From 9ebde0a9bd60d5c82910494fbe6bd1b891455cee Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 01:12:10 +0200 Subject: [PATCH] docs(security): accept bounded staged scanner runtime fixtures Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa --- .../RMGR-WP-0021-secret-detection-controls.md | 39 ++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/workplans/RMGR-WP-0021-secret-detection-controls.md b/workplans/RMGR-WP-0021-secret-detection-controls.md index 5f7e629..e1face1 100644 --- a/workplans/RMGR-WP-0021-secret-detection-controls.md +++ b/workplans/RMGR-WP-0021-secret-detection-controls.md @@ -155,7 +155,7 @@ applicable DSM-DETECT requirements; retain residuals as live work records. ```task id: RMGR-WP-0021-T05 -status: progress +status: done priority: medium state_hub_task_id: "25fbe694-41d8-5232-bce0-4ed362387d5a" ``` @@ -204,3 +204,40 @@ is still pending, so T05 stays progress. The explicit repo-local CLI published through rmgr sync --push and central primary/railiance01 accepted source projection; no global installed CLI is claimed. T03/T04 and whole target gates remain open. Final coordinator evidence: resume-integration-r1/publication-verification.json. + + +2026-10-17 bounded T05 completion evidence: the independently reviewed R3 namespace +fixture passed ten profile checks, exact-pidfd hard-parent-loss and cleanup +acceptance, and six actual configured-hook cases. Both the shared repo-manager +hook and Custodian hook accepted a clean generated blob (exit 0), blocked a +freshly generated private-key fixture (exit 1), and refused a non-executable +scanner view (exit 2, `unverified`, `scanner-file-refused`, zero scanned blobs). +The unavailable view was a new empty 0400 file read-only-bound over the exact +configured scanner path inside fresh user/mount/network namespaces; the host +scanner's bytes, stat identity and mode were unchanged. The canonical source, +hooks and interpreter hashes were read back before exec, original root and +`/dev/shm` device/inode identities and UID/GID were preserved, root was read only, +and only original `/dev/shm` and exact `/dev/null` had the reviewed writable/device +bind exceptions. The null character device and actual O_RDWR open were verified. +PID namespace identity stayed shared so the canonical independent cleanup +observer survived parent loss. Real indexes were not opened, real index stat +identities and HEADs stayed unchanged, and all new volatile storage was absent. + +Retain the failed preparation history: R1 refused after early process +registration without a full readback; R2 recorded PermissionError errno 13, +without enough retained phase information to establish its exact cause. Both +failed revisions and receipts are in `failed-r1/` and `failed-r2/`. R3 atomically +published the release gate, retained fixed public phase diagnostics and verified +the narrow `/dev/null` device bind and open. Its successful result does not +retroactively assign a verified cause or success to R1/R2. + +Receipts: Custodian +`docs/changes/netkingdom-target-2026-10-17/scanner-unavailable-r1/namespace-lifecycle-results.json` +and `namespace-hook-results.json`, with exact driver hashes and manifest. +Earlier publication and explicit repo-local CLI acceptance remain recorded above; +no globally installed CLI is claimed. This completes the bounded local staged +scanner optimization and its configured-hook generated-fixture acceptance. It +proves the exact non-executable scanner view within this namespace fixture, not +an observed host outage or coverage of other machines. T03 remains progress, +T04 remains todo, the workplan remains active, and remote receive/CI, broader +source-control coverage, real finding response and whole TSA15 remain open.