From ec1d7c591af4823ab42168fe3b6e940c8559392b Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 14:04:02 +0200 Subject: [PATCH] security: record deployed Git template inheritance and rollback proof Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 --- ...GE-WP-0006-independent-secret-detection.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md index 202c510..389d28d 100644 --- a/workplans/FORGE-WP-0006-independent-secret-detection.md +++ b/workplans/FORGE-WP-0006-independent-secret-detection.md @@ -110,6 +110,32 @@ remain open. Upstream import/mirror paths use clone/fetch, not receive-pack, so template inheritance alone cannot prove those content paths covered. T02/T03 remain open; Custodian close-down checklist row 21 retains the uncovered control. +2026-10-13 template lifecycle deployed under exact proposal +FORGE6-TEMPLATE-LIFECYCLE-001. Release source railiance-apps `390a30a` adds an +immutable non-secret ConfigMap, read-only file subPath mounts (avoiding broken +ConfigMap symlinks in copied Git templates), the encoded environment-to-ini +setting, and a Make prerequisite so future Helm deploys retain the declaration. +The live rollout is a conditional additive Deployment patch: the old Helm +release is not reapplied over intervening live changes. The same Forgejo image +reached generation 12 Ready. Actual `/data/home/.gitconfig` selects the mounted +template; native Git init using that configuration copied the exact regular, +executable scanner hook and malformed input was refused. All original 22 hook +inventories and pinned binaries remain exact, health passes, and the owned probe +repository was removed. No production credential or identity changed. + +Thirty isolated exact-image checks passed for this file-mount/configuration +variant, including rollback to Git's default template while preserving existing +repository hooks. Six conditional-patch/rollback tests and the exact server +dry-run passed. Receipt: Custodian +`docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json`; +proposal/rollback executor: `docs/changes/CUST-WP-0080/forge-template-proposal.json` +and `activate_forge_template.py`. Rollback retains the ConfigMap inert and uses +an explicit default template selection because merely removing the environment +variable would leave the saved setting behind. Original immutable October 12 +activation remains bound to its old pod and must not be rewritten or replayed. +Authenticated production HTTP/SSO/frontend creation, the other 143 existing +repositories, import/mirror and wider detection/response coverage remain open. + ## Verify CI independence, detection response and complete coverage ```task