coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: enforce staged secret scanning on reviewed workstation checkouts

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 17:47:19 +02:00
parent a9a29d82a8
commit 21498306ec
3 changed files with 51 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.githooks/pre-commit Executable file
View file

@ -0,0 +1,9 @@
#!/bin/sh
# CUST-WP-0080 / RMGR-WP-0021: preserve generated-only guard and exact local scan scope.
set -eu
python3 /home/worsch/the-custodian/scripts/check_generated_only_commit.py --staged
case "$(git rev-parse --show-toplevel)" in
/home/worsch/access-engine|/home/worsch/approval-engine|/home/worsch/audit-core|/home/worsch/gate-house|/home/worsch/glas-harness|/home/worsch/key-cape|/home/worsch/kings-guard|/home/worsch/maturity-engine|/home/worsch/net-kingdom|/home/worsch/ops-mason|/home/worsch/ops-warden|/home/worsch/policy-nexus|/home/worsch/railiance-forge|/home/worsch/railiance-platform|/home/worsch/repo-manager|/home/worsch/role-engine|/home/worsch/secrets-engine|/home/worsch/security-canon|/home/worsch/tenant-engine|/home/worsch/the-custodian|/home/worsch/user-engine|/home/worsch/zone-engine)
exec python3 /home/worsch/repo-manager/src/repo_manager/secret_scan.py --path . --binary /home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks
;;
esac

28
docs/secret-detection.md
View file

@ -2,7 +2,8 @@
Repo Manager provides a control adapter to an external scanner. Credential
custody, incident response and authorization remain with their existing owners.
The adapter is initially source tooling; it does not install or activate hooks.
The adapter does not itself install hooks. The reviewed workstation activation
below composes it with the existing generated-only guard.
Work: RMGR-WP-0021, coordinated by Custodian CUST-WP-0080 G07.
## Scan the proposed index
@ -73,6 +74,31 @@ revocation/rotation path; source removal or rejection of one commit does not
revoke credentials that were already exposed. CUST-WP-0073-T05's existing founder
deferral is not overridden by this adapter.
## Verified workstation activation (2026-10-12)
The shared `.githooks/pre-commit` composes the existing Custodian generated-only
guard with the scanner for these exact `/home/worsch/` checkout names:
access-engine, approval-engine, audit-core, gate-house, glas-harness, key-cape,
kings-guard, maturity-engine, net-kingdom, ops-mason, ops-warden, policy-nexus,
railiance-forge, railiance-platform, repo-manager, role-engine, secrets-engine,
security-canon, tenant-engine, the-custodian, user-engine and zone-engine.
Custodian's separately configured local pre-commit has the same composition.
Other checkout paths retain their existing generated-only behavior.
The admitted binary is `/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks`.
All 22 configured hooks passed clean, disposable-key rejection, generated-only
rejection and unavailable-scanner refusal checks. The failure probe restored the
binary mode. Other hooks and Git routing were preserved. These are actual hook
invocations with temporary Git indexes/object stores, not pushes to a forge.
Custodian stores the exact proposal, backups and rollback executor under
`docs/changes/CUST-WP-0080/`, and the native receipt under
`docs/evidence/2026-10-12-netkingdom-security/secret-hook-activation.json`.
The generated-guard installer recognizes the exact reviewed composition without
replacing it. Rollback restores the prior hook bytes/modes after revision checks;
the binary remains installed but inert. Clones on other machines are not covered.
Independent forge/CI and finding-to-response acceptance remain RMGR-WP-0021-T03/T04.
## Tests
Set `RMGR_TEST_GITLEAKS` to the exact reviewed test executable when running

16
workplans/RMGR-WP-0021-secret-detection-controls.md
View file

@ -44,7 +44,7 @@ This is source/tool behavior, not workstation or forge activation.
```task
id: RMGR-WP-0021-T02
status: todo
status: done
priority: high
state_hub_task_id: "e27817e6-b298-581f-b99a-05ec459be749"
```
@ -57,6 +57,20 @@ with clean/disposable-secret/scanner-failure cases without changing production
source or committing a credential. Record observed coverage and explicit
uncovered checkouts. Installer rollback restores exact prior content/routing.
2026-10-12: activated the reviewed composition in the existing shared hook and
Custodian local hook, with Gitleaks 8.30.1 admitted at
`/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks` under the pinned
SHA256. No Git routing or other hook changed. All 22 exact workstation roots in
the proposal passed actual configured-hook checks: clean exit 0, disposable
private key exit 1, generated-only exit 1, non-executable scanner exit 2. Scanner
mode was restored; a checkout outside the exact scope retained its prior behavior.
Probes used temporary alternate indexes/object stores, without changing user
source, staged content or branches. Eleven activation/rollback/guard tests pass.
Custodian evidence: `secret-hook-activation.json`; reviewed proposal and rollback
executor: `docs/changes/CUST-WP-0080/`. This covers these workstation checkouts,
not other machines/clones, existing history, remote enforcement or real findings.
T03/T04 remain open; local hooks remain bypassable.
## Establish independent forge and CI detection coverage
```task