diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r7/completion-audit.json b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r7/completion-audit.json new file mode 100644 index 00000000..931cd739 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r7/completion-audit.json @@ -0,0 +1,323 @@ +{ + "objective": "Finish what you found missing and finish CUST-WP-0080", + "status": "active", + "observed_at": "2026-10-18T11:47:21.781597+00:00", + "full_scope_baseline": { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json", + "sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065", + "all_requirements_retained": true + }, + "normative_architecture": { + "path": "docs/netkingdom-target-security-architecture.md", + "sha256": "sha256:701c1e276df3d21925f6939821fb3953babfcb5bce8ff10fed582642f75ff484" + }, + "acceptance_gates": [ + { + "id": "TSA-01", + "required_outcome": "Every inventoried privileged PEP authenticates its decision", + "required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-02", + "required_outcome": "Exact approval produces one bounded protected operation", + "required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-03", + "required_outcome": "Crashes preserve uncertainty and cleanup", + "required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-04", + "required_outcome": "First reusable browser case is accepted", + "required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-05", + "required_outcome": "Human and browser consumers can use the delivered identity", + "required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-06", + "required_outcome": "Actual agent and runner authority is bounded", + "required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-07", + "required_outcome": "Credential lifecycle is inventoried and simplified", + "required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-08", + "required_outcome": "Recovery is independent and measured", + "required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-09", + "required_outcome": "Security effects have independently reconciled evidence", + "required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-10", + "required_outcome": "Source and delivery controls cover declared entry paths", + "required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-11", + "required_outcome": "Discovery remains accurate", + "required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-12", + "required_outcome": "Improvement operates without repeated manual polling", + "required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-13", + "required_outcome": "Shared adapters reduce per-consumer implementation", + "required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-14", + "required_outcome": "Minimal profiles are independently reusable", + "required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-15", + "required_outcome": "Optimization improves measured operations", + "required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-16", + "required_outcome": "Governance and exceptions remain truthful", + "required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.", + "status": "incomplete", + "completion_evidence": [] + } + ], + "sec_dsm_requirements": { + "path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json", + "sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184", + "count": 116, + "status_counts": { + "unverified": 84, + "incomplete": 12, + "reference": 20 + }, + "closure_status_unchanged": true + }, + "gap_ids": [ + "G01", + "G02", + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12", + "G13" + ], + "separate_required_deliverables": [ + "G01-G13 current closure evidence or already applicable approved exceptions", + "SEC-DSM requirement ledger reconciled with exact evidence", + "T05 real human and agent Playwright acceptance and supported discovery", + "Second real consumer and clean installation proves reuse", + "Residual handoffs before workplan finish; no required work left only in prose" + ], + "source_progress": { + "packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1", + "producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3", + "consumer_owner_commit": "git:308e83fcfbf9ec98dbe6b0286cbe8ec7be8899b3", + "consumer_paths": 40, + "patch_sha256": "sha256:feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c", + "postgreSQL_test_subtest_passes": 37, + "database_schema_profiles": [ + "default", + "explicit-public", + "named" + ], + "separate_client_crash_recovery": true, + "actual_database_server_restart_recovery": true, + "controlled_missing_lock_and_private_marker_counterexamples": true, + "following_query_hook_context_panic_corrected": true, + "selected_composed_passes_including_subtests": 94, + "source_skips": 0, + "release": { + "frontend_and_static_backend": "passed", + "release_version": "11.0.3+cust80.feb10793", + "binary_sha256": "sha256:92efb26614d3fca22c400920d92c4cd022e32ab86c1f562f60699ab5f750cd28", + "embedded_assets_exact": 2234, + "actual_release_CLI_checks": 48, + "exact_local_OCI_exports": 2, + "manifest": "sha256:9d127b0a75d3d53b1598e7f380dce29f23f42c2e69056fdfc9a42122d98c41c7", + "native_admission": false + }, + "independent_owner_assent": false, + "production_database": false, + "native_gates_closed": 0 + }, + "current_work": "Finish the exact native scanner activation/recovery executor, resource/drift preflight and independent admission; obtain founder go for that new live revision, verify activation and ordinary queued source publication. Implement the selected current KeyCape checks across actual Forgejo ongoing HTTP/API/Git/SSH paths, including authoritative account/source/subject/application-tenant binding, current groups and exact resource/action policy. Finish actual current protected operation/inverse and effect/approval integration; private journal custody/retention; every-release-writer exclusion; complete release rebuild and independent/native acceptance. All sixteen gates, G01-G13 and 116 ledger entries remain in scope.", + "workplan_finished": false, + "goal_complete": false, + "preceding_audit": { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r6/completion-audit.json", + "sha256": "sha256:0885c059f5a2a75b9592a3ead6981529b88356e0aa9e729369a66f79aa72fc94" + }, + "issuer_source_progress": { + "packet": "docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1", + "base_revision": "git:d803e9282a47b49daf930fb905312fa5104c0ace", + "scope": "proposed opt-in extension in the existing issuer", + "source_delta_paths": 18, + "complete_race_passes_including_subtests": 659, + "existing_native_external_skips": 6, + "new_token_status_passes_including_subtests": 43, + "actual_built_server_process_checks": 26, + "actual_process_restart": true, + "actual_handler_HTTPS_PKCE_status_revocation": true, + "controlled_revocation_guard_omission_failed_checks": 7, + "independent_owner_assent": false, + "native_admission": false, + "gates_closed": 0, + "owner_identifier_reconciliation": "existing exact historical reference restored using official consistency injection helper; new canonical records assigned by normal Repo Manager; no replacement existing UUID", + "consumer_owner_commit": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32", + "owner_primary_projection_verified": true, + "owner_workplan": "KEY-WP-0042", + "owner_workplan_status": "proposed", + "owner_tasks": { + "T01": "progress", + "T02": "done", + "T03": "todo" + }, + "source_task_complete_only": true + }, + "shared_client_source_progress": { + "packet": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1", + "issuer_commit": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7", + "warden_commit": "git:08c098e64a9afd89e43f65436782ed2bb69cdfbd", + "complete_issuer_race_passes_including_subtests": 724, + "existing_native_external_skips": 6, + "warden_canonical_unit_passes": 796, + "warden_deselected": 4, + "built_cross_owner_fixture_assertions": 45, + "owner_processes": 2, + "generated_go_consumer_processes": 4, + "exact_source_delta_replay_paths": 23, + "single_generated_producer_export_and_drift_refusal": true, + "independent_owner_assent": false, + "native_admission": false, + "second_real_consumer": false, + "native_gates_closed": 0, + "both_owner_primary_projections_verified": true + }, + "current_callback_source_progress": { + "packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1", + "issuer_revision": "git:e2c5a947829568baf837543a6708fd0c3f6a863b", + "apps_revision": "git:ab3cf5cdc56d085d040256e2e84633b0289ab0af", + "consumer_source_postimages_exact": 49, + "issuer_source_postimages_exact": 6, + "latest_focused_results": 91, + "final_composed_results": 116, + "composed_skips": 0, + "complete_issuer_race_results": 726, + "existing_native_external_skips": 6, + "actual_issuer_consumer_processes": 5, + "original_purpose_and_issuer_failures_retained": true, + "synthetic_MFA_and_PDP_admission": true, + "independent_owner_assent": false, + "complete_release_rebuild": false, + "native_admission": false, + "native_gates_closed": 0, + "both_owner_primary_projections_verified": true + }, + "ongoing_access_profile": { + "selection": "Require current KeyCape checks on every ongoing API/Git/SSH operation for linked Forgejo accounts; retain separate local break-glass path", + "selected_by": "user conversation response", + "decision": "b96ef564-c713-4a48-9ab2-849958cec681", + "implementation_status": "incomplete", + "native_rollout_authority": false + }, + "receive_scanner_source_progress": { + "packet": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1", + "source_commit": "git:ea65606c1298db782f721f9443bafeb03cdef138", + "owner_primary_projection_verified": true, + "source_delta_paths": 6, + "distinct_passed_leaf_cases": 54, + "skipped": 0, + "exact_original_delta_objects": 141, + "exact_original_delta_refs": 1, + "exact_original_delta_seconds": 52.53, + "unchanged_deadline_seconds": 90, + "candidate_binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "installed_hook_inventory": 166, + "conditional_source_fields_only": 2, + "server_dry_runs_passed": true, + "activation_executor_complete": false, + "independent_owner_assent": false, + "native_admission": false, + "native_gates_closed": 0, + "root_remote_publication_complete": false, + "owner_workplan": "FORGE-WP-0010", + "owner_tasks": { + "T01": "done", + "T02": "progress", + "T03": "wait" + } + }, + "tracking_refinement": { + "workplan": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "decision": "77f88913-e893-42c8-992d-2f67df0a13db", + "original_6_bindings_and_statuses_preserved": true, + "additional_delivery_checkpoints": 34, + "delivery_status_counts": { + "done_source_evidence": 7, + "progress": 1, + "todo": 26 + }, + "raw_task_counts": { + "done": 9, + "progress": 4, + "todo": 27 + }, + "current_checkpoint": "CUST-WP-0080-T20", + "next_checkpoints": [ + "CUST-WP-0080-T14", + "CUST-WP-0080-T15" + ], + "completed_source_records_do_not_close_native_gates": true, + "coverage_validation": "docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/validation.json" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md new file mode 100644 index 00000000..6e516a78 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md @@ -0,0 +1,57 @@ +# Receive scanner: bounded small-input source correction + +Published owner source: railiance-forge +`ea65606c1298db782f721f9443bafeb03cdef138`, six files, ordinary hooks and primary +projection verified. Existing unrelated WORK-RECORDS bytes/index were preserved. +FORGE-WP-0010-T01 is done; T02 remains progress and T03 waits for native admission. +Finished FORGE-WP-0006 and unpromoted FORGE-WP-0008 retain their original scopes. + +The unchanged adapter reproduced the refused Custodian publication: after 90.06 +seconds, 94 of 141 introduced objects were scanned and the result was unverified. +It starts Gitleaks once for every object. The existing Repo Manager profile +provides the correction: batch up to 64 inputs of at most 4096 bytes; retain the +original stdin fragment path for larger inputs. Scanner 8.30.1, default rules, +object/ref coverage, all size/count limits and the 90-second deadline are unchanged. + +The final production source scans all 141 objects and one ref in 52.53 seconds. +The full suite passes 49 leaf cases; five additional boundary cases bring the +distinct combined coverage to 54, with zero skips. It covers actual receive-pack +quarantine, historical/merge/tag/ref content, suppression attempts and limits, +binary inputs, the 4096-byte boundary, larger-input stdin behavior, strict +diagnostic/report handling, receiver loss, reader termination and identity-checked +cleanup. Separate actual helper processes refuse unavailable and ordinary-disk +storage. Raw fixture inputs exist only in private namespace tmpfs or process memory. + +The original repeated-character token fixture failed its reference check: the +existing stdin scanner did not detect it. No directory parity claim is made for +that attempt. The fixture now generates a high-entropy synthetic value. The failed attempt is +retained. The first missing-storage harness accidentally retained bwrap's default +tmpfs; a later file-over-directory mount was rejected by bwrap itself. Neither +counts as storage-refusal proof. The corrected unavailable-root and ordinary-disk +checks both return the adapter's fixed `volatile-storage-unavailable` refusal. +Early read-only preflight failures and syntax/setup refinements also remain visible. + +Read-only native inspection verifies the intended dual-stack node, Linux 6.8, +UID 1000, actual tmpfs, unchanged installed binary/scanner hashes and 166 identical +installed hook fragments. It corrects the assumed repository path to +`/data/git/gitea-repositories`. The old Helm release predates intervening live +changes, so it must not be replayed for this correction. + +`native-preparation/` contains two proposed public Apps source files, the immutable +new hook ConfigMap and a conditional Deployment patch. Only the existing startup +guard command and hook ConfigMap reference change. Reused Forgejo patch helpers +prove local forward/inverse restoration and exact Deployment/ConfigMap server dry +runs. This is preparation, not an activation proposal ready for approval: the +sealed activation/recovery executor, final drift/resource preflight, independent +owner/package admission and founder go remain necessary. No native artifact, +hook, Deployment, credential, policy, image or database changed. + +Key evidence: `combined-tests.json`, `scan-r2.json`, `build-provenance.json`, +`native-hook-inventory.json`, `native-preparation/preparation.json`, +`publication-commit.json` and `projection.json`. Baseline reproduction is in +`../receive-scanner-budget-r1/`. The binary stays outside Git. Source postimages +and the exact patch are retained here; owner Git is authoritative. + +CUST-WP-0080 remains 2/6 coordinator tasks done with 0/16 complete native target +gates closed. G01–G13 and all 116 ledger entries remain required. Latest root +evidence is still unpublished remotely because the old live scanner is unchanged. diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/apply_owner.