuse Surface Forgejo reader contract" +domain: financials +repo: railiance-forge +status: active +owner: codex +created: "2026-10-15" +updated: "2026-10-15" +flavor: planning +depends_on: [] +--- + +Review CCR-2026-0046 independently under railiance-forge INTENT Core Principles +1, 4 and 6 (forge operation, stable handoffs, current/future forge contract). +Preparation only; source disclosure consent does not grant credential issuance. +This isolated checkout has its own supervised record and no autopilot or live +credential authority. No hub task writes or integration commits occur here. + +## Independently review target API and exact grant/lifecycle contract + +```task +id: FORGE-WP-0007-T01 +status: done +priority: high +``` + +Public unauthenticated target metadata reports Forgejo 11.0.3+gitea-1.22.0. +Matched Swagger and versioned upstream source were inspected. Initial suspicion +that /user/repos omitted collaborators was disproven by the downstream model +union; retain that correction in the owner review. Confirmed capped-pagination +fixture truncates 51 effective grants to 50. Exact artifact-bound owner review is +`docs/proposals/cust81-private-reader/forge-owner-review-r1.json`, disposition +changes_requested. No authenticated target-state proof is claimed. + +## Review platform correction and hand off final owner entry + +```task +id: FORGE-WP-0007-T02 +status: done +priority: high +``` + +Review complete pagination and exact lifecycle recovery changes when platform +worker delivers the revised bytes. Required deployment/credential evidence stays +explicit as execution gates; approval of preparation does not assert target state +or authorize runtime changes. Parent integrates file-bound owner entries. + +Independent R2 owner design review is approved, exact artifact-bound in +`forge-owner-review-r2.json`. Targeted23tests pass; independent cap50 fixture +now observes51/51. Historical R1 changes_requested and artifact timing correction +remain preserved. Preparation review is finished; approved attended activation +proof/recovery/helper and rollout gates remain with owner execution work. + +Final R2 refresh includes executable Basic-auth exact-PAT recovery; independently +rerun28tests pass. Original R2 review preserved verbatim in +`forge-owner-review-r2-before-recovery.json` with exact refresh diff/receipt. +Recovery approval, manual due-date record and authenticated execution proof stay +pending owner execution; no KV removal or remint is part of recovery.