coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

perf(security): batch small staged blobs with bounded volatile storage

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
This commit is contained in:
tegwick 2026-10-17 00:24:44 +02:00
parent 97ea248925
commit 83c521bf2f
3 changed files with 615 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

43
workplans/RMGR-WP-0021-secret-detection-controls.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: repo-manager
created: "2026-10-12"
updated: "2026-10-12"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "5aa6f84a-c682-5996-ae26-96daef670833"
@ -149,3 +149,44 @@ credentials, retain incident owner and revoke/replace/adopt/validate gates. Do n
execute founder-deferred rotations or treat suppressed output as remediation.
Close only after native coverage and response evidence are adequate for the
applicable DSM-DETECT requirements; retain residuals as live work records.
## Publish measured staged-scanner batching and verify runtime routing
```task
id: RMGR-WP-0021-T05
status: progress
priority: medium
state_hub_task_id: "25fbe694-41d8-5232-bce0-4ed362387d5a"
```
2026-10-17 prepared refinement for the local staged-object adapter. Independent
review and a coordinator-executed generated-fixture run cover the exact source
SHA256 `e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400`:
42 tests, 13 exact old/new summary parity cases, immutable scanner snapshot,
volatile-only bounded batches, watchdog and parent-loss refusal/cleanup. Warm
p50 for 1/16/64 distinct 1 KiB blobs is 0.835/0.884/0.904 seconds, compared with
0.702/12.065/49.172 seconds in the retained baseline. The one-blob case regressed;
this is descriptive local fixture evidence, not aggregate workload or tail
acceptance. Larger blobs retain the original stdin route.
Publish the reviewed patch against the exact owner base, verify the configured
shared and Custodian hooks still resolve to the admitted owner source, then run
clean/private-key/scanner-unavailable generated alternate-index probes without
reading or changing user source/indexes. Verify actual CLI import routing; the
repo-local `.venv/bin/rmgr` imports owner source, but the previously advertised
`/home/worsch/.local/bin/rmgr` is absent in the read-only observation and must not
be described as installed operational coverage. Reconcile that exact CLI route
before claiming CLI publication. Preserve existing hook guards and routing;
retain rollback to the exact prior adapter bytes. Source publication and runtime
acceptance must have separate receipts.
Review packet: Custodian
`docs/changes/netkingdom-target-2026-10-16/scanner-batch-r1/`.
No canonical owner mutation or runtime admission has occurred in the packet.
This task does not close T03/T04, independent receive/CI coverage, source-control
bypass limits or whole TSA15.
2026-10-17 integration started: exact reviewed source is applied in the owner
checkout. Canonical tests, configured-hook fixtures and publication are being
verified separately; actual-hook scanner-unavailability remains pending.