diff --git a/registry/capabilities/capability.railiance.forge-infrastructure.md b/registry/capabilities/capability.railiance.forge-infrastructure.md index 9dc21e2..9221cfa 100644 --- a/registry/capabilities/capability.railiance.forge-infrastructure.md +++ b/registry/capabilities/capability.railiance.forge-infrastructure.md @@ -1,9 +1,7 @@ --- id: capability.railiance.forge-infrastructure -name: Railiance Forge And Artifact Infrastructure -summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from - railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package - registries, and Actions runner substrate. +name: Source forge, registries and runner substrate +summary: Forgejo operation, package registries and runner lifecycle. owner: railiance-forge status: draft domain: financials @@ -12,21 +10,26 @@ tags: - forgejo - forge - ci-runner +- security +- netkingdom +- framework-reuse maturity: discovery: current: D3 target: D5 confidence: medium - rationale: README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration, - container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status - noted as 'active forge extraction' with canonical registry operation docs already landed. + rationale: README and SCOPE.md explicitly name 'current Gitea operation, future + Forgejo migration, container and package registries, Actions runner substrate, + artifact lifecycle' as the scope; status noted as 'active forge extraction' + with canonical registry operation docs already landed. availability: - current: A1 + current: A2 target: A3 confidence: medium - rationale: README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the - move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI - (not yet migrated to .forgejo itself, notably, despite owning the migration). + rationale: 'Source interface assessed 2026-10-14: Forgejo operation, package registries + and runner lifecycle. Availability describes the delivery form, not production + acceptance. Runner workload authority and independent verification coverage + remain open.' external_evidence: completeness: level: C1 @@ -43,87 +46,79 @@ external_evidence: basis: consumer_quality_signals known_reliability_risks: - repo is actively being founded/extracted; no live deploy yet by its own account - - directly relevant to REUSE-WP-0019 but hasn't migrated its own CI to .forgejo/ yet + - directly relevant to REUSE-WP-0019 but hasn't migrated its own CI to .forgejo/ + yet discovery: - intent: Own source forge, artifact registry, and CI runner substrate responsibilities for Railiance, - separated from application (railiance-apps) and enablement (railiance-enablement) concerns, across - the Gitea-to-Forgejo transition. + intent: Forgejo operation, package registries and runner lifecycle includes: - - forge operation (current Gitea, migrating to Forgejo) - - container/package registries - - Actions runner substrate - - artifact lifecycle + - Forgejo operation, package registries and runner lifecycle excludes: - - application workload deployment (railiance-apps) - - CI/CD templates for consuming repos (railiance-enablement) + - Runner workload authority and independent verification coverage remain open assumptions: [] - use_cases: [] + use_cases: + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' research_memos: [] availability: - current_level: A1 + current_level: A2 target_level: A3 current_artifacts: - - operator docs and tools/ (extraction in progress) + - SCOPE.md + - workplans/FORGE-WP-0006-independent-secret-detection.md target_artifacts: [] consumption_modes: - - cli (operator tooling) - - documentation/runbooks + - CLI + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.security.repository-secret-prevention + - capability.railiance.ci-enablement + - capability.railiance.workload-deployment-tooling evidence: documentation: - - README.md - SCOPE.md + - workplans/FORGE-WP-0006-independent-secret-detection.md tests: [] consumer_feedback: [] bug_reports: [] incidents: [] consumer_guidance: recommended_for: - - Railiance operators managing forge/registry/runner infrastructure, especially during the Gitea-to-Forgejo - transition + - Developer builds and publishes through controlled source, dependency and runner + paths not_recommended_for: - - treating this as production-stable — the repo's own README states the extraction is active and no - live deploy has run yet + - Runner workload authority and independent verification coverage remain open known_limitations: - - actively being founded; no live Helm/k8s deploy has run as part of the extraction yet; own CI still - under .gitea/ pending its own Forgejo migration -promotion_history: [] + - Runner workload authority and independent verification coverage remain open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A2 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex --- -# Railiance Forge And Artifact Infrastructure +# Source forge, registries and runner substrate -## Overview +Forgejo operation, package registries and runner lifecycle. -`railiance-forge` is being founded to separate source forge, artifact registry, and CI/Actions runner responsibilities from `railiance-apps` and `railiance-enablement`. It directly owns the current Gitea operation and the future Forgejo migration — of particular relevance to REUSE-WP-0019 — though by its own account no live deploy has run yet. +## Reuse boundary -## Assessment notes +Runner workload authority and independent verification coverage remain open. -### Discovery +## Supported use cases -README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration, container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status noted as 'active forge extraction' with canonical registry operation docs already landed. +- U12: Developer builds and publishes through controlled source, dependency and runner paths -### Availability +## Evidence and integration -README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI (not yet migrated to .forgejo itself, notably, despite owning the migration). +- [SCOPE.md](../../SCOPE.md) +- [workplans/FORGE-WP-0006-independent-secret-detection.md](../../workplans/FORGE-WP-0006-independent-secret-detection.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.forge-secret-prevention.md b/registry/capabilities/capability.security.forge-secret-prevention.md new file mode 100644 index 0000000..7e875db --- /dev/null +++ b/registry/capabilities/capability.security.forge-secret-prevention.md @@ -0,0 +1,96 @@ +--- +id: capability.security.forge-secret-prevention +owner: railiance-forge +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pinned receive adapter, lifecycle + template and fail-closed scan. Availability describes the delivery form, not + production acceptance. Dated native coverage excludes one repo; import/mirror + fetch and response coverage remain separate.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Independent introduced-history secret prevention +summary: Pinned receive adapter, lifecycle template and fail-closed scan. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pinned receive adapter, lifecycle template and fail-closed scan + includes: + - Pinned receive adapter, lifecycle template and fail-closed scan + excludes: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + use_cases: + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - workplans/FORGE-WP-0006-independent-secret-detection.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.repository-secret-prevention + - capability.railiance.ci-enablement + - capability.railiance.workload-deployment-tooling +evidence: + documentation: + - workplans/FORGE-WP-0006-independent-secret-detection.md +consumer_guidance: + recommended_for: + - Owner inventories, rotates, revokes and detects exposure of credentials + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + known_limitations: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Independent introduced-history secret prevention + +Pinned receive adapter, lifecycle template and fail-closed scan. + +## Reuse boundary + +Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate. + +## Supported use cases + +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [workplans/FORGE-WP-0006-independent-secret-detection.md](../../workplans/FORGE-WP-0006-independent-secret-detection.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 6437991..51cff6e 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,22 +1,38 @@ version: 1 -updated: '2026-07-06' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.railiance.forge-infrastructure - name: Railiance Forge And Artifact Infrastructure - summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from - railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package - registries, and Actions runner substrate. - vector: D3 / A1 / C1 / R0 + name: Source forge, registries and runner substrate + summary: Forgejo operation, package registries and runner lifecycle. domain: financials status: draft owner: railiance-forge - path: registry/capabilities/capability.railiance.forge-infrastructure.md tags: - railiance - forgejo - forge - ci-runner + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.forge-infrastructure.md consumption_modes: - - cli (operator tooling) - - documentation/runbooks + - CLI + - source +- id: capability.security.forge-secret-prevention + name: Independent introduced-history secret prevention + summary: Pinned receive adapter, lifecycle template and fail-closed scan. + domain: infotech + status: draft + owner: railiance-forge + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.forge-secret-prevention.md + consumption_modes: + - CLI + - source