From 2544b8703e51e4b6e6dfe62898b6e3abf76e93e2 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 12 Oct 2026 16:51:40 +0200 Subject: [PATCH] docs(security): record scanner proof and enforcement gaps --- .../sec-dsm-requirement-ledger.json | 58 +++- .../secret-detection.json | 317 ++++++++++++++++++ docs/netkingdom-security-blueprint.md | 8 + docs/netkingdom-security-gaps.md | 17 +- ...gdom-security-blueprint-and-gap-closure.md | 11 + 5 files changed, 399 insertions(+), 12 deletions(-) create mode 100644 docs/evidence/2026-10-12-netkingdom-security/secret-detection.json diff --git a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json index 29ef984a..f523cf75 100644 --- a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json +++ b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json @@ -2,7 +2,7 @@ "assessed_at": "2026-10-12", "source": "security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md", "source_sha256": "f79a6dfe1067028810677426cb7e8c5be16735074121437f3cc97849d08fb72b", - "coverage": "All 116 numbered DSM headings: 20 anti-pattern references, eight requirements assessed incomplete with scoped source evidence, 88 otherwise unverified. Unnumbered obligations in sections 29, 37, 38 and 39 remain in the gap analysis. No requirement is marked conformant.", + "coverage": "All 116 numbered DSM headings: 20 anti-pattern references, 12 requirements assessed incomplete with scoped evidence, 84 otherwise unverified. Unnumbered obligations in sections 29, 37, 38 and 39 remain in the gap analysis. No requirement is marked conformant.", "requirements": [ { "id": "DSM-TRANS-001", @@ -834,11 +834,21 @@ "normative_terms": [ "MUST" ], - "status": "unverified", + "status": "incomplete", "gap_refs": [ "G07" ], - "closure_evidence": [] + "closure_evidence": [], + "assessment": { + "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", + "observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests.", + "remaining": "Reviewed source is not activated in the configured hooks. Production repo denominator, actual automation coverage and historical/runtime findings remain unverified.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "verification_evidence": [ + "secret-detection.json" + ], + "assessed_at": "2026-10-12" + } }, { "id": "DSM-DETECT-002", @@ -847,11 +857,21 @@ "normative_terms": [ "SHOULD" ], - "status": "unverified", + "status": "incomplete", "gap_refs": [ "G07" ], - "closure_evidence": [] + "closure_evidence": [], + "assessment": { + "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", + "observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only.", + "remaining": "Native local activation, push/server/CI controls, logs/artifacts/runtime detection and independent boundary coverage remain unverified.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "verification_evidence": [ + "secret-detection.json" + ], + "assessed_at": "2026-10-12" + } }, { "id": "DSM-DETECT-003", @@ -860,11 +880,21 @@ "normative_terms": [ "SHOULD" ], - "status": "unverified", + "status": "incomplete", "gap_refs": [ "G07" ], - "closure_evidence": [] + "closure_evidence": [], + "assessment": { + "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", + "observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested.", + "remaining": "Configured estate hooks have not been changed, and independent push prevention has not been demonstrated. A local hook alone remains bypassable.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "verification_evidence": [ + "secret-detection.json" + ], + "assessed_at": "2026-10-12" + } }, { "id": "DSM-DETECT-004", @@ -873,11 +903,21 @@ "normative_terms": [ "SHOULD" ], - "status": "unverified", + "status": "incomplete", "gap_refs": [ "G07" ], - "closure_evidence": [] + "closure_evidence": [], + "assessment": { + "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", + "observed": "Source adapter emits only fixed status/counts and blocked blob IDs, suitable for private owner triage without finding disclosure.", + "remaining": "No exercised detection-to-response path or automatic/semi-automatic revocation integration. Actual exposed credentials require separately authorized response; founder-deferred rotation is unchanged.