coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: enforce staged secret scanning on reviewed workstation checkouts

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 17:47:19 +02:00
parent a9a29d82a8
commit 21498306ec
3 changed files with 51 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/secret-detection.md
View file

@ -2,7 +2,8 @@
Repo Manager provides a control adapter to an external scanner. Credential
custody, incident response and authorization remain with their existing owners.
The adapter is initially source tooling; it does not install or activate hooks.
The adapter does not itself install hooks. The reviewed workstation activation
below composes it with the existing generated-only guard.
Work: RMGR-WP-0021, coordinated by Custodian CUST-WP-0080 G07.
## Scan the proposed index
@ -73,6 +74,31 @@ revocation/rotation path; source removal or rejection of one commit does not
revoke credentials that were already exposed. CUST-WP-0073-T05's existing founder
deferral is not overridden by this adapter.
## Verified workstation activation (2026-10-12)
The shared `.githooks/pre-commit` composes the existing Custodian generated-only
guard with the scanner for these exact `/home/worsch/` checkout names:
access-engine, approval-engine, audit-core, gate-house, glas-harness, key-cape,
kings-guard, maturity-engine, net-kingdom, ops-mason, ops-warden, policy-nexus,
railiance-forge, railiance-platform, repo-manager, role-engine, secrets-engine,
security-canon, tenant-engine, the-custodian, user-engine and zone-engine.
Custodian's separately configured local pre-commit has the same composition.
Other checkout paths retain their existing generated-only behavior.
The admitted binary is `/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks`.
All 22 configured hooks passed clean, disposable-key rejection, generated-only
rejection and unavailable-scanner refusal checks. The failure probe restored the
binary mode. Other hooks and Git routing were preserved. These are actual hook
invocations with temporary Git indexes/object stores, not pushes to a forge.
Custodian stores the exact proposal, backups and rollback executor under
`docs/changes/CUST-WP-0080/`, and the native receipt under
`docs/evidence/2026-10-12-netkingdom-security/secret-hook-activation.json`.
The generated-guard installer recognizes the exact reviewed composition without
replacing it. Rollback restores the prior hook bytes/modes after revision checks;
the binary remains installed but inert. Clones on other machines are not covered.
Independent forge/CI and finding-to-response acceptance remain RMGR-WP-0021-T03/T04.
## Tests
Set `RMGR_TEST_GITLEAKS` to the exact reviewed test executable when running