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/apply_owner.py new file mode 100644 index 00000000..2ebfcecb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/apply_owner.py @@ -0,0 +1,37 @@ +"""Apply six reviewed public source files; no live/control installation.""" +from pathlib import Path +import hashlib +import json +import os +import subprocess + +HERE = Path(__file__).resolve().parent +ROOT = Path('/home/worsch/railiance-forge') +manifest=json.loads((HERE/'publication-inputs.json').read_text()) +def git(*args): + return subprocess.check_output(['git','-C',str(ROOT),*args],stderr=subprocess.PIPE).decode().strip() +assert git('rev-parse','HEAD')==manifest['base_revision'] +original={} +for name in ['.custodian-brief.md','WORK-RECORDS.md']: + original[name]={'bytes':(ROOT/name).read_bytes(), 'index':git('ls-files','--stage','--',name)} +for row in manifest['files']: + path=ROOT/row['path']; source=HERE/'owner-source'/row['path'] + assert hashlib.sha256(source.read_bytes()).hexdigest()==row['sha256'] + assert not path.is_symlink() + assert (hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None)==row['prior_sha256'] +receipt=HERE/'source-application.json' +assert not receipt.exists() +for row in manifest['files']: + path=ROOT/row['path']; source=HERE/'owner-source'/row['path'] + temp=path.with_name(path.name+'.cust80-tmp') + with temp.open('xb') as f: + os.chmod(temp,0o644) + f.write(source.read_bytes()) + f.flush(); os.fsync(f.fileno()) + os.replace(temp,path) +for name, old in original.items(): + assert (ROOT/name).read_bytes()==old['bytes'] + assert git('ls-files','--stage','--',name)==old['index'] +receipt.write_text(json.dumps({'source_applied':True,'base_revision':manifest['base_revision'], + 'files':manifest['files'],'original_unrelated_state_preserved':True,'native_changed':False},indent=2)+'\n') +print(json.dumps({'source_applied':True,'files':len(manifest['files']),'native_changed':False})) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/baseline.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/baseline.json new file mode 100644 index 00000000..35d2b46f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/baseline.json @@ -0,0 +1,7 @@ +{ + "owner": "railiance-forge", + "base_revision": "git:b42206e52bce0e11f9615b4e774f80f9015a1ef7", + "workspace": "/tmp/custodian-receive-scanner-batch-r1/source", + "goal": "CUST-WP-0080 G07/TSA-10/TSA-15; source correction only", + "native_authority": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/binary-build-info.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/binary-build-info.txt new file mode 100644 index 00000000..f5474764 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/binary-build-info.txt @@ -0,0 +1,11 @@ +/tmp/custodian-receive-scanner-batch-r1/candidate-hook: go1.26.7 + path railiance-forge/receive-secret-scan + mod railiance-forge/receive-secret-scan (devel) + build -buildmode=exe + build -compiler=gc + build -trimpath=true + build DefaultGODEBUG=asynctimerchan=1,containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,gotestjsonbuildtext=1,gotypesalias=0,httpcookiemaxnum=0,httpservecontentkeepheaders=1,multipathtcp=0,randseednop=0,rsa1024min=0,tls3des=1,tlsmlkem=0,tlssecpmlkem=0,tlssha1=1,updatemaxprocs=0,urlmaxqueryparams=0,urlstrictcolons=0,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509usepolicies=0 + build CGO_ENABLED=0 + build GOARCH=amd64 + build GOOS=linux + build GOAMD64=v1 diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-provenance.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-provenance.json new file mode 100644 index 00000000..f6fb3bc3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-provenance.json @@ -0,0 +1,11 @@ +{ + "compiler_version": "go1.26.7", + "compiler_sha256": "182d1dc98119d61a6241590e1aaca180d771dbcb1133b9846684aee82d457362", + "installed_module_ziphash": "h1:BbG1DRIqH1ZVMRnQg/4M6jtOJjMFUusUjI+kXRBWqE8=", + "go_module_dependencies": [], + "candidate_binary_sha256": "73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "scanner_version": "8.30.1", + "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "native_admission": false, + "source_commit": "ea65606c1298db782f721f9443bafeb03cdef138" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r1.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r1.json new file mode 100644 index 00000000..681bc04f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r1.json @@ -0,0 +1,95 @@ +{ + "returncode": 0, + "seconds": 12.06, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "build", + "-buildvcs=false", + "-trimpath", + "-o", + "/work/candidate-hook", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2", + "batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r1.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r1.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r2.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r2.json new file mode 100644 index 00000000..80c78efa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r2.json @@ -0,0 +1,95 @@ +{ + "returncode": 0, + "seconds": 1.07, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "build", + "-buildvcs=false", + "-trimpath", + "-o", + "/work/candidate-hook", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r2.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/build-r2.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/combined-tests.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/combined-tests.json new file mode 100644 index 00000000..d66c3d58 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/combined-tests.json @@ -0,0 +1,64 @@ +{ + "full_suite": "test-r2.json", + "additional_affected_checks": "test-r3.json", + "distinct_passed_leaf_cases": 54, + "distinct_passed_nodes": 59, + "failed": 0, + "skipped": 0, + "leaf_cases": [ + "TestBatchAndLargerInputPushBoundaries/exact-limit-key", + "TestBatchAndLargerInputPushBoundaries/larger-stdin-clean", + "TestBatchAndLargerInputPushBoundaries/larger-stdin-key", + "TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection", + "TestBatchRefusesUnverifiedReportsAndDiagnostics", + "TestCappedOutput", + "TestGitEnvironmentDoesNotInheritConfigOrSecrets", + "TestNativePushBoundaries/aggregate-byte-limit-refused", + "TestNativePushBoundaries/annotated-tag-message", + "TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion", + "TestNativePushBoundaries/commit-message", + "TestNativePushBoundaries/external-gitlink-refused", + "TestNativePushBoundaries/grafts-cannot-hide-introduced-history", + "TestNativePushBoundaries/initial-repository-clean-and-secret/false", + "TestNativePushBoundaries/initial-repository-clean-and-secret/true", + "TestNativePushBoundaries/inline-and-config-suppression-refused", + "TestNativePushBoundaries/merge-second-parent-history", + "TestNativePushBoundaries/missing-scanner-and-deletion-refused", + "TestNativePushBoundaries/multi-ref-all-refused", + "TestNativePushBoundaries/new-branch-and-force-update", + "TestNativePushBoundaries/object-count-limit-refused", + "TestNativePushBoundaries/oversized-object-refused", + "TestNativePushBoundaries/partial-config-include-refused", + "TestNativePushBoundaries/partial-repository-refused", + "TestNativePushBoundaries/ref-name-token", + "TestNativePushBoundaries/replacement-objects-cannot-hide-secret", + "TestNativePushBoundaries/secret-added-then-deleted", + "TestNativePushBoundaries/secret-in-tip", + "TestNativePushBoundaries/sha256-object-format", + "TestNativePushBoundaries/tag-direct-to-blob", + "TestNativePushBoundaries/wrong-executable-refused", + "TestReceiverDeathCleansStorageAndStopsReader", + "TestScannerFileAndTimeoutRefusal/expired-context", + "TestScannerFileAndTimeoutRefusal/nonexecutable", + "TestScannerFileAndTimeoutRefusal/scanner-process-failure", + "TestScannerFileAndTimeoutRefusal/symlink", + "TestScannerFileAndTimeoutRefusal/unknown-old-ref", + "TestSmallInputParity/binary-private-key", + "TestSmallInputParity/binary-token", + "TestSmallInputParity/clean", + "TestSmallInputParity/empty", + "TestSmallInputParity/exact-limit", + "TestSmallInputParity/exact-limit-private-key", + "TestSmallInputParity/expired-context", + "TestSmallInputParity/inline-suppression", + "TestSmallInputParity/invalid-inputs", + "TestSmallInputParity/private-key", + "TestSmallInputParity/scanner-failure", + "TestSmallInputParity/sixty-four-distinct-inputs", + "TestSmallInputParity/token", + "TestTreeRefusesMalformedAndExternalEntries", + "TestUpdateInputRefusesAmbiguity", + "TestVolatileIdentityRefusesReplacement", + "TestVolatileStorageLifecycle" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/compiletests-r1.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/compiletests-r1.json new file mode 100644 index 00000000..27bc3820 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/compiletests-r1.json @@ -0,0 +1,95 @@ +{ + "returncode": 0, + "seconds": 0.87, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--tmpfs", + "/dev/shm", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "test", + "-buildvcs=false", + "-c", + "-o", + "/work/scanner.test", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/compiletests-r1.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/compiletests-r1.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.json new file mode 100644 index 00000000..b0e61fea --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.json @@ -0,0 +1,106 @@ +{ + "repo_slug": "railiance-forge", + "repo_path": "/home/worsch/railiance-forge", + "source_revision": "ea65606c1298db782f721f9443bafeb03cdef138", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo", + "file_path": ".repo-classification.yaml", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['FORGE-WP', 'RAILIANCE-WP', 'RFORGE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-06", + "message": "Authoritative workplan 04d8ebb9\u2026 is absent from this projection", + "file_path": "workplans/FORGE-WP-0010-receive-scanner-budget.md", + "db_id": "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "4 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:338888ac, the-custodian:51e9eace, the-custodian:89854bab", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "4 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:338888ac, the-custodian:51e9eace, the-custodian:89854bab", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RFORGE-WP-0002' uses prefix 'RFORGE-WP' but repo canonical prefix is 'FORGE-WP' \u2014 new plans must conform", + "file_path": "workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md", + "db_id": "", + "file_value": "RFORGE-WP-0002", + "db_value": "FORGE-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAILIANCE-WP-0001' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'FORGE-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260605-RAILIANCE-WP-0001-statehub-bootstrap.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0001", + "db_value": "FORGE-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 11/12", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-06 fixed: created workstream 04d8ebb9\u2026 for FORGE-WP-0010, wrote ID to FORGE-WP-0010-receive-scanner-budget.md", + " + task FORGE-WP-0010-T01 \u2192 c61c0392\u2026", + " + task FORGE-WP-0010-T02 \u2192 b49d34ef\u2026", + " + task FORGE-WP-0010-T03 \u2192 863c91e4\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 8, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.stderr.txt new file mode 100644 index 00000000..3345563f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/identifier-assignment.