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "verification_evidence": [ + "secret-detection.json" + ], + "assessed_at": "2026-10-12" + } }, { "id": "DSM-CI-001", diff --git a/docs/evidence/2026-10-12-netkingdom-security/secret-detection.json b/docs/evidence/2026-10-12-netkingdom-security/secret-detection.json new file mode 100644 index 00000000..2a598bc2 --- /dev/null +++ b/docs/evidence/2026-10-12-netkingdom-security/secret-detection.json @@ -0,0 +1,317 @@ +{ + "date": "2026-10-12", + "gap": "G07", + "owner_workplan": "RMGR-WP-0021", + "review_denominator": "21 original architecture repositories plus Custodian local-hook exception; not a complete production repository denominator", + "effective_hook_inventory": [ + { + "repo": "security-canon", + "head": "1664a6def20be2759a1e575024563efd27c9f36f", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "net-kingdom", + "head": "19a1c75d309991de8654c4b7a9eeffea8fb90b18", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "gate-house", + "head": "bc890c4d050a2e726ce8988a8260ab9caea133e3", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "ops-mason", + "head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "ops-warden", + "head": "6d2f1be9691b19e826898a2166ae4451e4802ae2", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "key-cape", + "head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "user-engine", + "head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "tenant-engine", + "head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "role-engine", + "head": "d231241dbfeeb541b34243f4022883aa6417a1eb", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "zone-engine", + "head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "access-engine", + "head": "16ca97b2776789f730cc7049a2d6533612faaccd", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "approval-engine", + "head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "secrets-engine", + "head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "audit-core", + "head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "kings-guard", + "head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "maturity-engine", + "head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "policy-nexus", + "head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "railiance-platform", + "head": "7c79293831e2f46ad93f2ef689d9129b2ac0e139", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "glas-harness", + "head": "5ce4f38aedfd27cc783131f18480df02e2951514", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "repo-manager", + "head": "78d91efc76ddaf778365e445dc8fb5b6c924a274", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "railiance-forge", + "head": "e395e5e9c196fe7cea9cd2be513554e493e675ee", + "effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit", + "executable": true, + "sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + }, + { + "repo": "the-custodian", + "head": "e2dbe1267ffea38cd8042c153c942b26f6d177a4", + "effective_pre_commit": "/home/worsch/the-custodian/.git/hooks/pre-commit", + "executable": true, + "sha256": "4d23af188d7891209f032123508893d2bc49a1709644278a0f1fa9008b0b187f", + "observed_control": "generated-only commit guard; no scanner invocation", + "scanner_activation": "not activated by this repair" + } + ], + "baseline": { + "hook": "/home/worsch/repo-manager/.githooks/pre-commit", + "hook_sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5", + "synthetic_private_key_commit_exit": 0, + "commit_created": true, + "actual_credential_used": false, + "probe_repository": "/tmp/netkingdom-secret-detection/baseline-1ifantn4" + }, + "scanner": { + "version": "v8.30.1", + "source": "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz", + "archive_sha256": "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb", + "binary_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "verification": "Compared archive checksum with same official release checksum list; no detached signature verification." + }, + "manifest": { + "repo": "repo-manager", + "base_head": "78d91efc76ddaf778365e445dc8fb5b6c924a274", + "files": [ + { + "path": "src/repo_manager/secret_scan.py", + "before": null, + "after": "4559d7714308eaa70ce5f8fa91dfcc6b10fe74b607e9f2a94269d31ff76bce9d" + }, + { + "path": "src/repo_manager/cli.py", + "before": "fc2b34e67be3be56162a766fb06e2013b29753ecb26629048be66f0ab31aa359", + "after": "1120e8cc50341a2b02fd7d940a79f75a26ec6230c00dd1da76acaf0c6e494014" + }, + { + "path": "tests/test_secret_scan.py", + "before": null, + "after": "0b2efb9ad8949e6b8397036e81ecd29acfcdd11e0723d670e3b7e6d4ea2dd54c" + }, + { + "path": "docs/secret-detection.md", + "before": null, + "after": "4a8882ea23e8b1eaf3f2f61e8a6d97919781a01d77e31b01ef6c9c9324d6dc44" + }, + { + "path": "workplans/RMGR-WP-0021-secret-detection-controls.md", + "before": null, + "after": "df555899270cb03ffde9055eb48c9f1d23461bf5083d207814ac14ded5e1308f" + } + ] + }, + "source_commit": "77fc4c9b975c7dbcac852b7f62d56f8e84ceeadc", + "source_pushed": true, + "verification": { + "focused_real_scanner": { + "passed": 17, + "failed": 0, + "skipped": 0, + "seconds": 10.55 + }, + "full_owner_suite": { + "passed": 249, + "failed": 0, + "skipped": 0, + "warnings": 1, + "seconds": 