railiance-forge/workplans/FORGE-WP-0010-receive-scanner-budget.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
FORGE-WP-0010	workplan	Complete bounded receive scans without per-small-input startup overhead	financials	railiance-forge	finished	codex	railiance-forge	2026-10-18	2026-10-18	implementation		04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a

CUST-WP-0080 discovered an availability defect in the already enforced receive control: the normal 141-object public Custodian source delta exhausts the unchanged 90-second budget, with no secret finding. The unmodified owner source reproduces the refusal in an isolated bare repository. This is a new correction, not reopening finished FORGE-WP-0006 or promoting FORGE-WP-0008 residual coverage.

Reuse the existing Repo Manager small-input profile: at most 64 inputs of at most 4096 bytes per directory scan, identical pinned Gitleaks/default rules and strict report/diagnostic validation. Larger inputs retain the original stdin fragment path. Preserve every traversal/ref/object/byte/time bound, no override or new runtime service. Raw batch inputs require checked private tmpfs, independent parent-bound cleanup and child termination on receiver loss. Source preparation does not grant native installation, package/owner acceptance or production proof.

Reproduce and implement the bounded adapter correction

id: FORGE-WP-0010-T01
status: done
priority: high
state_hub_task_id: "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea"

Retain the exact original failure and source delta. Implement the existing small-input batching contract in the Linux receive adapter. Verify synthetic positive/negative parity, real receive-pack quarantine, all prior boundaries, limits, expired context, diagnostic/report refusal, normal cleanup, receiver death and changed storage identity. Complete the exact original clean delta within the same deadline. Failures remain evidence; source proof closes no native acceptance gate. Independent package/owner review remains under T02.

Source result: the exact previously refused 141-object/one-ref delta completes in 52.53 seconds with all objects counted, under the unchanged 90-second budget. The complete suite passes 49 leaf cases with zero skips; five additional boundary cases bring the combined distinct leaf coverage to 54. These include 4096-byte and larger-input detection, multi-ref-name detection, normal and receiver-loss cleanup, scanner/report/diagnostic failures and changed directory identity. Unavailable and ordinary-disk storage fail closed in separate actual helper processes. The original low-entropy canary failure and misconfigured storage fixture/setup failures are retained rather than counted as successful tests. Source/proof: Custodian docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/.

Prepare and approve the immutable native revision

id: FORGE-WP-0010-T02
status: done
priority: high
state_hub_task_id: "b49d34ef-e6e5-5674-b523-ebcf80e0dcca"

Obtain independent source/package review. Pin exact source/build tool provenance, executable digest, startup-guard and hook composition. Capture read-only current state, no-op checks and exact before/after/rollback. Retain permissions, scanner digest, hook ordering and fail-closed behavior. Obtain the founder's explicit go for this live change under the existing environment rule; previous activation is not approval for this different executable. Preserve the original revision and every refinement in the current supervised-action record.

2026-10-18 owner acceptance: the independent Forge owner review under this task approved unchanged proposal FORGE10-RECEIVE-BATCH-20261018, revision 1, sha256:90bb3a1a35729396b02a377d8db62e1d1f8f38d8e24e601dbc3d4446cffd05e8. Published Forge implementation ea65606c1298db782f721f9443bafeb03cdef138, candidate executable sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a, pinned Gitleaks 8.30.1, startup guard and exact hook scope were reviewed with the sealed inputs and before/after/rollback. Founder decision cb9a20f9-5f8d-411f-b034-b15856c0efb5, resolved by Bernd Worsch, approved this exact revision conditional on independent Forge and Apps reviews; both approved the same digest before execution. The existing supervised record retains the original/approved/executed revision and digest. This owner judgement grants no additional authority.

Verify admitted native behavior and ordinary publication

id: FORGE-WP-0010-T03
status: done
priority: high
state_hub_task_id: "863c91e4-7c25-575f-b8b6-f98d0074ce5a"

Verify actual hook clean/refusal/unavailable/cleanup behavior and the legitimate ordinary source publication without splitting or seeding refs. Reconcile owner task/source status and independent evidence. Existing remaining coverage, private incident response and target-wide acceptance retain their original owners; no residual implementation is inferred.

2026-10-18 independent Forge owner return review: exact revision 1 stage and activation receipts are verified. The admitted Recreate rollout produced ready pod b9c59178-2223-46e8-842b-2bc473f55940; it verified both executable versions, the dual startup guard, all 166 migrated scanner fragments and the unchanged hash/mode/ownership metadata of 1,328 protected hook files. Native real receive-pack proved clean acceptance, intermediate-history secret rejection, quarantine discard, unavailable-scanner refusal and clean recovery. Actual Forgejo global-template Git-init inheritance, inherited malformed-input refusal, mounted hook identity and temporary probe/control cleanup passed. No failed or unverified activation/recovery phase is recorded. No unchanged suite was rerun for this return review.

Apps declarations were normally published at 2fdc198b2bb8e6d4ad50768c22cf99328828eb4f and verified on the primary instance. The ordinary Custodian source push reached c1fcd94812e60b950b3be90312c5dbd2dfe62d44, equal to its remote main; all 40 refined task UUID/status bindings matched source. Consistency cleared five backlogged commits, with zero failure or automation-error findings. This meets the original availability correction and native/publication acceptance criteria.

Evidence: Custodian docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/: owner-reviews/railiance-forge.json, stage-r1.json, activation-r1.json, apps-publication-verification.json, publication-readback-r1.json and consistency-after-native.json. These remain bounded operational claims: built-in Forgejo authorization and production API repository creation were not proved by the isolated probe. The sole previously uncovered repository, FORGE-WP-0008 residual coverage, private incident response and target-wide acceptance remain with their original owners, outside this completed correction; no new residual or residual promotion is created.