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/identifier-assignment.json new file mode 100644 index 00000000..94f5407b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/identifier-assignment.json @@ -0,0 +1,38 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "source", + "namespace": "helixforge", + "assignments": [ + { + "kind": "workplan", + "record_id": "FORGE-WP-0010", + "uuid": "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a", + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md" + }, + { + "kind": "task", + "record_id": "FORGE-WP-0010-T01", + "uuid": "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea", + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md" + }, + { + "kind": "task", + "record_id": "FORGE-WP-0010-T02", + "uuid": "b49d34ef-e6e5-5674-b523-ebcf80e0dcca", + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md" + }, + { + "kind": "task", + "record_id": "FORGE-WP-0010-T03", + "uuid": "863c91e4-7c25-575f-b8b6-f98d0074ce5a", + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/FORGE-WP-0010-receive-scanner-budget.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/inspect_native.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/inspect_native.py new file mode 100644 index 00000000..f4054220 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/inspect_native.py @@ -0,0 +1,78 @@ +"""Read only known public scanner paths; suppress raw cluster errors.""" +from pathlib import Path +import argparse +import json +import subprocess + +HERE = Path(__file__).resolve().parent +parser = argparse.ArgumentParser() +parser.add_argument('--attempt', required=True) +args = parser.parse_args() +assert args.attempt.isalnum() +remote = r''' +import json, subprocess +def call(args, stage='metadata'): + p = subprocess.run(args, capture_output=True, text=True, timeout=30) + if p.returncode: + print(json.dumps({'error':'metadata-command-refused', 'stage':stage})) + raise SystemExit(2) + return p.stdout +items=json.loads(call(['kubectl','get','nodes','-o','json']))['items'] +nodes=[a['address'] for n in items for a in n['status']['addresses'] if a['type']=='InternalIP'] +if len(items)!=1 or '92.205.62.239' not in nodes: + print(json.dumps({'error':'target-node-mismatch', 'node_count':len(items), 'internal_ips':nodes})); raise SystemExit(2) +pods=call(['kubectl','-n','forgejo','get','pods','-o','custom-columns=NAME:.metadata.name,UID:.metadata.uid,PHASE:.status.phase','--no-headers']) +running=[line.split() for line in pods.splitlines() if line.startswith('forgejo-gitea-') and line.split()[-1]=='Running'] +if len(running)!=1: + raise RuntimeError('ambiguous-forgejo-pod') +pod,uid,_=running[0] +paths=[ + '/data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan', + '/data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks', + '/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan', + '/data/git/repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan', +] +script='set -eu\nid -u\nuname -r\nstat -f -c %t /dev/shm\nstat -c "%a:%u:%g:%F" /dev/shm\n' +for path in paths: + script+='if test -f '+path+' && test ! -L '+path+'; then\nstat -c "%a:%u:%g:%F" '+path+'\nsha256sum '+path+'\nelse\necho unavailable\nfi\n' +script+=""" +for base in /data/git/repositories /data/git/gitea-repositories /data/gitea/repositories; do + if test -d "$base"; then printf 'root=%s\\n' "$base"; fi + for path in "$base"/*/*.git/hooks/pre-receive.d/10-custodian-secret-scan; do + if test -f "$path" && test ! -L "$path"; then + printf 'hook=%s\\n' "$path" + stat -c "%a:%u:%g:%F" "$path" + sha256sum "$path" + fi + done +done +""" +output=call(['kubectl','-n','forgejo','exec',pod,'--','sh','-c',script], stage='public-file-metadata') +current=call(['kubectl','-n','forgejo','get','pod',pod,'-o','custom-columns=UID:.metadata.uid','--no-headers']).strip() +if current!=uid: + raise RuntimeError('pod-identity-changed') +print(json.dumps({'node_ip':'92.205.62.239', 'pod':pod, 'pod_uid':uid, 'read_only':True, 'public_scanner_metadata':output.splitlines()})) +''' +compile(remote, '', 'exec') +result = subprocess.run(['ssh', '-o', 'BatchMode=yes', 'railiance01', 'python3', '-'], + input=remote, text=True, capture_output=True, timeout=150) +receipt = {'returncode': result.returncode, 'read_only': True, 'real_credentials_retrieved': False} +if result.returncode == 0: + receipt['result'] = json.loads(result.stdout) +else: + receipt['error'] = 'read-only-metadata-refused; raw output suppressed' + try: + detail=json.loads(result.stdout) + if detail.get('error') in {'metadata-command-refused', 'target-node-mismatch'}: + receipt['detail']=detail + except ValueError: + pass +path=HERE/('native-preflight-'+args.attempt+'.json') +with path.open('x') as f: + f.write(json.dumps(receipt, indent=2)+'\n') +summary={k:receipt[k] for k in ['returncode','read_only','error','detail'] if k in receipt} +if 'result' in receipt: + summary.update({k:receipt['result'][k] for k in ['node_ip','pod','pod_uid']}) + summary['installed_hooks']=sum(line.startswith('hook=') for line in receipt['result']['public_scanner_metadata']) +print(json.dumps(summary)) +raise SystemExit(result.returncode) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-hook-inventory.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-hook-inventory.json new file mode 100644 index 00000000..38bdf7f6 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-hook-inventory.json @@ -0,0 +1,836 @@ +{ + "pod": "forgejo-gitea-7474684b6-lnr9w", + "pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d", + "hooks": [ + { + "path": "/data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + }, + { + "path": "/data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "mode_owner": "775:1000:1000:regular file", + "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r1.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r1.json new file mode 100644 index 00000000..15448b15 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r1.json @@ -0,0 +1,6 @@ +{ + "returncode": 1, + "read_only": true, + "real_credentials_retrieved": false, + "error": "read-only-metadata-refused; raw output suppressed" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r2.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r2.json new file mode 100644 index 00000000..15448b15 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r2.json @@ -0,0 +1,6 @@ +{ + "returncode": 1, + "read_only": true, + "real_credentials_retrieved": false, + "error": "read-only-metadata-refused; raw output suppressed" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r3.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r3.json new file mode 100644 index 00000000..bde78bcf --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r3.json @@ -0,0 +1,9 @@ +{ + "returncode": 2, + "read_only": true, + "real_credentials_retrieved": false, + "error": "read-only-metadata-refused; raw output suppressed", + "detail": { + "error": "target-node-mismatch" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r4.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r4.json new file mode 100644 index 00000000..bc971702 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r4.json @@ -0,0 +1,24 @@ +{ + "returncode": 0, + "read_only": true, + "real_credentials_retrieved": false, + "result": { + "node_ip": "92.205.62.239", + "pod": "forgejo-gitea-7474684b6-lnr9w", + "pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d", + "read_only": true, + "public_scanner_metadata": [ + "1000", + "6.8.0-136-generic", + "1021994", + "1777:0:0:directory", + "755:1000:1000:regular file", + "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan", + "755:1000:1000:regular file", + "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks", + "555:0:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan", + "unavailable" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r5.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r5.json new file mode 100644 index 00000000..bc971702 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r5.json @@ -0,0 +1,24 @@ +{ + "returncode": 0, + "read_only": true, + "real_credentials_retrieved": false, + "result": { + "node_ip": "92.205.62.239", + "pod": "forgejo-gitea-7474684b6-lnr9w", + "pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d", + "read_only": true, + "public_scanner_metadata": [ + "1000", + "6.8.0-136-generic", + "1021994", + "1777:0:0:directory", + "755:1000:1000:regular file", + "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan", + "755:1000:1000:regular file", + "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks", + "555:0:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan", + "unavailable" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r7.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r7.json new file mode 100644 index 00000000..15448b15 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r7.json @@ -0,0 +1,6 @@ +{ + "returncode": 1, + "read_only": true, + "real_credentials_retrieved": false, + "error": "read-only-metadata-refused; raw output suppressed" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r8.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r8.json new file mode 100644 index 00000000..eeb27c00 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preflight-r8.json @@ -0,0 +1,523 @@ +{ + "returncode": 0, + "read_only": true, + "real_credentials_retrieved": false, + "result": { + "node_ip": "92.205.62.239", + "pod": "forgejo-gitea-7474684b6-lnr9w", + "pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d", + "read_only": true, + "public_scanner_metadata": [ + "1000", + "6.8.0-136-generic", + "1021994", + "1777:0:0:directory", + "755:1000:1000:regular file", + "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan", + "755:1000:1000:regular file", + "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks", + "555:0:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan", + "unavailable", + "root=/data/git/gitea-repositories", + "hook=/data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan", + "hook=/data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan", + "775:1000:1000:regular file", + "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan" + ] + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/helm/forgejo-values.yaml b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/helm/forgejo-values.yaml new file mode 100644 index 00000000..e0ece72f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/helm/forgejo-values.yaml @@ -0,0 +1,138 @@ +# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image). +# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials. +# Recreate avoids leveldb queue lock fights on the shared RWO PVC during upgrades. +strategy: + type: Recreate + +service: + http: + type: ClusterIP + +image: + registry: code.forgejo.org + repository: forgejo/forgejo + tag: "11.0.3" + rootless: true + +persistence: + enabled: true + size: 10Gi + +postgresql: + enabled: false + +postgresql-ha: + enabled: false + +redis-cluster: + enabled: false + +valkey-cluster: + enabled: false + +# File subPath keeps Git from copying ConfigMap projection symlinks. +extraVolumes: +- name: secret-scan-template + configMap: + name: forgejo-secret-template-832f6dc6b809 + defaultMode: 365 +extraContainerVolumeMounts: +- &id001 + name: secret-scan-template + mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan + subPath: hook + readOnly: true +extraInitVolumeMounts: +- *id001 + +# Verify admitted scanner custody after Kubernetes fsGroup volume processing. +# Only the existing security subtree is mounted; no credentials are needed. +preExtraInitContainers: +- name: verify-secret-scanner + image: code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba + imagePullPolicy: IfNotPresent + command: + - sh + - -c + - "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security\ + \ && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\n\ + test -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\n\ + test -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n\ + test \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 1000\n\ + test \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \"\ + \ \" -f 1)\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\"\ + \ in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\ + \ && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\ + \ = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \" \"\ + \ -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\ + \ in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n\ + \ test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 755\n\ + \ chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\ + \ = 755\nfi\n" + - sh + - apply + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 64Mi + volumeMounts: + - name: data + mountPath: /data/security + subPath: security + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + +gitea: + admin: + username: forgejo_admin + email: admin@coulomb.social + passwordMode: initialOnlyRequireReset + # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS). + additionalConfigFromEnvs: + - name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR + value: /opt/forge-secret-template + - name: GITEA__mailer__PASSWD + valueFrom: + secretKeyRef: + name: forgejo-mailer + key: MAILER_PASSWD + config: + database: + DB_TYPE: postgres + HOST: forgejo-db-rw.databases.svc.cluster.local:5432 + NAME: forgejo + USER: forgejo + server: + DOMAIN: forgejo.coulomb.social + SSH_DOMAIN: forgejo.coulomb.social + SSH_PORT: 22 + SSH_LISTEN_PORT: 2222 + DISABLE_SSH: false + service: + DISABLE_REGISTRATION: true + security: + INSTALL_LOCK: true + session: + COOKIE_SECURE: true + mailer: + ENABLED: true + FROM: forgejo@coulomb.social + # IONOS submission port 587 uses STARTTLS, not implicit TLS (smtps). + PROTOCOL: smtp+starttls + SMTP_ADDR: smtp.ionos.de + SMTP_PORT: 587 + USER: forgejo@coulomb.social + actions: + ENABLED: true \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/manifests/forgejo-secret-scan-template.yaml b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/manifests/forgejo-secret-scan-template.yaml new file mode 100644 index 00000000..f76dfb99 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/apps-source/manifests/forgejo-secret-scan-template.