diff --git a/.custodian-brief.md b/.custodian-brief.md index 347573d..ef8b60a 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,16 +2,17 @@ # Custodian Brief — the-custodian **Domain:** infotech -**Last synced:** 2026-10-12 04:39 UTC +**Last synced:** 2026-10-13 20:02 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### NetKingdom security blueprint and SEC-DSM gap closure -Progress: 2/4 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52` +Progress: 2/5 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52` **Open tasks:** - ► Close source defects and reconcile uncovered lifecycle gaps `87637402` +- ► Coordinate self-service Playwright identity delivery `ed8b909a` - · Verify native closure against every requirement `82378b0f` ### Separate agent credentials and establish supervised privileged execution @@ -43,7 +44,7 @@ Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3` **Open tasks:** - ! Schedule the flow report and decision sync `1be0569c` - *(wait: Awaiting daily schedule owner acceptance; workstation user service bus unavailable. Handoff 117e538e-da06-48b8-ba68-b82300a832e7.)* + *(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)* - ! Encode the standing change rule as a policy-nexus guardrail `5dd52156` *(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)* - ! Stop agent-authored index and sync commits `8a3dc219` diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md index 15f0b37..2f6079a 100644 --- a/docs/security-close-down-checklist.md +++ b/docs/security-close-down-checklist.md @@ -30,3 +30,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi | 21 | Independent repository secret detection and response (CUST-WP-0080 G07) | Scanner active on 22 workstation checkouts and 166 of 167 Forgejo repositories. Exact expansion of 143 targets passed native SSH scanner verdicts and final cleanup audit; one repository with four external submodules remains builtin-only. [Expansion evidence](evidence/2026-10-13-netkingdom-security/forge-expansion-final.json). Template inheritance deployed October 13; its first rollout broke scanner custody permissions and is retained as failed. Recovery adds a pinned startup guard; two Kubernetes replacements (generations 13/14) pass 0755 custody and native clean/secret/quarantine/recovery checks. Thirty isolated configuration/lifecycle/rollback checks pass; authenticated production API/SSO/frontend acceptance remains open. Import/mirror fetch, historical/LFS/log/artifact coverage and private finding response remain open. [Recovery evidence](evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json). | Complete FORGE-WP-0006 and RMGR-WP-0021: admit the full repository denominator, persist/reconcile hooks across creation and lifecycle, verify deployed write paths and unsupported input handling, and prove private detection-to-response with existing custody owners. Rejection alone does not revoke prior exposure; CUST-WP-0073-T05 remains founder-deferred. | railiance-forge, repo-manager; Custodian coordinates | 2026-10-13 | | 22 | CI runner authority boundary (CUST-WP-0080 G12) | Reproduced unauthenticated cross-pod Docker access is closed: same-image generation 4 listens on loopback only, local ping and heartbeat pass, peer pod denied. [Evidence](evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json). Host-mode jobs still share the privileged runner; no full isolation or job-scoped credential claim. | Complete native workflow authority, required detection checks, job identity/expiry and privileged runner trust boundaries under FORGE-WP-0006 / RMGR-WP-0021. Preserve loopback-only listener across deployments. | railiance-forge, railiance-enablement, railiance-platform; source railiance-apps | 2026-10-13 | | 23 | Traefik HTTPS upload read budget | Activated 2026-10-13 under the founder-approved publication fix: shared websecure readTimeout raised from 60s to bounded 600s. Traefik generation 2 Ready; five previously failing Forgejo OCI blobs completed in 85–183s, exact tested image digest published. Evidence: railiance-cluster RCLUSTER-WP-0016 and rapp-playwright/docs/evidence/2026-10-13-publication.md. TLS and registry authentication stay enforced. | At production close-down review the 600s body-read budget and slow-upload exposure; retain a measured artifact-upload budget or isolate the registry entry point. Do not disable timeouts. | railiance-cluster / railiance-forge | 2026-10-13 | +| 24 | Metered spend settlement (rein-aharness spend envelopes) | Opt-in per envelope since 2026-10-14 (rein-aharness `c7dceee`, `c04d1c6`; owner decision `a93619a9`): `settlement: observed-usage` charges a completed provider request its gateway-metered cost (provider-reported tokens at admitted rates) instead of its full hold, and a run max(metered requests, reported/attested cost). Unfinished requests keep full hold; overrun still freezes the envelope; `full-hold` stays the default. First use: memo `infd-20261014-b01` (3 attempts, EUR 10). Provider-reported usage is trusted until billing is compared. | Compare each observed-usage envelope's charges with provider billing before renewal; decide whether observed-usage stays allowed or envelopes return to full-hold. | rein-aharness, owner | 2026-10-14 |