security: verify runner listener closure and post-change CI

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

docs/forgejo-actions-runner-substrate.md

@@ -77,4 +77,21 @@ ssh coulombcore 'sudo systemctl disable --now forgejo-runner'
 ## References
 
 - `railiance-infra/docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`
-- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)
+- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)
+
+## October 13 Docker listener hardening
+
+Source railiance-apps `706461b` pins the exact previously running image digests
+and binds Docker to `127.0.0.1:2375`; DinD readiness now uses a local exec ping.
+No resource, replica, registration, credential or PVC change was made. Native
+generation 4 is Ready: local ping succeeds, other-pod ping refuses and the actual
+socket is loopback only. Runner heartbeat resumed. The normal source push ran
+CI workflow 7251 successfully, including host-smoke and container-smoke.
+
+This closes the reproduced unauthenticated cross-pod daemon exposure. Host-mode
+jobs still share the privileged runner boundary; workflow authority, required
+secret checks and job credential isolation remain FORGE-WP-0006-T03 work.
+Exact proposal, retained preflight refinement and guarded rollback: Custodian
+`docs/changes/CUST-WP-0080/forge-runner-loopback-operations.md`. Native receipts:
+`docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`
+and `forge-runner-post-change-ci.json`.

workplans/FORGE-WP-0006-independent-secret-detection.md

@@ -190,7 +190,7 @@ and session-revocation receipts remain required. Packet: Custodian
 
 ```task
 id: FORGE-WP-0006-T03
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "e65f9093-f615-5af9-a2c0-21e17ff35dcf"
 ```
@@ -202,3 +202,26 @@ positive governance, exact receipt and recovery path. Historical, log/artifact,
 runtime and LFS gaps stay explicit. Complete only with native prevention and
 response evidence for the admitted denominator; hand off residuals as live records
 before finishing. Do not claim all DSM-DETECT requirements from hook tests alone.
+
+2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping
+from another pod reproduced the wildcard listener defect. Exact revision 2 of
+FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps `706461b`, pinning the
+same running images and restricting Docker to loopback with local exec readiness.
+The conditional server dry-run and three patch tests pass. Generation 4 is Ready;
+loopback ping succeeds, other-pod ping refuses and the socket table contains only
+127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after;
+resource requests and Recreate strategy are unchanged (node CPU requests 86%).
+Fresh runner heartbeat is one second old. Normal source push `706461b` triggered
+workflow 7251; host-smoke and container-smoke both succeeded. Receipt:
+`docs/evidence/2026-10-13-netkingdom-security/forge-runner-post-change-ci.json`. The original revision-1 preflight is
+retained; revision 2 corrects rollback verification for the observed dual-stack
+wildcard. Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`.
+This closes the reproduced listener exposure only. Host jobs still share the
+privileged runner boundary; workflow authority, required detection checks and
+job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.
+
+Submodule follow-through: all four URLs use the retired forge NodePort. Two
+pinned commits are reachable in current managed repositories; the wiki and
+issue-facade repositories are absent. Neither URL rewriting alone nor an
+allowlist closes this dependency coverage. Custodian receipt:
+`docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-reconciliation.json`.