coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: reconcile independent forge scanner coverage

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 17:59:52 +02:00
parent 5a7e838d34
commit 7677b00f69
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/RMGR-WP-0021-secret-detection-controls.md
View file

@ -117,6 +117,22 @@ introduced. State Hub owner record: STATE-WP-ADHOC-2026-10-13-T01. Dedicated tim
regressions and real delayed-hook acceptance are recorded in Custodian's
`push-deadline.json`. This transport correction does not close T03.
2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after
all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref
veto. The independent final read-only audit reconciles 167 repositories: 166
admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All
23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership
markers remain. Each rejected synthetic commit was absent after its probe.
Repository 55 has four external submodules and remains required compatibility
work. Ordinary source acceptance is distinct from vetoed scanner checks.
Production HTTP/API/frontend acceptance remains unverified: the protected API
credential route failed before child handoff and the metadata-only capability
check denied access. Prepare one complete acceptance command for the existing
attended login window. CI, import/mirror, historical/LFS/log/artifact detection
and private response gates remain open; this is no whole-estate closure.
Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
and `forge-api-route-readiness.json`.
## Verify private finding-to-response handling
```task