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: forgejo-secret-template-832f6dc6b809 + namespace: forgejo + labels: + app.kubernetes.io/part-of: forgejo + custodian.coulomb.social/workplan: FORGE-WP-0010 +immutable: true +data: + hook: '#!/bin/sh + + set +vx + + set -eu + + exec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan + --scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks + + ' diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/configmap.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/configmap.json new file mode 100644 index 00000000..842b6615 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/configmap.json @@ -0,0 +1,16 @@ +{ + "apiVersion": "v1", + "kind": "ConfigMap", + "metadata": { + "name": "forgejo-secret-template-832f6dc6b809", + "namespace": "forgejo", + "labels": { + "app.kubernetes.io/part-of": "forgejo", + "custodian.coulomb.social/workplan": "FORGE-WP-0010" + } + }, + "immutable": true, + "data": { + "hook": "#!/bin/sh\nset +vx\nset -eu\nexec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan --scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/deployment-forward.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/deployment-forward.json new file mode 100644 index 00000000..670c848b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/deployment-forward.json @@ -0,0 +1,44 @@ +[ + { + "op": "test", + "path": "/metadata/uid", + "value": "e8eff0aa-64bb-4b44-9a80-a66612986355" + }, + { + "op": "test", + "path": "/metadata/resourceVersion", + "value": "75293954" + }, + { + "op": "test", + "path": "/spec/template/spec/initContainers/0/command", + "value": [ + "sh", + "-c", + "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \" \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 755\nfi\n", + "sh", + "apply" + ] + }, + { + "op": "test", + "path": "/spec/template/spec/volumes/5/configMap/name", + "value": "forgejo-secret-template-b1d7cf8cd13f" + }, + { + "op": "replace", + "path": "/spec/template/spec/initContainers/0/command", + "value": [ + "sh", + "-c", + "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \" \" -f 1)\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 755\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 755\nfi\n", + "sh", + "apply" + ] + }, + { + "op": "replace", + "path": "/spec/template/spec/volumes/5/configMap/name", + "value": "forgejo-secret-template-832f6dc6b809" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/new-hook b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/new-hook new file mode 100644 index 00000000..079afd8d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/new-hook @@ -0,0 +1,4 @@ +#!/bin/sh +set +vx +set -eu +exec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan --scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/old-hook b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/old-hook new file mode 100644 index 00000000..0714e490 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/old-hook @@ -0,0 +1,4 @@ +#!/bin/sh +set +vx +set -eu +exec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan --scanner /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/preparation.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/preparation.json new file mode 100644 index 00000000..b8051d51 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/native-preparation/preparation.json @@ -0,0 +1,40 @@ +{ + "proposal_id": "FORGE10-RECEIVE-BATCH-20261018", + "revision": "preparation-1", + "source_commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "candidate_binary_sha256": "73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "new_directory": "/data/security/receive-secret-scan/20261018-73ee04078786", + "old_directory": "/data/security/receive-secret-scan/20261012-57a0642b6251", + "old_binary_sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec", + "old_configmap": "forgejo-secret-template-b1d7cf8cd13f", + "new_configmap": "forgejo-secret-template-832f6dc6b809", + "old_hook_sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b", + "new_hook_sha256": "832f6dc6b809de4dad401b283a77eb1372b9d29f62b893010f1cecd0af5d01de", + "deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355", + "generation": 14, + "original_template_sha256": "6fc7c79797790dc30871ec523714012b68907b51e8b2d23db22fd1783462ed36", + "proposed_template_sha256": "d308fa8a64612ef506a7c027cf80123ccfae47d75c9d32b9ef504e92f8ca0ca0", + "source_fields_only_verified": true, + "conditional_forward_and_inverse_verified": true, + "deployment_server_dry_run_verified": true, + "configmap_server_dry_run_verified": true, + "native_changed": false, + "approval_requested": false, + "remaining": [ + "Pinned activation/recovery executor, drift/refusal checks and resource preflight", + "Independent owner/package admission and exact founder go", + "Native exact-binary smoke, 166-hook rollout and ordinary publication proof" + ], + "support_hashes": { + "activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789", + "verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd", + "activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3" + }, + "apps_preimage_hashes": { + "helm/forgejo-values.yaml": "sha256:cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f", + "manifests/forgejo-secret-scan-template.yaml": "sha256:8fad71aff5a25d8e31289072b9c06c6ec74ac74fedafc54dde7177bfe187c96a" + }, + "cost_estimate_eur": 0, + "cost_note": "No additional infrastructure or paid service; human effort unpriced.", + "risk_note": "One existing Forgejo Recreate rollout and exact installed-hook copies; availability impact and partial rollout require guarded rollback. No credential, policy, image or database change." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source.patch b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source.patch new file mode 100644 index 00000000..e03849fc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source.patch @@ -0,0 +1,1121 @@ +--- a/tools/receive-secret-scan/main.go ++++ b/tools/receive-secret-scan/main.go +@@ -5,8 +5,6 @@ + import ( + "bytes" + "context" +- "crypto/sha256" +- "encoding/hex" + "encoding/json" + "errors" + "flag" +@@ -95,7 +93,7 @@ + b := &cappedBuffer{limit: limit} + cmd.Stdout = b + cmd.Stderr = io.Discard +- if cmd.Run() != nil { ++ if runChild(cmd) != nil { + return nil, errors.New("git-" + args[0] + "-failed") + } + return b.Bytes(), nil +@@ -133,17 +131,8 @@ + f.Close() + } + }() +- st, err := f.Stat() +- if err != nil { +- return nil, errors.New("scanner-file-refused") +- } +- native, valid := st.Sys().(*syscall.Stat_t) +- if !valid || !st.Mode().IsRegular() || st.Mode().Perm()&022 != 0 || st.Mode().Perm()&0111 == 0 || st.Size() > 64*1024*1024 || native.Uid != 0 && native.Uid != uint32(os.Getuid()) { +- return nil, errors.New("scanner-file-refused") +- } +- hash := sha256.New() +- if _, err = io.Copy(hash, f); err != nil || hex.EncodeToString(hash.Sum(nil)) != scannerHash { +- return nil, errors.New("scanner-digest-mismatch") ++ if err = verifyScannerFD(f); err != nil { ++ return nil, err + } + ok = true + return f, nil +@@ -156,7 +145,10 @@ + cmd.Stdin = bytes.NewReader(content) + cmd.Stdout = io.Discard + cmd.Stderr = io.Discard +- err := cmd.Run() ++ err := runChild(cmd) ++ if ctx.Err() != nil { ++ return false, errors.New("scan-deadline-exceeded") ++ } + if err == nil { + return false, nil + } +@@ -321,21 +313,85 @@ + return fail(errors.New("temporary-directory-unavailable")) + } + defer os.RemoveAll(dir) ++ var storage *volatileStorage ++ defer func() { ++ if storage != nil { ++ if e := storage.close(); e != nil { ++ out.Status = "unverified" ++ out.Reason = e.Error() ++ } ++ } ++ }() ++ getStorage := func() error { ++ if storage == nil { ++ var e error ++ storage, e = newVolatileStorage() ++ return e ++ } ++ if !storage.live() { ++ return errors.New("cleanup-watchdog-unavailable") ++ } ++ return nil ++ } + if os.WriteFile(filepath.Join(dir, "scanner.toml"), []byte("[extend]\nuseDefault = true\n"), 0600) != nil || os.WriteFile(filepath.Join(dir, "ignore"), nil, 0600) != nil { + return fail(errors.New("scanner-config-unavailable")) + } + // Ref names can themselves contain recognized tokens. Never echo them. +- for _, u := range updates { +- blocked, e := scan(ctx, scanner, dir, []byte(u.Ref)) ++ for start := 0; start < len(updates); start += directoryBatchInputs { ++ end := start + directoryBatchInputs ++ if end > len(updates) { ++ end = len(updates) ++ } ++ if end-start == 1 { ++ blocked, e := scan(ctx, scanner, dir, []byte(updates[start].Ref)) ++ if e != nil { ++ return fail(e) ++ } ++ out.ScannedRefs++ ++ if blocked { ++ out.Status = "blocked" ++ out.Reason = "ref-name-detection" ++ return out ++ } ++ continue ++ } ++ if e := getStorage(); e != nil { ++ return fail(e) ++ } ++ var batch []scanInput ++ for i := start; i < end; i++ { ++ batch = append(batch, scanInput{fmt.Sprintf("ref-%d", i), []byte(updates[i].Ref)}) ++ } ++ blocked, e := scanSmall(ctx, scanner, dir, storage, batch) + if e != nil { + return fail(e) + } +- out.ScannedRefs++ +- if blocked { ++ out.ScannedRefs += len(batch) ++ if blocked != "" { + out.Status = "blocked" + out.Reason = "ref-name-detection" + return out + } ++ } ++ var pending []scanInput ++ flush := func() error { ++ if len(pending) == 0 { ++ return nil ++ } ++ if e := getStorage(); e != nil { ++ return e ++ } ++ blocked, e := scanSmall(ctx, scanner, dir, storage, pending) ++ if e != nil { ++ return e ++ } ++ out.Scanned += len(pending) ++ pending = nil ++ if blocked != "" { ++ out.Status = "blocked" ++ out.BlockedID = blocked ++ } ++ return nil + } + for i, info := range objectMetadata { + kind, size := info.kind, info.size +@@ -352,6 +408,18 @@ + return fail(e) + } + } ++ if len(raw) <= directoryInputBytes { ++ pending = append(pending, scanInput{ids[i], raw}) ++ if len(pending) == directoryBatchInputs { ++ if e = flush(); e != nil { ++ return fail(e) ++ } ++ if out.Status == "blocked" { ++ return out ++ } ++ } ++ continue ++ } + blocked, e := scan(ctx, scanner, dir, raw) + if e != nil { + return fail(e) +@@ -363,6 +431,12 @@ + return out + } + } ++ if err = flush(); err != nil { ++ return fail(err) ++ } ++ if out.Status == "blocked" { ++ return out ++ } + after, _, err := refs(ctx) + if err != nil { + return fail(err) +@@ -374,6 +448,9 @@ + return out + } + func main() { ++ if code, handled := internalProcess(os.Args[1:]); handled { ++ os.Exit(code) ++ } + flags := flag.NewFlagSet("receive-secret-scan", flag.ContinueOnError) + flags.SetOutput(io.Discard) + binary := flags.String("scanner", "", "reviewed Gitleaks executable") +--- /dev/null ++++ b/tools/receive-secret-scan/batch.go +@@ -0,0 +1,192 @@ ++package main ++ ++import ( ++ "bytes" ++ "context" ++ "crypto/sha256" ++ "encoding/hex" ++ "errors" ++ "io" ++ "os" ++ "os/exec" ++ "path/filepath" ++ "regexp" ++ "strings" ++ "syscall" ++) ++ ++// Same bounded small-input profile as Repo Manager's staged adapter. Above ++// PIPE_BUF, keep the original stdin reader/fragment path byte-for-byte. ++const directoryInputBytes = 4096 ++const directoryBatchInputs = 64 ++const maxReportBytes = 1024 * 1024 ++ ++type scanInput struct { ++ name string ++ content []byte ++} ++ ++func verifyScannerFD(f *os.File) error { ++ st, err := f.Stat() ++ if err != nil { ++ return errors.New("scanner-file-refused") ++ } ++ native, ok := st.Sys().(*syscall.Stat_t) ++ if !ok || !st.Mode().IsRegular() || st.Mode().Perm()&022 != 0 || st.Mode().Perm()&0111 == 0 || st.Size() > 64*1024*1024 || (native.Uid != 0 && native.Uid != uint32(os.Getuid())) { ++ return errors.New("scanner-file-refused") ++ } ++ if _, err = f.Seek(0, 0); err != nil { ++ return errors.New("scanner-file-refused") ++ } ++ hash := sha256.New() ++ if _, err = io.Copy(hash, f); err != nil || hex.EncodeToString(hash.Sum(nil)) != scannerHash { ++ return errors.New("scanner-digest-mismatch") ++ } ++ if _, err = f.Seek(0, 0); err != nil { ++ return errors.New("scanner-file-refused") ++ } ++ return nil ++} ++ ++// Trusted child mode establishes resource limits before exec of the exact ++// independently pinned scanner descriptor. It accepts no repository commands. ++func batchScannerProcess(args []string) int { ++ if len(args) != 2 { ++ return 127 ++ } ++ if _, err := volatileIdentity(args[1]); err != nil { ++ return 127 ++ } ++ f := os.NewFile(3, "pinned-scanner") ++ if f == nil || verifyScannerFD(f) != nil { ++ return 127 ++ } ++ defer f.Close() ++ for resource, limit := range map[int]uint64{syscall.RLIMIT_FSIZE: maxReportBytes, syscall.RLIMIT_CPU: 20, syscall.RLIMIT_AS: 8 * 1024 * 1024 * 1024} { ++ if syscall.Setrlimit(resource, &syscall.Rlimit{Cur: limit, Max: limit}) != nil { ++ return 127 ++ } ++ } ++ if os.Chdir(args[1]) != nil { ++ return 127 ++ } ++ argv := []string{"gitleaks", "dir", "--config", filepath.Join(args[0], "scanner.toml"), "--gitleaks-ignore-path", filepath.Join(args[0], "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "warn", "--exit-code", "20", "--timeout", "15", "--report-format", "template", "--report-template", filepath.Join(args[0], "template"), "--report-path", filepath.Join(args[0], "report.paths"), "--max-target-megabytes", "0", "payload"} ++ if syscall.Exec("/proc/self/fd/3", argv, []string{"PATH=/usr/bin:/bin", "HOME=" + args[1], "TMPDIR=" + args[1], "LANG=C"}) != nil { ++ return 127 ++ } ++ return 127 ++} ++ ++var safeInputName = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64}|ref-[0-9]{1,3})$`) ++var leakSummary = regexp.MustCompile(`^[0-9]{1,2}:[0-9]{2}(?:AM|PM) WRN leaks found: [1-9][0-9]*\n$`) ++ ++func validateBatchDiagnostics(code int, diagnostics []byte) error { ++ if code != 0 && code != 20 || len(diagnostics) > 0 && !