From b02e1cefb0e07fe246dc9fe9c5a989fe06116587 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 00:37:50 +0200 Subject: [PATCH] docs(security): record verified source delivery and native preparation Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa --- .../RMGR-WP-0021-secret-detection-controls.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/workplans/RMGR-WP-0021-secret-detection-controls.md b/workplans/RMGR-WP-0021-secret-detection-controls.md index e77fc4b..5f7e629 100644 --- a/workplans/RMGR-WP-0021-secret-detection-controls.md +++ b/workplans/RMGR-WP-0021-secret-detection-controls.md @@ -190,3 +190,17 @@ bypass limits or whole TSA15. 2026-10-17 integration started: exact reviewed source is applied in the owner checkout. Canonical tests, configured-hook fixtures and publication are being verified separately; actual-hook scanner-unavailability remains pending. + +2026-10-17 verified source follow-through: source commit `83c521b` passed normal +local scanning and all 42 canonical scanner tests. The exact final tmpfs candidate +also passed 13 old/new parity cases. The actual configured shared and Custodian +hooks each accepted a clean generated fixture and blocked a generated private key, +using alternate indexes/object stores in private tmpfs; the real indexes were not +opened and their stat identities and HEADs stayed unchanged. All new fixture and +scan storage was removed. Scanner/hook/source bytes and routing stayed exact. +No chmod or unavailable-scanner injection touched the real scanner. Source tests +cover unavailable/wrong-digest refusal, but actual configured-hook unavailability +is still pending, so T05 stays progress. The explicit repo-local CLI published +through rmgr sync --push and central primary/railiance01 accepted source projection; +no global installed CLI is claimed. T03/T04 and whole target gates remain open. +Final coordinator evidence: resume-integration-r1/publication-verification.json.