38.57, + "warning_scope": "Existing FastAPI/Starlette test-client deprecation", + "command": "RMGR_TEST_GITLEAKS=/tmp/netkingdom-secret-detection/gitleaks PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q --tb=short" + }, + "lint": "new scanner module and tests pass Ruff", + "whitespace": "git diff --check passed" + }, + "controls": [ + "Full changed staged blobs; partial staging and actual git commit --only index tested", + "Literal pinned executable digest and invocation through an open descriptor", + "Isolated trusted config and no ambient ignore/config/inline-allow suppression", + "No raw finding content, paths, lines or diagnostics emitted or retained", + "Git replace disabled; symlinks not dereferenced; changed gitlinks/index conflicts and limits refuse", + "Scanner missing/failure/timeout produces unverified nonzero rather than clean", + "Observed index mutation causes refusal" + ], + "proof_limits": [ + "Synthetic disposable private keys only; no production repository findings were scanned or disclosed", + "Source adapter is not active enforcement in the inherited hooks; shared pre-commit and routing remain unchanged", + "Local hooks are bypassable; server-side/required CI checks, introduced history/merge coverage and production denominator remain unverified", + "Scanner default heuristic rules do not prove absence of every credential form", + "The adapter does not scan unchanged history, working-tree content, remote refs, logs, artifacts or runtime stores", + "No fleet toolchain admission, detached signature verification or hostile same-UID/runtime isolation claim", + "Private finding classification, approved exact false-positive exceptions and detection-to-revocation remain owner work; no deferred rotation executed" + ], + "owner_projection": { + "status": "applied", + "commit": "a9a29d82a82d35be098522636f96d96f37aaa468", + "instance_role": "primary", + "instance_label": "railiance01", + "derived_commit": "a9a29d82a82d35be098522636f96d96f37aaa468", + "workplan_id": "5aa6f84a-c682-5996-ae26-96daef670833", + "task_status_readback": { + "T01": "done", + "T02": "todo", + "T03": "todo", + "T04": "todo" + } + }, + "workplan_after_identifier_assignment_sha256": "50f8527324e4f791eb7c7089617a89c079cc0332adfae18d662e8cb2b2af15b6", + "custodian_sync": { + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "note": "DB reconciliation succeeded; automatic working-memory commit was prevented by sandbox read-only Git metadata. Scoped evidence committed separately." + }, + "source_implementation_decision_id": "e897057f-4685-4ae9-af46-6935fbb19ae5", + "progress_id": "373c2122-d68d-4a45-bf03-35c19e4eecd3" +} diff --git a/docs/netkingdom-security-blueprint.md b/docs/netkingdom-security-blueprint.md index a216c460..6a1dffa2 100644 --- a/docs/netkingdom-security-blueprint.md +++ b/docs/netkingdom-security-blueprint.md @@ -148,6 +148,14 @@ or an ESO Ready condition alone is insufficient. Startup-only consumers need a controlled reload/restart and rollback strategy; restoring an old value is safe only if its authority remains valid and unexposed. +Repository prevention uses Repo Manager as a control adapter, with the external +scanner owning detection rules and Forge owning independent push/CI enforcement. +The reviewed inherited hook currently enforces generated-only commits; it is not +a secret scanner. RMGR-WP-0021 adds pinned, content-silent staged-blob scanning +and separately tracks actual activation and response. A local hook is bypassable, +so it cannot substitute for independent introduced-history checks or governed +incident response. [Coverage evidence](evidence/2026-10-12-netkingdom-security/secret-detection.json). + ## Roots, outages and recovery The root register must cover OpenBao unseal/recovery authority, age/SOPS decryption, diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md index e9f3435e..6572c220 100644 --- a/docs/netkingdom-security-gaps.md +++ b/docs/netkingdom-security-gaps.md @@ -15,7 +15,7 @@ No whole-estate SEC-DSM conformance or maturity level is claimed. | G04 | Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery. | MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03 | Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings | | G05 | Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation | | G06 | Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness. | AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records | Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion | -| G07 | Automated secret-detection coverage is unverified across production repositories and pipelines. Inspection of 36 tracked workflow/build configurations in 21 repositories found no common scanner references. Custom, inherited