(code == 20 && leakSummary.Match(diagnostics)) { ++ return errors.New("scanner-failed") ++ } ++ return nil ++} ++ ++func batchFindings(code int, raw []byte, known map[string]string) (map[string]bool, error) { ++ findings := map[string]bool{} ++ if len(raw) > 0 { ++ if !bytes.HasSuffix(raw, []byte("\n")) { ++ return nil, errors.New("scanner-report-refused") ++ } ++ for _, line := range strings.Split(string(raw[:len(raw)-1]), "\n") { ++ name, ok := known[line] ++ if !ok { ++ return nil, errors.New("scanner-report-refused") ++ } ++ findings[name] = true ++ } ++ } ++ if (code != 0 && code != 20) || (len(findings) > 0) != (code == 20) { ++ return nil, errors.New("scanner-report-refused") ++ } ++ return findings, nil ++} ++ ++func scanSmall(ctx context.Context, scanner *os.File, config string, storage *volatileStorage, inputs []scanInput) (blocked string, err error) { ++ if len(inputs) == 0 || len(inputs) > directoryBatchInputs || !storage.live() { ++ return "", errors.New("cleanup-watchdog-unavailable") ++ } ++ id, e := volatileIdentity(storage.path) ++ if e != nil || id != storage.id { ++ return "", errors.New("volatile-storage-identity-changed") ++ } ++ payload := filepath.Join(storage.path, "payload") ++ if os.Mkdir(payload, 0700) != nil { ++ return "", errors.New("volatile-storage-unavailable") ++ } ++ defer func() { ++ if os.RemoveAll(payload) != nil && err == nil { ++ err = errors.New("volatile-storage-cleanup-failed") ++ } ++ }() ++ known := map[string]string{} ++ for _, item := range inputs { ++ if !safeInputName.MatchString(item.name) || len(item.content) > directoryInputBytes || known["payload/"+item.name] != "" { ++ return "", errors.New("invalid-scan-batch") ++ } ++ known["payload/"+item.name] = item.name ++ file, e := os.OpenFile(filepath.Join(payload, item.name), os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW, 0600) ++ if e != nil { ++ return "", errors.New("volatile-storage-write-failed") ++ } ++ _, e = file.Write(item.content) ++ closed := file.Close() ++ if e != nil || closed != nil { ++ return "", errors.New("volatile-storage-write-failed") ++ } ++ } ++ if os.WriteFile(filepath.Join(config, "template"), []byte("{{range .}}{{.File}}\n{{end}}"), 0600) != nil { ++ return "", errors.New("scanner-config-unavailable") ++ } ++ report := filepath.Join(config, "report.paths") ++ if e = os.Remove(report); e != nil && !os.IsNotExist(e) { ++ return "", errors.New("scanner-report-refused") ++ } ++ cmd := exec.CommandContext(ctx, "/proc/self/exe", "--batch-scanner", config, storage.path) ++ cmd.ExtraFiles = []*os.File{scanner} ++ cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"} ++ diagnostics := &cappedBuffer{limit: maxReportBytes} ++ cmd.Stdout = io.Discard ++ cmd.Stderr = diagnostics ++ runErr := runChild(cmd) ++ if ctx.Err() != nil { ++ return "", errors.New("scan-deadline-exceeded") ++ } ++ code := 0 ++ var exit *exec.ExitError ++ if runErr != nil { ++ if !errors.As(runErr, &exit) { ++ return "", errors.New("scanner-failed") ++ } ++ code = exit.ExitCode() ++ } ++ if e = validateBatchDiagnostics(code, diagnostics.Bytes()); e != nil { ++ return "", e ++ } ++ st, e := os.Lstat(report) ++ if e != nil || !st.Mode().IsRegular() || st.Size() > maxReportBytes { ++ return "", errors.New("scanner-report-refused") ++ } ++ raw, e := os.ReadFile(report) ++ if e != nil { ++ return "", errors.New("scanner-report-refused") ++ } ++ findings, e := batchFindings(code, raw, known) ++ if e != nil { ++ return "", e ++ } ++ if !storage.live() { ++ return "", errors.New("scanner-report-refused") ++ } ++ for _, item := range inputs { ++ if findings[item.name] { ++ return item.name, nil ++ } ++ } ++ return "", nil ++} +--- /dev/null ++++ b/tools/receive-secret-scan/volatile.go +@@ -0,0 +1,268 @@ ++// Linux volatile input custody; no raw input is written to ordinary disk. ++package main ++ ++import ( ++ "errors" ++ "fmt" ++ "io" ++ "os" ++ "os/exec" ++ "path/filepath" ++ "runtime" ++ "strconv" ++ "strings" ++ "syscall" ++ "time" ++) ++ ++type storageIdentity struct { ++ dev uint64 ++ ino uint64 ++ uid uint32 ++} ++ ++func volatileIdentity(path string) (storageIdentity, error) { ++ var id storageIdentity ++ if filepath.Dir(path) != "/dev/shm" || !strings.HasPrefix(filepath.Base(path), "forge-receive-scan-") { ++ return id, errors.New("volatile-storage-refused") ++ } ++ fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) ++ if err != nil { ++ return id, errors.New("volatile-storage-unavailable") ++ } ++ defer syscall.Close(fd) ++ var st syscall.Stat_t ++ var fs syscall.Statfs_t ++ if syscall.Fstat(fd, &st) != nil || syscall.Fstatfs(fd, &fs) != nil || fs.Type != 0x01021994 || st.Mode&07777 != 0700 || st.Uid != uint32(os.Getuid()) { ++ return id, errors.New("volatile-storage-refused") ++ } ++ return storageIdentity{uint64(st.Dev), st.Ino, st.Uid}, nil ++} ++ ++func removeVolatile(path string, expected storageIdentity) error { ++ if _, err := os.Lstat(path); os.IsNotExist(err) { ++ return nil ++ } ++ id, err := volatileIdentity(path) ++ if err != nil || id != expected { ++ return errors.New("volatile-storage-identity-changed") ++ } ++ if os.RemoveAll(path) != nil { ++ return errors.New("volatile-storage-cleanup-failed") ++ } ++ return nil ++} ++ ++// Pin the exact parent using Linux pidfd, not a reusable numeric process ID. ++func parentDescriptor(parent int) (*os.File, error) { ++ if runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" { ++ return nil, errors.New("cleanup-platform-unsupported") ++ } ++ if parent <= 1 || os.Getppid() != parent { ++ return nil, errors.New("cleanup-parent-refused") ++ } ++ fd, _, errno := syscall.Syscall(434, uintptr(parent), 0, 0) // pidfd_open, Linux 5.3+ ++ if errno != 0 { ++ return nil, errors.New("cleanup-parent-unavailable") ++ } ++ f := os.NewFile(fd, "parent-pidfd") ++ if os.Getppid() != parent || fd >= 1024 { ++ f.Close() ++ return nil, errors.New("cleanup-parent-refused") ++ } ++ return f, nil ++} ++ ++func waitParent(f *os.File, duration time.Duration) bool { ++ fd := int(f.Fd()) ++ var deadline time.Time ++ if duration >= 0 { ++ deadline = time.Now().Add(duration) ++ } ++ for { ++ // select may mutate both arguments, including when interrupted. ++ var set syscall.FdSet ++ set.Bits[fd/64] |= 1 << uint(fd%64) ++ var timeout *syscall.Timeval ++ if duration >= 0 { ++ remaining := time.Until(deadline) ++ if remaining < 0 { ++ remaining = 0 ++ } ++ value := syscall.NsecToTimeval(remaining.Nanoseconds()) ++ timeout = &value ++ } ++ n, err := syscall.Select(fd+1, &set, nil, nil, timeout) ++ if err == syscall.EINTR { ++ continue ++ } ++ return err == nil && n > 0 ++ } ++} ++ ++func signalParent(f *os.File, signal syscall.Signal) { ++ _, _, _ = syscall.Syscall6(424, f.Fd(), uintptr(signal), 0, 0, 0, 0) // pidfd_send_signal ++} ++ ++func cleanupProcess(args []string) int { ++ if len(args) != 5 { ++ return 4 ++ } ++ dev, e1 := strconv.ParseUint(args[1], 10, 64) ++ ino, e2 := strconv.ParseUint(args[2], 10, 64) ++ uid, e3 := strconv.ParseUint(args[3], 10, 32) ++ parent, e4 := strconv.Atoi(args[4]) ++ if e1 != nil || e2 != nil || e3 != nil || e4 != nil { ++ return 4 ++ } ++ expected := storageIdentity{dev, ino, uint32(uid)} ++ id, err := volatileIdentity(args[0]) ++ if err != nil || id != expected { ++ return 3 ++ } ++ process, err := parentDescriptor(parent) ++ if err != nil { ++ return 4 ++ } ++ defer process.Close() ++ if _, err = os.Stdout.Write([]byte("R")); err != nil { ++ return 4 ++ } ++ eof := make(chan bool, 1) ++ go func() { var b [1]byte; n, e := os.Stdin.Read(b[:]); eof <- n == 0 && e == io.EOF }() ++ select { ++ case ok := <-eof: ++ if !ok { ++ return 4 ++ } ++ case <-time.After(180 * time.Second): ++ signalParent(process, syscall.SIGTERM) ++ if !waitParent(process, 5*time.Second) { ++ signalParent(process, syscall.SIGKILL) ++ if !waitParent(process, -1) { ++ return 4 ++ } ++ } ++ } ++ if removeVolatile(args[0], expected) != nil { ++ return 3 ++ } ++ return 0 ++} ++ ++type volatileStorage struct { ++ path string ++ id storageIdentity ++ pipe io.WriteCloser ++ command *exec.Cmd ++ done chan error ++} ++ ++func newVolatileStorage() (*volatileStorage, error) { ++ root, err := syscall.Open("/dev/shm", syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) ++ if err != nil { ++ return nil, errors.New("volatile-storage-unavailable") ++ } ++ var fs syscall.Statfs_t ++ err = syscall.Fstatfs(root, &fs) ++ syscall.Close(root) ++ if err != nil || fs.Type != 0x01021994 { ++ return nil, errors.New("volatile-storage-unavailable") ++ } ++ path, err := os.MkdirTemp("/dev/shm", "forge-receive-scan-") ++ if err != nil { ++ return nil, errors.New("volatile-storage-unavailable") ++ } ++ id, err := volatileIdentity(path) ++ if err != nil { ++ os.RemoveAll(path) ++ return nil, err ++ } ++ cmd := exec.Command("/proc/self/exe", "--cleanup-storage", path, fmt.Sprint(id.dev), fmt.Sprint(id.ino), fmt.Sprint(id.uid), strconv.Itoa(os.Getpid())) ++ cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"} ++ cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} ++ writer, err := cmd.StdinPipe() ++ if err != nil { ++ removeVolatile(path, id) ++ return nil, errors.New("cleanup-watchdog-unavailable") ++ } ++ reader, err := cmd.StdoutPipe() ++ if err != nil { ++ writer.Close() ++ removeVolatile(path, id) ++ return nil, errors.New("cleanup-watchdog-unavailable") ++ } ++ if err = cmd.Start(); err != nil { ++ writer.Close() ++ reader.Close() ++ removeVolatile(path, id) ++ return nil, errors.New("cleanup-watchdog-unavailable") ++ } ++ v := &volatileStorage{path, id, writer, cmd, make(chan error, 1)} ++ go func() { v.done <- cmd.Wait() }() ++ ready := make(chan bool, 1) ++ go func() { ++ var b [1]byte ++ _, e := io.ReadFull(reader, b[:]) ++ reader.Close() ++ ready <- e == nil && b[0] == 'R' ++ }() ++ select { ++ case ok := <-ready: ++ if ok && v.live() { ++ return v, nil ++ } ++ case <-time.After(5 * time.Second): ++ } ++ v.close() ++ return nil, errors.New("cleanup-watchdog-unavailable") ++} ++ ++func (v *volatileStorage) live() bool { ++ select { ++ case err := <-v.done: ++ v.done <- err ++ return false ++ default: ++ return true ++ } ++} ++ ++func (v *volatileStorage) close() error { ++ err := removeVolatile(v.path, v.id) ++ v.pipe.Close() ++ select { ++ case outcome := <-v.done: ++ if outcome != nil && err == nil { ++ err = errors.New("cleanup-watchdog-failed") ++ } ++ case <-time.After(5 * time.Second): ++ v.command.Process.Kill() ++ <-v.done ++ if err == nil { ++ err = errors.New("cleanup-watchdog-failed") ++ } ++ } ++ return err ++} ++ ++// Source-reading/writing children cannot survive loss of their exact parent. ++func runChild(cmd *exec.Cmd) error { ++ runtime.LockOSThread() ++ defer runtime.UnlockOSThread() ++ cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL} ++ return cmd.Run() ++} ++ ++func internalProcess(args []string) (int, bool) { ++ if len(args) == 0 { ++ return 0, false ++ } ++ switch args[0] { ++ case "--cleanup-storage": ++ return cleanupProcess(args[1:]), true ++ case "--batch-scanner": ++ return batchScannerProcess(args[1:]), true ++ } ++ return 0, false ++} +--- /dev/null ++++ b/tools/receive-secret-scan/batch_test.go +@@ -0,0 +1,323 @@ ++package main ++ ++import ( ++ "bufio" ++ "bytes" ++ "context" ++ "crypto/rand" ++ "encoding/hex" ++ "encoding/json" ++ "fmt" ++ "os" ++ "os/exec" ++ "path/filepath" ++ "strings" ++ "testing" ++ "time" ++) ++ ++func TestMain(m *testing.M) { ++ if code, handled := internalProcess(os.Args[1:]); handled { ++ os.Exit(code) ++ } ++ if len(os.Args) == 2 && os.Args[1] == "--test-storage-refusal" { ++ storage, err := newVolatileStorage() ++ if err == nil { ++ storage.close() ++ os.Exit(3) ++ } ++ json.NewEncoder(os.Stdout).Encode(map[string]string{"status": "unverified", "reason": err.Error()}) ++ os.Exit(0) ++ } ++ if len(os.Args) == 2 && os.Args[1] == "--test-storage-parent" { ++ storage, err := newVolatileStorage() ++ if err != nil { ++ os.Exit(3) ++ } ++ if os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic private test input"), 0600) != nil { ++ os.Exit(3) ++ } ++ json.NewEncoder(os.Stdout).Encode(map[string]any{"path": storage.path, "watchdog": storage.command.Process.Pid}) ++ child := exec.Command("/proc/self/exe", "--test-storage-reader", storage.path) ++ child.Stdout = os.Stdout ++ if runChild(child) != nil { ++ os.Exit(4) ++ } ++ os.Exit(0) ++ } ++ if len(os.Args) == 3 && os.Args[1] == "--test-storage-reader" { ++ f, err := os.Open(filepath.Join(os.Args[2], "input")) ++ if err != nil { ++ os.Exit(3) ++ } ++ defer f.Close() ++ fmt.Fprintln(os.Stdout, os.Getpid()) ++ time.Sleep(time.Minute) ++ os.Exit(0) ++ } ++ os.Exit(m.Run()) ++} ++ ++func TestVolatileStorageLifecycle(t *testing.T) { ++ storage, err := newVolatileStorage() ++ if err != nil { ++ t.Fatal(err) ++ } ++ if !storage.live() { ++ t.Fatal("watchdog did not remain live") ++ } ++ if err = os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic input"), 0600); err != nil { ++ t.Fatal("cannot write private fixture") ++ } ++ if err = storage.close(); err != nil { ++ t.Fatal(err) ++ } ++ if _, err = os.Lstat(storage.path); !os.IsNotExist(err) { ++ t.Fatal("private storage retained") ++ } ++} ++ ++func TestVolatileIdentityRefusesReplacement(t *testing.T) { ++ storage, err := newVolatileStorage() ++ if err != nil { ++ t.Fatal(err) ++ } ++ // Keep the original inode alive so a new directory cannot reuse it. ++ original := storage.path + "-original" ++ if os.Rename(storage.path, original) != nil || os.Mkdir(storage.path, 0700) != nil { ++ t.Fatal("cannot prepare replacement") ++ } ++ defer os.RemoveAll(original) ++ defer os.RemoveAll(storage.path) ++ if err = storage.close(); err == nil { ++ t.Fatal("replacement directory accepted") ++ } ++ if _, err = os.Stat(storage.path); err != nil { ++ t.Fatal("replacement directory was removed") ++ } ++} ++ ++func TestReceiverDeathCleansStorageAndStopsReader(t *testing.T) { ++ cmd := exec.Command("/proc/self/exe", "--test-storage-parent") ++ pipe, err := cmd.StdoutPipe() ++ if err != nil || cmd.Start() != nil { ++ t.Fatal("cannot start disposable parent") ++ } ++ defer cmd.Process.Kill() ++ reader := bufio.NewReader(pipe) ++ line, err := reader.ReadBytes('\n') ++ var receipt struct { ++ Path string ++ Watchdog int ++ } ++ if err != nil || json.Unmarshal(line, &receipt) != nil || receipt.Path == "" { ++ t.Fatal("disposable parent did not prepare storage") ++ } ++ var childPID int ++ if _, err = fmt.Fscanln(reader, &childPID); err != nil || childPID < 2 { ++ t.Fatal("disposable reader did not open input") ++ } ++ if cmd.Process.Kill() != nil { ++ t.Fatal("cannot kill disposable parent") ++ } ++ cmd.Wait() ++ deadline := time.Now().Add(5 * time.Second) ++ for time.Now().Before(deadline) { ++ _, pathErr := os.Lstat(receipt.Path) ++ stat, procErr := os.ReadFile(fmt.Sprintf("/proc/%d/stat", childPID)) ++ terminal := os.IsNotExist(procErr) ++ if procErr == nil { ++ // Zombies are terminal; the private PID namespace reaps them. ++ fields := strings.Fields(string(stat)[strings.LastIndex(string(stat), ")")+1:]) ++ terminal = len(fields) > 0 && fields[0] == "Z" ++ } ++ if os.IsNotExist(pathErr) && terminal { ++ return ++ } ++ time.Sleep(10 * time.Millisecond) ++ } ++ t.Fatal("receiver loss retained private input or live reader") ++} ++ ++func TestSmallInputParity(t *testing.T) { ++ scanner := os.Getenv("FORGE_TEST_GITLEAKS") ++ if scanner == "" { ++ t.Skip("requires explicitly admitted disposable Gitleaks binary") ++ } ++ f, err := pinScanner(scanner) ++ if err != nil { ++ t.Fatal(err) ++ } ++ defer f.Close() ++ storage, err := newVolatileStorage() ++ if err != nil { ++ t.Fatal(err) ++ } ++ defer func() { ++ if err := storage.close(); err != nil { ++ t.Error(err) ++ } ++ }() ++ config := t.TempDir() ++ write(t, filepath.Join(config, "scanner.toml"), []byte("[extend]\nuseDefault = true\n")) ++ write(t, filepath.Join(config, "ignore"), nil) ++ privateKey := key(t) ++ var random [32]byte ++ if _, err := rand.Read(random[:]); err != nil { ++ t.Fatal("cannot generate synthetic token") ++ } ++ canary := []byte("glpat-" + hex.EncodeToString(random[:])) ++ for _, tc := range []struct { ++ name string ++ input []byte ++ want bool ++ }{ ++ {"empty", nil, false}, ++ {"clean", []byte("reviewed clean input\n"), false}, ++ {"exact-limit", bytes.Repeat([]byte("x"), directoryInputBytes), false}, ++ {"private-key", privateKey, true}, ++ {"exact-limit-private-key", append(bytes.Repeat([]byte("\n"), directoryInputBytes-len(privateKey)), privateKey...), true}, ++ {"binary-private-key", append([]byte{0, 1, 0}, privateKey...), true}, ++ {"token", canary, true}, ++ {"binary-token", append([]byte{0, 0}, canary...), true}, ++ {"inline-suppression", append([]byte("# gitleaks:allow\n"), privateKey...), true}, ++ } { ++ t.Run(tc.name, func(t *testing.T) { ++ stdin, e := scan(context.Background(), f, config, tc.input) ++ if e != nil || stdin != tc.want { ++ t.Fatal("stdin reference outcome differs", e) ++ } ++ name := strings.Repeat("a", 40) ++ blocked, e := scanSmall(context.Background(), f, config, storage, []scanInput{{name, tc.input}}) ++ if e != nil || (blocked != "") != stdin || blocked != "" && blocked != name { ++ t.Fatal("directory and original stdin detection differ", e) ++ } ++ }) ++ } ++ t.Run("sixty-four-distinct-inputs", func(t *testing.T) { ++ var inputs []scanInput ++ for i := 0; i < directoryBatchInputs; i++ { ++ inputs = append(inputs, scanInput{fmt.Sprintf("%040x", i), []byte("clean")}) ++ } ++ inputs[63].content = privateKey ++ blocked, e := scanSmall(context.Background(), f, config, storage, inputs) ++ if e != nil || blocked != inputs[63].name { ++ t.Fatal("last batch input was not detected", e) ++ } ++ }) ++ t.Run("expired-context", func(t *testing.T) { ++ ctx, cancel := context.WithCancel(context.Background()) ++ cancel() ++ _, e := scanSmall(ctx, f, config, storage, []scanInput{{strings.Repeat("b", 40), []byte("clean")}}) ++ if e == nil || e.Error() != "scan-deadline-exceeded" { ++ t.Fatal("expired scan did not fail closed") ++ } ++ }) ++ t.Run("invalid-inputs", func(t *testing.T) { ++ name := strings.Repeat("c", 40) ++ for _, inputs := range [][]scanInput{ ++ {{"../escape", []byte("clean")}}, ++ {{name, bytes.Repeat([]byte("x"), directoryInputBytes+1)}}, ++ {{name, []byte("clean")}, {name, []byte("clean")}}, ++ } { ++ if _, e := scanSmall(context.Background(), f, config, storage, inputs); e == nil { ++ t.Fatal("invalid batch input accepted") ++ } ++ if _, e := os.Lstat(filepath.Join(storage.path, "payload")); !os.IsNotExist(e) { ++ t.Fatal("invalid batch left input files") ++ } ++ } ++ }) ++ t.Run("scanner-failure", func(t *testing.T) { ++ write(t, filepath.Join(config, "scanner.toml"), []byte("invalid = [")) ++ if _, e := scanSmall(context.Background(), f, config, storage, []scanInput{{strings.Repeat("d", 40), []byte("clean")}}); e == nil { ++ t.Fatal("scanner failure accepted") ++ } ++ }) ++} ++ ++func TestBatchAndLargerInputPushBoundaries(t *testing.T) { ++ adapter, scanner := binary(t) ++ for _, tc := range []struct { ++ name string ++ size int ++ secret bool ++ }{ ++ {"exact-limit-key", directoryInputBytes, true}, ++ {"larger-stdin-key", directoryInputBytes + 1, true}, ++ {"larger-stdin-clean", 70 * 1024, false}, ++ } { ++ t.Run(tc.name, func(t *testing.T) { ++ f := setup(t, adapter, scanner) ++ content := []byte("reviewed clean input\n") ++ want := 0 ++ if tc.secret { ++ content = key(t) ++ want = 1 ++ } ++ content = append(content, bytes.Repeat([]byte("\n"), tc.size-len(content))...) ++ f.commit(t, "input.bin", content, "disposable boundary fixture") ++ f.push(t, want, "HEAD:refs/heads/main") ++ }) ++ } ++ t.Run("multiple-ref-name-detection", func(t *testing.T) { ++ f := setup(t, adapter, scanner) ++ var random [32]byte ++ if _, err := rand.Read(random[:]); err != nil { ++ t.Fatal("fixture generation failed") ++ } ++ out := f.push(t, 1, "HEAD:refs/heads/clean-new", "HEAD:refs/heads/glpat-"+hex.EncodeToString(random[:])) ++ if !bytes.Contains(out, []byte(`"reason":"ref-name-detection"`)) { ++ t.Fatal("multi-ref name was not scanned") ++ } ++ }) ++} ++ ++func TestBatchRefusesUnverifiedReportsAndDiagnostics(t *testing.T) { ++ known := map[string]string{"payload/ref-0": "ref-0"} ++ for _, tc := range []struct { ++ code int ++ raw string ++ }{ ++ {0, "payload/ref-0\n"}, {20, ""}, {0, "\n"}, ++ {20, "payload/ref-0"}, {20, "payload/ref-0\n\n"}, ++ {20, "payload/ref-unknown\n"}, {20, "../payload/ref-0\n"}, ++ {20, "payload/ref-0\r\n"}, {2, ""}, ++ } { ++ if _, err := batchFindings(tc.code, []byte(tc.raw), known); err == nil { ++ t.Fatal("unverified report accepted") ++ } ++ } ++ for _, tc := range []struct { ++ code int ++ raw string ++ }{ ++ {0, ""}, {20, "payload/ref-0\n"}, {20, "payload/ref-0\npayload/ref-0\n"}, ++ } { ++ if _, err := batchFindings(tc.code, []byte(tc.raw), known); err != nil { ++ t.Fatal("valid report refused") ++ } ++ } ++ for _, tc := range []struct { ++ code int ++ text string ++ }{ ++ {0, "12:03PM WRN incomplete scan\n"}, {20, "12:03PM WRN incomplete scan\n"}, ++ {20, "12:03PM WRN leaks found: 1\n12:03PM WRN incomplete scan\n"}, ++ {0, "12:03PM WRN leaks found: 1\n"}, {2, ""}, ++ } { ++ if validateBatchDiagnostics(tc.code, []byte(tc.text)) == nil { ++ t.Fatal("unverified diagnostic accepted") ++ } ++ } ++ for _, tc := range []struct { ++ code int ++ text string ++ }{ ++ {0, ""}, {20, ""}, {20, "12:03PM WRN leaks found: 1\n"}, ++ } { ++ if validateBatchDiagnostics(tc.code, []byte(tc.text)) != nil { ++ t.Fatal("valid diagnostic refused") ++ } ++ } ++} +--- a/docs/receive-secret-detection.md ++++ b/docs/receive-secret-detection.md +@@ -9,7 +9,8 @@ + The forge-owned, standalone Linux adapter composes with Forgejo's generated + pre-receive dispatcher. It uses pinned Gitleaks 8.30.1 Linux amd64 + (SHA256 `88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509`). +-It requires `/usr/bin/git` and `/proc` but no Python runtime, issuer credential, ++It requires `/usr/bin/git`, `/proc`, a private writable tmpfs at `/dev/shm`, ++and Linux pidfd support (5.3+ on amd64/arm64) but no Python runtime, issuer credential, + network access, source checkout, or repository-controlled workflow. The current + Forgejo 11.0.3 image has no Python interpreter; this keeps the runtime change to + two reviewed executables and a hook fragment, subject to native admission. +@@ -67,6 +68,26 @@ + than skip. Large imports need an admitted path; do not disable the gate to pass + an unreviewed import. Git/scanner versions and limits require native load testing. + ++FORGE-WP-0010 corrects per-small-input scanner startup overhead without changing ++these limits. It reuses Repo Manager's bounded profile: at most 64 inputs of at ++most 4096 bytes per directory invocation. Larger inputs retain the existing stdin ++reader and fragment behavior. Raw inputs use 0700 private tmpfs directories and ++0600 files with safe object/ref identifiers; no source path controls a filename. ++Missing or nonvolatile storage refuses instead of falling back to ordinary disk. ++ ++A separately supervised child pins its receiver with pidfd, acknowledges readiness ++before payload writes, and cleans up on pipe EOF. A 180-second backstop terminates ++the exact stalled receiver before cleanup. Git/scanner children die when their ++creating receiver thread dies; it is pinned to its OS thread during each child. ++Normal cleanup and failed cleanup are checked. Directory identity replacement ++refuses deletion. This is not protection against a hostile same-UID host process. ++ ++Directory scans use the same pinned scanner/default config and explicit empty ++ignore file. Bounded reports contain only known safe payload identifiers. Missing, ++malformed, oversized or inconsistent reports, unknown diagnostics and scanner or ++watchdog failures refuse. Only the exact pinned scanner's positive-finding summary ++is accepted as a warning. The original stdin route is otherwise unchanged. ++ + The adapter does not rescan objects already reachable before the push, scan + unreachable extra pack objects, LFS payloads, other repositories, runtime logs, + artifacts or credentials outside Git. It is not an authorization boundary against +@@ -82,8 +103,10 @@ + + ## Build and disposable acceptance + +-Use the admitted Go toolchain (the current candidate uses official Go 1.26.9, +-verified against the SHA256 from go.dev release metadata). No third-party Go ++Use an admitted Go toolchain. The original deployed revision used Go 1.26.9, ++verified against the SHA256 from go.dev release metadata. The FORGE-WP-0010 ++source candidate is separately tested with installed Go 1.26.7; its new source, ++compiler and exact executable still require native admission. No third-party Go + modules are required. Keep binaries and logs outside the repository: + + ```sh +--- /dev/null ++++ b/workplans/FORGE-WP-0010-receive-scanner-budget.md +@@ -0,0 +1,90 @@ ++--- ++id: FORGE-WP-0010 ++type: workplan ++title: "Complete bounded receive scans without per-small-input startup overhead" ++domain: financials ++repo: railiance-forge ++status: proposed ++owner: codex ++topic_slug: railiance-forge ++created: "2026-10-18" ++updated: "2026-10-18" ++flavor: implementation ++depends_on: [] ++state_hub_workstream_id: "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a" ++--- ++ ++CUST-WP-0080 discovered an availability defect in the already enforced receive ++control: the normal 141-object public Custodian source delta exhausts the ++unchanged 90-second budget, with no secret finding. The unmodified owner source ++reproduces the refusal in an isolated bare repository. This is a new correction, ++not reopening finished FORGE-WP-0006 or promoting FORGE-WP-0008 residual coverage. ++ ++Reuse the existing Repo Manager small-input profile: at most 64 inputs of at most ++4096 bytes per directory scan, identical pinned Gitleaks/default rules and strict ++report/diagnostic validation. Larger inputs retain the original stdin fragment ++path. Preserve every traversal/ref/object/byte/time bound, no override or new ++runtime service. Raw batch inputs require checked private tmpfs, independent ++parent-bound cleanup and child termination on receiver loss. Source preparation ++does not grant native installation, package/owner acceptance or production proof. ++ ++## Reproduce and implement the bounded adapter correction ++ ++```task ++id: FORGE-WP-0010-T01 ++status: done ++priority: high ++state_hub_task_id: "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea" ++``` ++ ++Retain the exact original failure and source