coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: prepare contained authenticated route acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 18:26:45 +02:00
parent bb513010af
commit 3dde887a65
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/FORGE-WP-0006-independent-secret-detection.md
View file

@ -171,6 +171,21 @@ and private response gates remain open; this is no whole-estate closure.
Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
and `forge-api-route-readiness.json`.
2026-10-13 authenticated-route preparation: FORGE6-ROUTES-001 revision 2
binds a silent contained operation to one newly created private disposable
repository. The exact shared suite passes 27 isolated pinned-image checks:
creation/inherited hook, anonymous denial, HTTPS clean/secret pushes, API content
acceptance/refusal, merge-message refusal/clean merge, unchanged refs, quarantine
and owned cleanup. Five boundary tests cover changed ownership, ambiguous-create
cleanup refusal, generic-error non-acceptance, redirect credential protection,
and silent digest-bound credential handoff. Read-only live preflight passes
under a private HOME. The failed first rehearsal and source-binding limitation
remain recorded. No production API mutation or credential fetch was performed.
The existing attended-window command is ready for caller OIDC/MFA; live route
and session-revocation receipts remain required. Packet: Custodian
`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence:
`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`.
## Verify CI independence, detection response and complete coverage
```task