coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): accept bounded staged scanner runtime fixtures

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
This commit is contained in:
tegwick 2026-10-17 01:12:10 +02:00
parent b02e1cefb0
commit 9ebde0a9bd
1 changed files with 38 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

39
workplans/RMGR-WP-0021-secret-detection-controls.md
View file

@ -155,7 +155,7 @@ applicable DSM-DETECT requirements; retain residuals as live work records.
```task
id: RMGR-WP-0021-T05
status: progress
status: done
priority: medium
state_hub_task_id: "25fbe694-41d8-5232-bce0-4ed362387d5a"
```
@ -204,3 +204,40 @@ is still pending, so T05 stays progress. The explicit repo-local CLI published
through rmgr sync --push and central primary/railiance01 accepted source projection;
no global installed CLI is claimed. T03/T04 and whole target gates remain open.
Final coordinator evidence: resume-integration-r1/publication-verification.json.
2026-10-17 bounded T05 completion evidence: the independently reviewed R3 namespace
fixture passed ten profile checks, exact-pidfd hard-parent-loss and cleanup
acceptance, and six actual configured-hook cases. Both the shared repo-manager
hook and Custodian hook accepted a clean generated blob (exit 0), blocked a
freshly generated private-key fixture (exit 1), and refused a non-executable
scanner view (exit 2, `unverified`, `scanner-file-refused`, zero scanned blobs).
The unavailable view was a new empty 0400 file read-only-bound over the exact
configured scanner path inside fresh user/mount/network namespaces; the host
scanner's bytes, stat identity and mode were unchanged. The canonical source,
hooks and interpreter hashes were read back before exec, original root and
`/dev/shm` device/inode identities and UID/GID were preserved, root was read only,
and only original `/dev/shm` and exact `/dev/null` had the reviewed writable/device
bind exceptions. The null character device and actual O_RDWR open were verified.
PID namespace identity stayed shared so the canonical independent cleanup
observer survived parent loss. Real indexes were not opened, real index stat
identities and HEADs stayed unchanged, and all new volatile storage was absent.
Retain the failed preparation history: R1 refused after early process
registration without a full readback; R2 recorded PermissionError errno 13,
without enough retained phase information to establish its exact cause. Both
failed revisions and receipts are in `failed-r1/` and `failed-r2/`. R3 atomically
published the release gate, retained fixed public phase diagnostics and verified
the narrow `/dev/null` device bind and open. Its successful result does not
retroactively assign a verified cause or success to R1/R2.
Receipts: Custodian
`docs/changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-lifecycle-results.json`
and `namespace-hook-results.json`, with exact driver hashes and manifest.
Earlier publication and explicit repo-local CLI acceptance remain recorded above;
no globally installed CLI is claimed. This completes the bounded local staged
scanner optimization and its configured-hook generated-fixture acceptance. It
proves the exact non-executable scanner view within this namespace fixture, not
an observed host outage or coverage of other machines. T03 remains progress,
T04 remains todo, the workplan remains active, and remote receive/CI, broader
source-control coverage, real finding response and whole TSA15 remain open.