delta. Implement the existing ++small-input batching contract in the Linux receive adapter. Verify synthetic ++positive/negative parity, real receive-pack quarantine, all prior boundaries, ++limits, expired context, diagnostic/report refusal, normal cleanup, receiver ++death and changed storage identity. Complete the exact original clean delta ++within the same deadline. Failures remain evidence; source proof closes no ++native acceptance gate. Independent package/owner review remains under T02. ++ ++Source result: the exact previously refused 141-object/one-ref delta completes ++in 52.53 seconds with all objects counted, under the unchanged 90-second budget. ++The complete suite passes 49 leaf cases with zero skips; five additional boundary ++cases bring the combined distinct leaf coverage to 54. These include 4096-byte ++and larger-input detection, multi-ref-name detection, normal and receiver-loss ++cleanup, scanner/report/diagnostic failures and changed directory identity. ++Unavailable and ordinary-disk storage fail closed in separate actual helper ++processes. The original low-entropy canary failure and misconfigured storage ++fixture/setup failures are retained rather than counted as successful tests. ++Source/proof: Custodian `docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/`. ++ ++## Prepare and approve the immutable native revision ++ ++```task ++id: FORGE-WP-0010-T02 ++status: progress ++priority: high ++state_hub_task_id: "b49d34ef-e6e5-5674-b523-ebcf80e0dcca" ++``` ++ ++Obtain independent source/package review. Pin exact source/build tool provenance, executable digest, startup-guard and ++hook composition. Capture read-only current state, no-op checks and exact ++before/after/rollback. Retain permissions, scanner digest, hook ordering and ++fail-closed behavior. Obtain the founder's explicit go for this live change ++under the existing environment rule; previous activation is not approval for ++this different executable. Preserve the original revision and every refinement ++in the current supervised-action record. ++ ++## Verify admitted native behavior and ordinary publication ++ ++```task ++id: FORGE-WP-0010-T03 ++status: wait ++priority: high ++state_hub_task_id: "863c91e4-7c25-575f-b8b6-f98d0074ce5a" ++``` ++ ++Waiting on T02: exact executable/startup admission and founder-authorized native ++activation. Verify actual hook clean/refusal/unavailable/cleanup behavior and ++the legitimate ordinary source publication without splitting or seeding refs. ++Reconcile owner task/source status and independent evidence. Existing remaining ++coverage, private incident response and target-wide acceptance retain their ++original owners; no residual implementation is inferred. diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/docs/receive-secret-detection.md b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/docs/receive-secret-detection.md new file mode 100644 index 00000000..26c0afe2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/docs/receive-secret-detection.md @@ -0,0 +1,130 @@ +# Forge receive-path secret detection + +FORGE-WP-0006 implements the forge-owned part of RMGR-WP-0021-T03 and +Custodian CUST-WP-0080 G07. The local Repo Manager scanner remains separate. +The source adapter is not evidence of installed server enforcement. + +## Boundary and ownership + +The forge-owned, standalone Linux adapter composes with Forgejo's generated +pre-receive dispatcher. It uses pinned Gitleaks 8.30.1 Linux amd64 +(SHA256 `88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509`). +It requires `/usr/bin/git`, `/proc`, a private writable tmpfs at `/dev/shm`, +and Linux pidfd support (5.3+ on amd64/arm64) but no Python runtime, issuer credential, +network access, source checkout, or repository-controlled workflow. The current +Forgejo 11.0.3 image has no Python interpreter; this keeps the runtime change to +two reviewed executables and a hook fragment, subject to native admission. + +The forge owns tool admission, hook installation and recovery. Repo Manager +coordinates repository-control coverage; enablement owns reusable CI templates; +source repositories own their workflows. Credential classification and +revocation remain with existing incident/custody owners. + +Do not overwrite generated `hooks/pre-receive` or `pre-receive.d/gitea`, or enable +arbitrary user Git-hook editing. A reviewed additional executable in the existing +`pre-receive.d/` dispatcher is the proposed integration. Server writers, frontend +merge/edit/import paths, SSH and HTTP pushes, hook resynchronization, pod restart +and new repository creation all need separate native acceptance. No admission +or production coverage is inferred from disposable bare-repository tests. + +## What is checked + +Input is the exact `old-object new-object ref-name` batch from receive-pack. +Malformed, duplicate, oversized, inconsistent or unsupported updates refuse. +All updated ref names are scanned without echoing them. Ref exclusions are frozen +from the pre-push snapshot; the traversal scans complete introduced reachable +objects across every new tip and every parent, including annotated tags and +direct object tags. A secret added and removed before the tip is still examined. + +Blob data, raw commit/tag contents and tree names are scanned. Symlink contents +are read as Git blobs; their filesystem targets are never followed. Changed trees +containing external gitlinks refuse because the referenced repository is not +covered. Git replacement objects and grafts cannot hide history. Partial/shallow +repositories, missing objects and unverified traversal refuse. Receive-pack's +quarantine object locations are preserved only for Git reads; the adapter never +updates refs or copies objects into the primary store. + +The scanner executable is opened without following a final symlink, checked for +ownership/mode/regular-file shape and exact SHA256, and executed through its open +file descriptor. Scanner config and ignore files are private temporary files; +repository configuration, inline allow comments and ambient scanner settings do +not disable detection. Child diagnostics/findings are discarded. Output contains +only a fixed status/reason, counts, version and, for an object detection, its ID. +Privately review the identified object; never paste its contents into an issue, +State Hub, CI logs or chat. Standard Git output may independently display ref +names; the adapter does not make Git's transport diagnostics a secret-safe log. + +Exit 0 is `clean` in this declared scope; exit 1 is `blocked`; exit 2 is +`unverified`. Both nonzero statuses must refuse the complete push. There is no +implicit baseline/ignore or override switch. A false-positive exception needs a +separate reviewed mechanism with exact scope, approval and expiry. + +## Bounds and remaining coverage + +Current bounds: 256 updates, 10,000 existing refs, 2,000 introduced objects, +8 MiB per object, 64 MiB total, 512 KiB update input and 90 seconds for the check. +Scanner calls also use the scanner's 15-second timeout. Object sizes and total +bytes are checked before scanning payloads. Limits reject rather +than skip. Large imports need an admitted path; do not disable the gate to pass +an unreviewed import. Git/scanner versions and limits require native load testing. + +FORGE-WP-0010 corrects per-small-input scanner startup overhead without changing +these limits. It reuses Repo Manager's bounded profile: at most 64 inputs of at +most 4096 bytes per directory invocation. Larger inputs retain the existing stdin +reader and fragment behavior. Raw inputs use 0700 private tmpfs directories and +0600 files with safe object/ref identifiers; no source path controls a filename. +Missing or nonvolatile storage refuses instead of falling back to ordinary disk. + +A separately supervised child pins its receiver with pidfd, acknowledges readiness +before payload writes, and cleans up on pipe EOF. A 180-second backstop terminates +the exact stalled receiver before cleanup. Git/scanner children die when their +creating receiver thread dies; it is pinned to its OS thread during each child. +Normal cleanup and failed cleanup are checked. Directory identity replacement +refuses deletion. This is not protection against a hostile same-UID host process. + +Directory scans use the same pinned scanner/default config and explicit empty +ignore file. Bounded reports contain only known safe payload identifiers. Missing, +malformed, oversized or inconsistent reports, unknown diagnostics and scanner or +watchdog failures refuse. Only the exact pinned scanner's positive-finding summary +is accepted as a warning. The original stdin route is otherwise unchanged. + +The adapter does not rescan objects already reachable before the push, scan +unreachable extra pack objects, LFS payloads, other repositories, runtime logs, +artifacts or credentials outside Git. It is not an authorization boundary against +a forge administrator or hostile same-UID process. Default scanner rules remain +heuristic. Historical discovery and finding-to-response are independent work; +removing a source value or rejecting a push does not revoke an exposed credential. +CUST-WP-0073-T05's founder-deferred rotation is unchanged. + +The 165 observed on-disk repository directories are a discovery count, not an +admitted production-software denominator. The 22 reviewed repositories provide a +named rollout starting scope; the owner must reconcile all production repositories, +wikis, archives, mirrors and new-repository lifecycle before claiming DSM coverage. + +## Build and disposable acceptance + +Use an admitted Go toolchain. The original deployed revision used Go 1.26.9, +verified against the SHA256 from go.dev release metadata. The FORGE-WP-0010 +source candidate is separately tested with installed Go 1.26.7; its new source, +compiler and exact executable still require native admission. No third-party Go +modules are required. Keep binaries and logs outside the repository: + +```sh +cd tools/receive-secret-scan +FORGE_TEST_GITLEAKS=/reviewed/gitleaks go test -count=1 -v ./... +CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false -o /tmp/receive-secret-scan . +``` + +The root `make test-secret-detection` target requires `FORGE_TEST_GITLEAKS` +and runs this module; set `GO` to the admitted compiler path where needed. + +Tests use disposable Git servers, actual receive-pack quarantine and generated +keys. Scanner-dependent tests explicitly skip without `FORGE_TEST_GITLEAKS`; +skips are not acceptance. Native activation additionally needs exact original +hook hashes, tool provenance, dry-run/diff, abort owner, rollback and value-free +receipts under the accepted build-mode change rule. + +References: [Git receive-pack and quarantine](https://git-scm.com/docs/git-receive-pack), +[Git object traversal](https://git-scm.com/docs/git-rev-list), +[Forgejo 11.0.3 generated hooks](https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go), +[Gitleaks release](https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1). diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch.go b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch.go new file mode 100644 index 00000000..429c226e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch.go @@ -0,0 +1,192 @@ +package main + +import ( + "bytes" + "context" + "crypto/sha256" + "encoding/hex" + "errors" + "io" + "os" + "os/exec" + "path/filepath" + "regexp" + "strings" + "syscall" +) + +// Same bounded small-input profile as Repo Manager's staged adapter. Above +// PIPE_BUF, keep the original stdin reader/fragment path byte-for-byte. +const directoryInputBytes = 4096 +const directoryBatchInputs = 64 +const maxReportBytes = 1024 * 1024 + +type scanInput struct { + name string + content []byte +} + +func verifyScannerFD(f *os.File) error { + st, err := f.Stat() + if err != nil { + return errors.New("scanner-file-refused") + } + native, ok := st.Sys().(*syscall.Stat_t) + if !ok || !st.Mode().IsRegular() || st.Mode().Perm()&022 != 0 || st.Mode().Perm()&0111 == 0 || st.Size() > 64*1024*1024 || (native.Uid != 0 && native.Uid != uint32(os.Getuid())) { + return errors.New("scanner-file-refused") + } + if _, err = f.Seek(0, 0); err != nil { + return errors.New("scanner-file-refused") + } + hash := sha256.New() + if _, err = io.Copy(hash, f); err != nil || hex.EncodeToString(hash.Sum(nil)) != scannerHash { + return errors.New("scanner-digest-mismatch") + } + if _, err = f.Seek(0, 0); err != nil { + return errors.New("scanner-file-refused") + } + return nil +} + +// Trusted child mode establishes resource limits before exec of the exact +// independently pinned scanner descriptor. It accepts no repository commands. +func batchScannerProcess(args []string) int { + if len(args) != 2 { + return 127 + } + if _, err := volatileIdentity(args[1]); err != nil { + return 127 + } + f := os.NewFile(3, "pinned-scanner") + if f == nil || verifyScannerFD(f) != nil { + return 127 + } + defer f.Close() + for resource, limit := range map[int]uint64{syscall.RLIMIT_FSIZE: maxReportBytes, syscall.RLIMIT_CPU: 20, syscall.RLIMIT_AS: 8 * 1024 * 1024 * 1024} { + if syscall.Setrlimit(resource, &syscall.Rlimit{Cur: limit, Max: limit}) != nil { + return 127 + } + } + if os.Chdir(args[1]) != nil { + return 127 + } + argv := []string{"gitleaks", "dir", "--config", filepath.Join(args[0], "scanner.toml"), "--gitleaks-ignore-path", filepath.Join(args[0], "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "warn", "--exit-code", "20", "--timeout", "15", "--report-format", "template", "--report-template", filepath.Join(args[0], "template"), "--report-path", filepath.Join(args[0], "report.paths"), "--max-target-megabytes", "0", "payload"} + if syscall.Exec("/proc/self/fd/3", argv, []string{"PATH=/usr/bin:/bin", "HOME=" + args[1], "TMPDIR=" + args[1], "LANG=C"}) != nil { + return 127 + } + return 127 +} + +var safeInputName = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64}|ref-[0-9]{1,3})$`) +var leakSummary = regexp.MustCompile(`^[0-9]{1,2}:[0-9]{2}(?:AM|PM) WRN leaks found: [1-9][0-9]*\n$`) + +func validateBatchDiagnostics(code int, diagnostics []byte) error { + if code != 0 && code != 20 || len(diagnostics) > 0 && !