From bc3cc92b0c087674bc6e551c9452cef6e06e416a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 22:45:15 +0100 Subject: [PATCH] FORGE-WP-ADHOC-2026-10-27: admit the filename-digest receive scanner The live Forgejo adapter now allows one generic-api-key match for a text filename whose value is a 64-character lowercase content digest. The two older admitted binaries stay on disk. Assistant: grok Assistant-Model: grok-4.7 Assistant-Session: 01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9 --- WORK-RECORDS.md | 4 ++-- workplans/ADHOC-2026-10-27.md | 14 ++++++++------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 5efb132..a86d3bf 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,7 +8,7 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | FORGE-WP-ADHOC-2026-10-27 | active | — | workplans/ADHOC-2026-10-27.md | +| workplan | FORGE-WP-ADHOC-2026-10-27 | finished | — | workplans/ADHOC-2026-10-27.md | | workplan | FORGE-WP-0006 | finished | — | workplans/FORGE-WP-0006-independent-secret-detection.md | | workplan | FORGE-WP-0007 | finished | — | workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md | | workplan | FORGE-WP-0008 | proposed | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md | @@ -17,7 +17,7 @@ | workplan | FORGE-WP-0011 | active | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | | workplan | RFORGE-WP-0002 | finished | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md | | task | FORGE-WP-ADHOC-2026-10-27-T01 | done | — | workplans/ADHOC-2026-10-27.md | -| task | FORGE-WP-ADHOC-2026-10-27-T02 | wait | — | workplans/ADHOC-2026-10-27.md | +| task | FORGE-WP-ADHOC-2026-10-27-T02 | done | — | workplans/ADHOC-2026-10-27.md | | task | FORGE-WP-0006-T01 | done | — | workplans/FORGE-WP-0006-independent-secret-detection.md | | task | FORGE-WP-0006-T02 | done | — | workplans/FORGE-WP-0006-independent-secret-detection.md | | task | FORGE-WP-0006-T03 | cancel | — | workplans/FORGE-WP-0006-independent-secret-detection.md | diff --git a/workplans/ADHOC-2026-10-27.md b/workplans/ADHOC-2026-10-27.md index 65824da..7d4ec21 100644 --- a/workplans/ADHOC-2026-10-27.md +++ b/workplans/ADHOC-2026-10-27.md @@ -4,7 +4,7 @@ type: workplan title: "Allow filename content digests in the receive scanner" domain: financials repo: railiance-forge -status: active +status: finished owner: grok created: "2026-10-27" updated: "2026-10-27" @@ -32,12 +32,14 @@ Repository `.gitleaks.toml` files and inline allow comments remain ignored. ```task id: FORGE-WP-ADHOC-2026-10-27-T02 -status: wait +status: done priority: high state_hub_task_id: "a2c3e425-a36f-59e0-a07f-600882b6a141" ``` -Source and the disposable scanner test do not change the installed pre-receive -adapter. The running Forgejo hook keeps the previous profile until this -executable is rebuilt and admitted. The emergent-security 0.2.7 push stays -blocked until that admission. +The admitted adapter is directory `20261027-b735d052a49f`, binary +`b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2`, template +`forgejo-secret-template-d1df801be39f`. The 20261012 and 20261018 binaries +remain in place. All 168 existing repository hooks now execute the new +adapter. Forgejo deployment `forge` was recreated and its health check passed. +emergent-security `8c903af` is on origin/main.