From 21498306ecc9f8fb19f67ca3d0cdb38b76f984e4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 12 Oct 2026 17:47:19 +0200 Subject: [PATCH] security: enforce staged secret scanning on reviewed workstation checkouts Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c --- .githooks/pre-commit | 9 ++++++ docs/secret-detection.md | 28 ++++++++++++++++++- .../RMGR-WP-0021-secret-detection-controls.md | 16 ++++++++++- 3 files changed, 51 insertions(+), 2 deletions(-) create mode 100755 .githooks/pre-commit diff --git a/.githooks/pre-commit b/.githooks/pre-commit new file mode 100755 index 0000000..ea0d516 --- /dev/null +++ b/.githooks/pre-commit @@ -0,0 +1,9 @@ +#!/bin/sh +# CUST-WP-0080 / RMGR-WP-0021: preserve generated-only guard and exact local scan scope. +set -eu +python3 /home/worsch/the-custodian/scripts/check_generated_only_commit.py --staged +case "$(git rev-parse --show-toplevel)" in + /home/worsch/access-engine|/home/worsch/approval-engine|/home/worsch/audit-core|/home/worsch/gate-house|/home/worsch/glas-harness|/home/worsch/key-cape|/home/worsch/kings-guard|/home/worsch/maturity-engine|/home/worsch/net-kingdom|/home/worsch/ops-mason|/home/worsch/ops-warden|/home/worsch/policy-nexus|/home/worsch/railiance-forge|/home/worsch/railiance-platform|/home/worsch/repo-manager|/home/worsch/role-engine|/home/worsch/secrets-engine|/home/worsch/security-canon|/home/worsch/tenant-engine|/home/worsch/the-custodian|/home/worsch/user-engine|/home/worsch/zone-engine) + exec python3 /home/worsch/repo-manager/src/repo_manager/secret_scan.py --path . --binary /home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks + ;; +esac diff --git a/docs/secret-detection.md b/docs/secret-detection.md index 80c595e..690efcb 100644 --- a/docs/secret-detection.md +++ b/docs/secret-detection.md @@ -2,7 +2,8 @@ Repo Manager provides a control adapter to an external scanner. Credential custody, incident response and authorization remain with their existing owners. -The adapter is initially source tooling; it does not install or activate hooks. +The adapter does not itself install hooks. The reviewed workstation activation +below composes it with the existing generated-only guard. Work: RMGR-WP-0021, coordinated by Custodian CUST-WP-0080 G07. ## Scan the proposed index @@ -73,6 +74,31 @@ revocation/rotation path; source removal or rejection of one commit does not revoke credentials that were already exposed. CUST-WP-0073-T05's existing founder deferral is not overridden by this adapter. +## Verified workstation activation (2026-10-12) + +The shared `.githooks/pre-commit` composes the existing Custodian generated-only +guard with the scanner for these exact `/home/worsch/` checkout names: +access-engine, approval-engine, audit-core, gate-house, glas-harness, key-cape, +kings-guard, maturity-engine, net-kingdom, ops-mason, ops-warden, policy-nexus, +railiance-forge, railiance-platform, repo-manager, role-engine, secrets-engine, +security-canon, tenant-engine, the-custodian, user-engine and zone-engine. +Custodian's separately configured local pre-commit has the same composition. +Other checkout paths retain their existing generated-only behavior. + +The admitted binary is `/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks`. +All 22 configured hooks passed clean, disposable-key rejection, generated-only +rejection and unavailable-scanner refusal checks. The failure probe restored the +binary mode. Other hooks and Git routing were preserved. These are actual hook +invocations with temporary Git indexes/object stores, not pushes to a forge. + +Custodian stores the exact proposal, backups and rollback executor under +`docs/changes/CUST-WP-0080/`, and the native receipt under +`docs/evidence/2026-10-12-netkingdom-security/secret-hook-activation.json`. +The generated-guard installer recognizes the exact reviewed composition without +replacing it. Rollback restores the prior hook bytes/modes after revision checks; +the binary remains installed but inert. Clones on other machines are not covered. +Independent forge/CI and finding-to-response acceptance remain RMGR-WP-0021-T03/T04. + ## Tests Set `RMGR_TEST_GITLEAKS` to the exact reviewed test executable when running diff --git a/workplans/RMGR-WP-0021-secret-detection-controls.md b/workplans/RMGR-WP-0021-secret-detection-controls.md index f17e784..e22b4b5 100644 --- a/workplans/RMGR-WP-0021-secret-detection-controls.md +++ b/workplans/RMGR-WP-0021-secret-detection-controls.md @@ -44,7 +44,7 @@ This is source/tool behavior, not workstation or forge activation. ```task id: RMGR-WP-0021-T02 -status: todo +status: done priority: high state_hub_task_id: "e27817e6-b298-581f-b99a-05ec459be749" ``` @@ -57,6 +57,20 @@ with clean/disposable-secret/scanner-failure cases without changing production source or committing a credential. Record observed coverage and explicit uncovered checkouts. Installer rollback restores exact prior content/routing. +2026-10-12: activated the reviewed composition in the existing shared hook and +Custodian local hook, with Gitleaks 8.30.1 admitted at +`/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks` under the pinned +SHA256. No Git routing or other hook changed. All 22 exact workstation roots in +the proposal passed actual configured-hook checks: clean exit 0, disposable +private key exit 1, generated-only exit 1, non-executable scanner exit 2. Scanner +mode was restored; a checkout outside the exact scope retained its prior behavior. +Probes used temporary alternate indexes/object stores, without changing user +source, staged content or branches. Eleven activation/rollback/guard tests pass. +Custodian evidence: `secret-hook-activation.json`; reviewed proposal and rollback +executor: `docs/changes/CUST-WP-0080/`. This covers these workstation checkouts, +not other machines/clones, existing history, remote enforcement or real findings. +T03/T04 remain open; local hooks remain bypassable. + ## Establish independent forge and CI detection coverage ```task