and server-side controls remain unverified. | CUST-WP-0080-T03, with repo-manager/railiance-forge ownership review | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure | +| G07 | Inherited hooks in all 21 reviewed repositories enforce generated-only commits, not secret detection; a disposable private-key commit was accepted. New pinned staged-object scanner adapter passes synthetic refusal tests, but configured local hooks and independent forge/CI prevention remain unverified. | RMGR-WP-0021-T01 source done; T02 local activation, T03 forge/CI, T04 response; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure | | G08 | Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified. | NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work | Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests | | G09 | Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption. | CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07 | For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred | | G10 | Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields. | CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions | Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance | @@ -87,6 +87,17 @@ Actual privacyIDEA 3.12.2/SQLite tests prove retry stability, mismatch/refusal a rollback behavior; the full suite passes 288 tests plus 29 subtests. Deployed-image/PostgreSQL/MFA acceptance, legacy-object revocation and the separate privileged KeyCape token path remain open. [Receipt](evidence/2026-10-12-netkingdom-security/admin-bootstrap.json). +G07 inherited-control inspection found all 21 review repositories using the same +generated-only pre-commit guard; Custodian has a separate equivalent local hook. +A synthetic private key committed successfully through the actual inherited hook. +Repo Manager `77fc4c9` supplies a pinned Gitleaks staged-object adapter that rejects a +synthetic key without logging findings, checks partial/alternate indexes and +`git commit --only`, and refuses missing/failed tools or unsupported inputs. +All 249 owner tests pass. The shared hook has not been replaced. RMGR-WP-0021 explicitly owns local +activation, independent forge/CI coverage and private response acceptance. +All four DSM-DETECT requirements now have incomplete assessments rather than +unverified placeholders. [Receipt and exact hook inventory](evidence/2026-10-12-netkingdom-security/secret-detection.json). + ## SEC DSM requirement coverage Each numbered requirement in these families is in scope for assessment. The @@ -157,8 +168,8 @@ reviews remain in the existing plans. Completion means verified closure of these findings and all applicable requirements, not merely publication of this plan. Individual requirement ledger: [116 numbered entries](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json), -including 20 anti-pattern references, eight requirements assessed incomplete with -scoped source evidence, and 88 otherwise unverified entries. The ledger records +including 20 anti-pattern references, 12 requirements assessed incomplete with +scoped evidence, and 84 otherwise unverified entries. The ledger records what each repair proves and what is missing; no requirement is marked conformant. [Source inventory](evidence/2026-10-12-netkingdom-security/source-inventory.json) records 21 repository revisions and their open workplans at initial inspection. The [scanner configuration inventory](evidence/2026-10-12-netkingdom-security/scanner-wiring-inventory.json) diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 7a509404..a0d5957e 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -140,6 +140,17 @@ records the remaining privileged KeyCape token path explicitly (eight incomplete 88 unverified, 20 reference entries). Native PostgreSQL/image/MFA acceptance, legacy-object revocation and other delegated helper lifecycle remain open. +2026-10-12 G07 broadened audit: all 21 review repositories inherit a generated-only +guard; a disposable private-key commit succeeds through it. Repo Manager's new +`secret-scan` adapter (`77fc4c9`, pushed) pins Gitleaks, scans exact staged blobs without content +output and passes 17 focused tests including an actual refused selective commit. +All 249 Repo Manager tests pass, no skips. +RMGR-WP-0021 owns source integration, exact local activation, independent forge/CI +coverage and private detection-to-response acceptance. No global hook/routing +changed and no real credential finding was exposed. Four DSM-DETECT assessments +are now explicitly incomplete (12 incomplete, 84 unverified, 20 references). +Evidence: `secret-detection.json`; G07 stays open pending native enforcement. + ## Verify native closure against every requirement ```task