workplans: finish FORGE-WP-0006 on verified scope, carry residuals to FORGE-WP-0008

FORGE6-ROUTES-001 r3 verified live (26/26): authenticated HTTPS, content API
and merge paths refuse synthetic secrets. T02 done for its admitted scope;
T03 cancelled (not done) and carried unchanged with repo 55, import/mirror
and browser/SSO into the new FORGE-WP-0008.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 99543@bnt-lap001
Assistant-Session: 05d24177-20b9-4e96-a91b-b73be1d6e99e

workplans/FORGE-WP-0006-independent-secret-detection.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Enforce secret detection independently in the forge receive path"
 domain: financials
 repo: railiance-forge
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-10-12"
@@ -57,7 +57,7 @@ status does not count as a successful secret-detection test.
 
 ```task
 id: FORGE-WP-0006-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "210e7935-944a-5720-b356-18b48a68aa5e"
 ```
@@ -205,11 +205,29 @@ attended login, never a replay. Custodian evidence:
 `docs/evidence/2026-10-13-netkingdom-security/forge-routes-live.json` and
 `forge-routes-live.transport.json`.
 
+2026-10-18 authenticated routes verified live. Forgejo's log showed the revision 2
+clean merge got 405 in 17 ms during its post-refusal mergeability recheck.
+FORGE6-ROUTES-001 revision 3 waits for mergeable, retries only 405 (at most three
+times) and records status codes; 7 boundary tests and the isolated rehearsal
+(27 checks) passed first. The attended live run (founder OIDC/MFA) is `verified`:
+26/26 checks on owned private repository `custodian-routes-b15df5a32e9697ab47215efc`
+covering private creation with the exact inherited hook, anonymous denial, HTTPS
+clean/secret pushes with refs and quarantine absent, content API acceptance and
+refusal with detector evidence, secret merge-message refusal, clean merge (200 on
+first attempt) and verified deletion. Runner exit 0, no credential returned to
+the agent. Custodian `81f2f59`: `docs/evidence/2026-10-18-netkingdom-security/forge-routes-live-r3.json`.
+
+T02 is done for its admitted scope: receive-path prevention on 166 of 167
+repositories, template inheritance through restarts, and deployed SSH, HTTPS,
+content API and merge paths. Not covered and handed off to FORGE-WP-0008:
+repository 55 (four external submodules), import/mirror content arriving via
+clone/fetch, and the browser/SSO journey.
+
 ## Verify CI independence, detection response and complete coverage
 
 ```task
 id: FORGE-WP-0006-T03
-status: progress
+status: cancel
 priority: high
 state_hub_task_id: "e65f9093-f615-5af9-a2c0-21e17ff35dcf"
 ```
@@ -244,3 +262,10 @@ pinned commits are reachable in current managed repositories; the wiki and
 issue-facade repositories are absent. Neither URL rewriting alone nor an
 allowlist closes this dependency coverage. Custodian receipt:
 `docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-reconciliation.json`.
+
+2026-10-18 closed as `cancel`, not done: the runner-listener repair above is real,
+but CI independence (workflow authority, required checks, job-scoped
+credentials), private finding response with a revocation/rotation owner,
+false-positive governance and the historical/log/artifact/LFS gaps were never
+evidenced. They move unchanged as live records to FORGE-WP-0008 (T04-T06); no
+owner acceptance or DSM-DETECT conformance is claimed by closing this plan.

workplans/FORGE-WP-0008-secret-detection-residual-coverage.md

@@ -0,0 +1,100 @@
+---
+id: FORGE-WP-0008
+type: workplan
+title: "Close residual secret-detection coverage, CI independence and finding response"
+domain: financials
+repo: railiance-forge
+status: proposed
+owner: codex
+topic_slug: railiance
+created: "2026-10-18"
+updated: "2026-10-18"
+flavor: implementation
+depends_on: [FORGE-WP-0006]
+---
+
+Continues FORGE-WP-0006, which closed with receive-path prevention verified on
+166 of 167 repositories and on deployed SSH, HTTPS, content API and merge paths
+(Custodian `docs/evidence/2026-10-18-netkingdom-security/forge-routes-live-r3.json`).
+Everything below was explicitly left open there and is carried here unchanged.
+Coordinate with RMGR-WP-0021-T03/T04 and CUST-WP-0080 G07; do not invent owner
+acceptance. Reuse the admitted scanner, adapter and hook profile.
+
+## Bring repository 55 under the admitted profile
+
+```task
+id: FORGE-WP-0008-T01
+status: todo
+priority: high
+```
+
+Repository 55 is the only builtin-only repository. Its four submodule URLs use
+the retired forge NodePort; two pinned commits are reachable in managed
+repositories, the wiki and issue-facade repositories are absent. URL rewriting
+or an allowlist alone does not close this. Decide the compatibility treatment,
+admit the profile and re-run the inventory audit to 167/167.
+Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-reconciliation.json`.
+
+## Cover import and mirror content paths
+
+```task
+id: FORGE-WP-0008-T02
+status: todo
+priority: high
+```
+
+Upstream import and pull-mirror content arrives via clone/fetch, not
+receive-pack, so the pre-receive hook never sees it. Define and prove the
+control (scan on import/mirror sync, or disable those paths) for new and
+existing mirrors, with refusal or quarantine evidence.
+
+## Verify the browser/SSO journey
+
+```task
+id: FORGE-WP-0008-T03
+status: todo
+priority: medium
+```
+
+The live route acceptance used the API with a PAT. Prove web UI file edit,
+upload and merge under KeyCape SSO refuse a synthetic secret and accept clean
+content, in an owned disposable repository with verified cleanup.
+
+## Establish CI independence
+
+```task
+id: FORGE-WP-0008-T04
+status: todo
+priority: high
+```
+
+Carried from FORGE-WP-0006-T03. Review who can alter workflows, required checks
+and enforcement; host jobs still share the privileged runner boundary.
+Job-scoped credentials and required detection checks remain open with
+RMGR-WP-0021-T03/T04. The loopback listener repair (FORGE6-RUNNER-LOOPBACK-001)
+is already done and is not repeated here.
+
+## Exercise finding response
+
+```task
+id: FORGE-WP-0008-T05
+status: todo
+priority: high
+```
+
+Carried from FORGE-WP-0006-T03. Exercise private synthetic finding
+classification and routing with a named revocation/rotation owner,
+false-positive governance, an exact receipt and the recovery path.
+
+## Record historical, log, artifact and LFS detection gaps
+
+```task
+id: FORGE-WP-0008-T06
+status: todo
+priority: medium
+```
+
+Carried from FORGE-WP-0006-T03. Receive hooks only see introduced history.
+Record the gaps for existing history, logs, CI artifacts, runtime and LFS as
+explicit residuals, or close them with evidence. Do not claim DSM-DETECT
+conformance from hook tests alone.