From 5f05cf12ff731c416051cdff13c7a34162262a39 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 02:34:26 +0200 Subject: [PATCH] workplans: finish FORGE-WP-0006 on verified scope, carry residuals to FORGE-WP-0008 FORGE6-ROUTES-001 r3 verified live (26/26): authenticated HTTPS, content API and merge paths refuse synthetic secrets. T02 done for its admitted scope; T03 cancelled (not done) and carried unchanged with repo 55, import/mirror and browser/SSO into the new FORGE-WP-0008. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 99543@bnt-lap001 Assistant-Session: 05d24177-20b9-4e96-a91b-b73be1d6e99e --- ...GE-WP-0006-independent-secret-detection.md | 31 +++++- ...0008-secret-detection-residual-coverage.md | 100 ++++++++++++++++++ 2 files changed, 128 insertions(+), 3 deletions(-) create mode 100644 workplans/FORGE-WP-0008-secret-detection-residual-coverage.md diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md index 4e2b26a..55ba7bd 100644 --- a/workplans/FORGE-WP-0006-independent-secret-detection.md +++ b/workplans/FORGE-WP-0006-independent-secret-detection.md @@ -4,7 +4,7 @@ type: workplan title: "Enforce secret detection independently in the forge receive path" domain: financials repo: railiance-forge -status: active +status: finished owner: codex topic_slug: railiance created: "2026-10-12" @@ -57,7 +57,7 @@ status does not count as a successful secret-detection test. ```task id: FORGE-WP-0006-T02 -status: progress +status: done priority: high state_hub_task_id: "210e7935-944a-5720-b356-18b48a68aa5e" ``` @@ -205,11 +205,29 @@ attended login, never a replay. Custodian evidence: `docs/evidence/2026-10-13-netkingdom-security/forge-routes-live.json` and `forge-routes-live.transport.json`. +2026-10-18 authenticated routes verified live. Forgejo's log showed the revision 2 +clean merge got 405 in 17 ms during its post-refusal mergeability recheck. +FORGE6-ROUTES-001 revision 3 waits for mergeable, retries only 405 (at most three +times) and records status codes; 7 boundary tests and the isolated rehearsal +(27 checks) passed first. The attended live run (founder OIDC/MFA) is `verified`: +26/26 checks on owned private repository `custodian-routes-b15df5a32e9697ab47215efc` +covering private creation with the exact inherited hook, anonymous denial, HTTPS +clean/secret pushes with refs and quarantine absent, content API acceptance and +refusal with detector evidence, secret merge-message refusal, clean merge (200 on +first attempt) and verified deletion. Runner exit 0, no credential returned to +the agent. Custodian `81f2f59`: `docs/evidence/2026-10-18-netkingdom-security/forge-routes-live-r3.json`. + +T02 is done for its admitted scope: receive-path prevention on 166 of 167 +repositories, template inheritance through restarts, and deployed SSH, HTTPS, +content API and merge paths. Not covered and handed off to FORGE-WP-0008: +repository 55 (four external submodules), import/mirror content arriving via +clone/fetch, and the browser/SSO journey. + ## Verify CI independence, detection response and complete coverage ```task id: FORGE-WP-0006-T03 -status: progress +status: cancel priority: high state_hub_task_id: "e65f9093-f615-5af9-a2c0-21e17ff35dcf" ``` @@ -244,3 +262,10 @@ pinned commits are reachable in current managed repositories; the wiki and issue-facade repositories are absent. Neither URL rewriting alone nor an allowlist closes this dependency coverage. Custodian receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-reconciliation.json`. + +2026-10-18 closed as `cancel`, not done: the runner-listener repair above is real, +but CI independence (workflow authority, required checks, job-scoped +credentials), private finding response with a revocation/rotation owner, +false-positive governance and the historical/log/artifact/LFS gaps were never +evidenced. They move unchanged as live records to FORGE-WP-0008 (T04-T06); no +owner acceptance or DSM-DETECT conformance is claimed by closing this plan. diff --git a/workplans/FORGE-WP-0008-secret-detection-residual-coverage.md b/workplans/FORGE-WP-0008-secret-detection-residual-coverage.md new file mode 100644 index 0000000..5304312 --- /dev/null +++ b/workplans/FORGE-WP-0008-secret-detection-residual-coverage.md @@ -0,0 +1,100 @@ +--- +id: FORGE-WP-0008 +type: workplan +title: "Close residual secret-detection coverage, CI independence and finding response" +domain: financials +repo: railiance-forge +status: proposed +owner: codex +topic_slug: railiance +created: "2026-10-18" +updated: "2026-10-18" +flavor: implementation +depends_on: [FORGE-WP-0006] +--- + +Continues FORGE-WP-0006, which closed with receive-path prevention verified on +166 of 167 repositories and on deployed SSH, HTTPS, content API and merge paths +(Custodian `docs/evidence/2026-10-18-netkingdom-security/forge-routes-live-r3.json`). +Everything below was explicitly left open there and is carried here unchanged. +Coordinate with RMGR-WP-0021-T03/T04 and CUST-WP-0080 G07; do not invent owner +acceptance. Reuse the admitted scanner, adapter and hook profile. + +## Bring repository 55 under the admitted profile + +```task +id: FORGE-WP-0008-T01 +status: todo +priority: high +``` + +Repository 55 is the only builtin-only repository. Its four submodule URLs use +the retired forge NodePort; two pinned commits are reachable in managed +repositories, the wiki and issue-facade repositories are absent. URL rewriting +or an allowlist alone does not close this. Decide the compatibility treatment, +admit the profile and re-run the inventory audit to 167/167. +Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-reconciliation.json`. + +## Cover import and mirror content paths + +```task +id: FORGE-WP-0008-T02 +status: todo +priority: high +``` + +Upstream import and pull-mirror content arrives via clone/fetch, not +receive-pack, so the pre-receive hook never sees it. Define and prove the +control (scan on import/mirror sync, or disable those paths) for new and +existing mirrors, with refusal or quarantine evidence. + +## Verify the browser/SSO journey + +```task +id: FORGE-WP-0008-T03 +status: todo +priority: medium +``` + +The live route acceptance used the API with a PAT. Prove web UI file edit, +upload and merge under KeyCape SSO refuse a synthetic secret and accept clean +content, in an owned disposable repository with verified cleanup. + +## Establish CI independence + +```task +id: FORGE-WP-0008-T04 +status: todo +priority: high +``` + +Carried from FORGE-WP-0006-T03. Review who can alter workflows, required checks +and enforcement; host jobs still share the privileged runner boundary. +Job-scoped credentials and required detection checks remain open with +RMGR-WP-0021-T03/T04. The loopback listener repair (FORGE6-RUNNER-LOOPBACK-001) +is already done and is not repeated here. + +## Exercise finding response + +```task +id: FORGE-WP-0008-T05 +status: todo +priority: high +``` + +Carried from FORGE-WP-0006-T03. Exercise private synthetic finding +classification and routing with a named revocation/rotation owner, +false-positive governance, an exact receipt and the recovery path. + +## Record historical, log, artifact and LFS detection gaps + +```task +id: FORGE-WP-0008-T06 +status: todo +priority: medium +``` + +Carried from FORGE-WP-0006-T03. Receive hooks only see introduced history. +Record the gaps for existing history, logs, CI artifacts, runtime and LFS as +explicit residuals, or close them with evidence. Do not claim DSM-DETECT +conformance from hook tests alone.