coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record attended live route trial for FORGE-WP-0006-T02
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
FORGE6-ROUTES-001 ran live under founder OIDC/MFA: 24/25 checks passed
(HTTPS push/refusal, content API, merge-message refusal, cleanup), but
the clean merge was not accepted, so the trial is unverified and T02
stays in progress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 99543@bnt-lap001
Assistant-Session: 05d24177-20b9-4e96-a91b-b73be1d6e99e
This commit is contained in:
tegwick 2026-10-18 02:19:23 +02:00
parent fcc3a57f6a
commit d2cf22920b
1 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/FORGE-WP-0006-independent-secret-detection.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: railiance
created: "2026-10-12"
updated: "2026-10-13"
updated: "2026-10-18"
flavor: implementation
depends_on: []
state_hub_workstream_id: "69458fdc-d727-5391-b88b-d03da0afe24e"
@ -186,6 +186,25 @@ and session-revocation receipts remain required. Packet: Custodian
`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence:
`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`.
2026-10-18 attended live run of FORGE6-ROUTES-001 (founder OIDC/MFA, contained
lane) is a failed trial: result `unverified`, failure phase `merge-api`, child
exit 1, no credential returned to the agent. 24 of 25 checks passed on owned
private repository 173: authenticated caller, private creation, anonymous
denial, exact inherited hook, HTTPS clean push, HTTPS secret refusal with refs
and quarantine objects absent, content API acceptance/refusal with detector
evidence, and secret-bearing merge-message refusal with the merge not applied.
The subsequent clean merge was not accepted (`clean_merge_accepted: false`), so
merge-path acceptance and `clean_merge_applied` remain unproven; raw diagnostics
were deliberately not retained, so the cause is not known. The isolated suite
passed the same step, so suspect a production-specific merge setting or a
post-refusal merge state, not the scanner. Cleanup verified identity, deleted
the repository and confirmed absence. An earlier garbled invocation that same
day never started the runner (no receipt, no transport file). The receipt is
consumed: a retry needs a new trial revision (fresh name/receipt) and another
attended login, never a replay. Custodian evidence:
`docs/evidence/2026-10-13-netkingdom-security/forge-routes-live.json` and
`forge-routes-live.transport.json`.
## Verify CI independence, detection response and complete coverage
```task