(code == 20 && leakSummary.Match(diagnostics)) { + return errors.New("scanner-failed") + } + return nil +} + +func batchFindings(code int, raw []byte, known map[string]string) (map[string]bool, error) { + findings := map[string]bool{} + if len(raw) > 0 { + if !bytes.HasSuffix(raw, []byte("\n")) { + return nil, errors.New("scanner-report-refused") + } + for _, line := range strings.Split(string(raw[:len(raw)-1]), "\n") { + name, ok := known[line] + if !ok { + return nil, errors.New("scanner-report-refused") + } + findings[name] = true + } + } + if (code != 0 && code != 20) || (len(findings) > 0) != (code == 20) { + return nil, errors.New("scanner-report-refused") + } + return findings, nil +} + +func scanSmall(ctx context.Context, scanner *os.File, config string, storage *volatileStorage, inputs []scanInput) (blocked string, err error) { + if len(inputs) == 0 || len(inputs) > directoryBatchInputs || !storage.live() { + return "", errors.New("cleanup-watchdog-unavailable") + } + id, e := volatileIdentity(storage.path) + if e != nil || id != storage.id { + return "", errors.New("volatile-storage-identity-changed") + } + payload := filepath.Join(storage.path, "payload") + if os.Mkdir(payload, 0700) != nil { + return "", errors.New("volatile-storage-unavailable") + } + defer func() { + if os.RemoveAll(payload) != nil && err == nil { + err = errors.New("volatile-storage-cleanup-failed") + } + }() + known := map[string]string{} + for _, item := range inputs { + if !safeInputName.MatchString(item.name) || len(item.content) > directoryInputBytes || known["payload/"+item.name] != "" { + return "", errors.New("invalid-scan-batch") + } + known["payload/"+item.name] = item.name + file, e := os.OpenFile(filepath.Join(payload, item.name), os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW, 0600) + if e != nil { + return "", errors.New("volatile-storage-write-failed") + } + _, e = file.Write(item.content) + closed := file.Close() + if e != nil || closed != nil { + return "", errors.New("volatile-storage-write-failed") + } + } + if os.WriteFile(filepath.Join(config, "template"), []byte("{{range .}}{{.File}}\n{{end}}"), 0600) != nil { + return "", errors.New("scanner-config-unavailable") + } + report := filepath.Join(config, "report.paths") + if e = os.Remove(report); e != nil && !os.IsNotExist(e) { + return "", errors.New("scanner-report-refused") + } + cmd := exec.CommandContext(ctx, "/proc/self/exe", "--batch-scanner", config, storage.path) + cmd.ExtraFiles = []*os.File{scanner} + cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"} + diagnostics := &cappedBuffer{limit: maxReportBytes} + cmd.Stdout = io.Discard + cmd.Stderr = diagnostics + runErr := runChild(cmd) + if ctx.Err() != nil { + return "", errors.New("scan-deadline-exceeded") + } + code := 0 + var exit *exec.ExitError + if runErr != nil { + if !errors.As(runErr, &exit) { + return "", errors.New("scanner-failed") + } + code = exit.ExitCode() + } + if e = validateBatchDiagnostics(code, diagnostics.Bytes()); e != nil { + return "", e + } + st, e := os.Lstat(report) + if e != nil || !st.Mode().IsRegular() || st.Size() > maxReportBytes { + return "", errors.New("scanner-report-refused") + } + raw, e := os.ReadFile(report) + if e != nil { + return "", errors.New("scanner-report-refused") + } + findings, e := batchFindings(code, raw, known) + if e != nil { + return "", e + } + if !storage.live() { + return "", errors.New("scanner-report-refused") + } + for _, item := range inputs { + if findings[item.name] { + return item.name, nil + } + } + return "", nil +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch_test.go b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch_test.go new file mode 100644 index 00000000..d2b52783 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/batch_test.go @@ -0,0 +1,323 @@ +package main + +import ( + "bufio" + "bytes" + "context" + "crypto/rand" + "encoding/hex" + "encoding/json" + "fmt" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func TestMain(m *testing.M) { + if code, handled := internalProcess(os.Args[1:]); handled { + os.Exit(code) + } + if len(os.Args) == 2 && os.Args[1] == "--test-storage-refusal" { + storage, err := newVolatileStorage() + if err == nil { + storage.close() + os.Exit(3) + } + json.NewEncoder(os.Stdout).Encode(map[string]string{"status": "unverified", "reason": err.Error()}) + os.Exit(0) + } + if len(os.Args) == 2 && os.Args[1] == "--test-storage-parent" { + storage, err := newVolatileStorage() + if err != nil { + os.Exit(3) + } + if os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic private test input"), 0600) != nil { + os.Exit(3) + } + json.NewEncoder(os.Stdout).Encode(map[string]any{"path": storage.path, "watchdog": storage.command.Process.Pid}) + child := exec.Command("/proc/self/exe", "--test-storage-reader", storage.path) + child.Stdout = os.Stdout + if runChild(child) != nil { + os.Exit(4) + } + os.Exit(0) + } + if len(os.Args) == 3 && os.Args[1] == "--test-storage-reader" { + f, err := os.Open(filepath.Join(os.Args[2], "input")) + if err != nil { + os.Exit(3) + } + defer f.Close() + fmt.Fprintln(os.Stdout, os.Getpid()) + time.Sleep(time.Minute) + os.Exit(0) + } + os.Exit(m.Run()) +} + +func TestVolatileStorageLifecycle(t *testing.T) { + storage, err := newVolatileStorage() + if err != nil { + t.Fatal(err) + } + if !storage.live() { + t.Fatal("watchdog did not remain live") + } + if err = os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic input"), 0600); err != nil { + t.Fatal("cannot write private fixture") + } + if err = storage.close(); err != nil { + t.Fatal(err) + } + if _, err = os.Lstat(storage.path); !os.IsNotExist(err) { + t.Fatal("private storage retained") + } +} + +func TestVolatileIdentityRefusesReplacement(t *testing.T) { + storage, err := newVolatileStorage() + if err != nil { + t.Fatal(err) + } + // Keep the original inode alive so a new directory cannot reuse it. + original := storage.path + "-original" + if os.Rename(storage.path, original) != nil || os.Mkdir(storage.path, 0700) != nil { + t.Fatal("cannot prepare replacement") + } + defer os.RemoveAll(original) + defer os.RemoveAll(storage.path) + if err = storage.close(); err == nil { + t.Fatal("replacement directory accepted") + } + if _, err = os.Stat(storage.path); err != nil { + t.Fatal("replacement directory was removed") + } +} + +func TestReceiverDeathCleansStorageAndStopsReader(t *testing.T) { + cmd := exec.Command("/proc/self/exe", "--test-storage-parent") + pipe, err := cmd.StdoutPipe() + if err != nil || cmd.Start() != nil { + t.Fatal("cannot start disposable parent") + } + defer cmd.Process.Kill() + reader := bufio.NewReader(pipe) + line, err := reader.ReadBytes('\n') + var receipt struct { + Path string + Watchdog int + } + if err != nil || json.Unmarshal(line, &receipt) != nil || receipt.Path == "" { + t.Fatal("disposable parent did not prepare storage") + } + var childPID int + if _, err = fmt.Fscanln(reader, &childPID); err != nil || childPID < 2 { + t.Fatal("disposable reader did not open input") + } + if cmd.Process.Kill() != nil { + t.Fatal("cannot kill disposable parent") + } + cmd.Wait() + deadline := time.Now().Add(5 * time.Second) + for time.Now().Before(deadline) { + _, pathErr := os.Lstat(receipt.Path) + stat, procErr := os.ReadFile(fmt.Sprintf("/proc/%d/stat", childPID)) + terminal := os.IsNotExist(procErr) + if procErr == nil { + // Zombies are terminal; the private PID namespace reaps them. + fields := strings.Fields(string(stat)[strings.LastIndex(string(stat), ")")+1:]) + terminal = len(fields) > 0 && fields[0] == "Z" + } + if os.IsNotExist(pathErr) && terminal { + return + } + time.Sleep(10 * time.Millisecond) + } + t.Fatal("receiver loss retained private input or live reader") +} + +func TestSmallInputParity(t *testing.T) { + scanner := os.Getenv("FORGE_TEST_GITLEAKS") + if scanner == "" { + t.Skip("requires explicitly admitted disposable Gitleaks binary") + } + f, err := pinScanner(scanner) + if err != nil { + t.Fatal(err) + } + defer f.Close() + storage, err := newVolatileStorage() + if err != nil { + t.Fatal(err) + } + defer func() { + if err := storage.close(); err != nil { + t.Error(err) + } + }() + config := t.TempDir() + write(t, filepath.Join(config, "scanner.toml"), []byte("[extend]\nuseDefault = true\n")) + write(t, filepath.Join(config, "ignore"), nil) + privateKey := key(t) + var random [32]byte + if _, err := rand.Read(random[:]); err != nil { + t.Fatal("cannot generate synthetic token") + } + canary := []byte("glpat-" + hex.EncodeToString(random[:])) + for _, tc := range []struct { + name string + input []byte + want bool + }{ + {"empty", nil, false}, + {"clean", []byte("reviewed clean input\n"), false}, + {"exact-limit", bytes.Repeat([]byte("x"), directoryInputBytes), false}, + {"private-key", privateKey, true}, + {"exact-limit-private-key", append(bytes.Repeat([]byte("\n"), directoryInputBytes-len(privateKey)), privateKey...), true}, + {"binary-private-key", append([]byte{0, 1, 0}, privateKey...), true}, + {"token", canary, true}, + {"binary-token", append([]byte{0, 0}, canary...), true}, + {"inline-suppression", append([]byte("# gitleaks:allow\n"), privateKey...), true}, + } { + t.Run(tc.name, func(t *testing.T) { + stdin, e := scan(context.Background(), f, config, tc.input) + if e != nil || stdin != tc.want { + t.Fatal("stdin reference outcome differs", e) + } + name := strings.Repeat("a", 40) + blocked, e := scanSmall(context.Background(), f, config, storage, []scanInput{{name, tc.input}}) + if e != nil || (blocked != "") != stdin || blocked != "" && blocked != name { + t.Fatal("directory and original stdin detection differ", e) + } + }) + } + t.Run("sixty-four-distinct-inputs", func(t *testing.T) { + var inputs []scanInput + for i := 0; i < directoryBatchInputs; i++ { + inputs = append(inputs, scanInput{fmt.Sprintf("%040x", i), []byte("clean")}) + } + inputs[63].content = privateKey + blocked, e := scanSmall(context.Background(), f, config, storage, inputs) + if e != nil || blocked != inputs[63].name { + t.Fatal("last batch input was not detected", e) + } + }) + t.Run("expired-context", func(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _, e := scanSmall(ctx, f, config, storage, []scanInput{{strings.Repeat("b", 40), []byte("clean")}}) + if e == nil || e.Error() != "scan-deadline-exceeded" { + t.Fatal("expired scan did not fail closed") + } + }) + t.Run("invalid-inputs", func(t *testing.T) { + name := strings.Repeat("c", 40) + for _, inputs := range [][]scanInput{ + {{"../escape", []byte("clean")}}, + {{name, bytes.Repeat([]byte("x"), directoryInputBytes+1)}}, + {{name, []byte("clean")}, {name, []byte("clean")}}, + } { + if _, e := scanSmall(context.Background(), f, config, storage, inputs); e == nil { + t.Fatal("invalid batch input accepted") + } + if _, e := os.Lstat(filepath.Join(storage.path, "payload")); !os.IsNotExist(e) { + t.Fatal("invalid batch left input files") + } + } + }) + t.Run("scanner-failure", func(t *testing.T) { + write(t, filepath.Join(config, "scanner.toml"), []byte("invalid = [")) + if _, e := scanSmall(context.Background(), f, config, storage, []scanInput{{strings.Repeat("d", 40), []byte("clean")}}); e == nil { + t.Fatal("scanner failure accepted") + } + }) +} + +func TestBatchAndLargerInputPushBoundaries(t *testing.T) { + adapter, scanner := binary(t) + for _, tc := range []struct { + name string + size int + secret bool + }{ + {"exact-limit-key", directoryInputBytes, true}, + {"larger-stdin-key", directoryInputBytes + 1, true}, + {"larger-stdin-clean", 70 * 1024, false}, + } { + t.Run(tc.name, func(t *testing.T) { + f := setup(t, adapter, scanner) + content := []byte("reviewed clean input\n") + want := 0 + if tc.secret { + content = key(t) + want = 1 + } + content = append(content, bytes.Repeat([]byte("\n"), tc.size-len(content))...) + f.commit(t, "input.bin", content, "disposable boundary fixture") + f.push(t, want, "HEAD:refs/heads/main") + }) + } + t.Run("multiple-ref-name-detection", func(t *testing.T) { + f := setup(t, adapter, scanner) + var random [32]byte + if _, err := rand.Read(random[:]); err != nil { + t.Fatal("fixture generation failed") + } + out := f.push(t, 1, "HEAD:refs/heads/clean-new", "HEAD:refs/heads/glpat-"+hex.EncodeToString(random[:])) + if !bytes.Contains(out, []byte(`"reason":"ref-name-detection"`)) { + t.Fatal("multi-ref name was not scanned") + } + }) +} + +func TestBatchRefusesUnverifiedReportsAndDiagnostics(t *testing.T) { + known := map[string]string{"payload/ref-0": "ref-0"} + for _, tc := range []struct { + code int + raw string + }{ + {0, "payload/ref-0\n"}, {20, ""}, {0, "\n"}, + {20, "payload/ref-0"}, {20, "payload/ref-0\n\n"}, + {20, "payload/ref-unknown\n"}, {20, "../payload/ref-0\n"}, + {20, "payload/ref-0\r\n"}, {2, ""}, + } { + if _, err := batchFindings(tc.code, []byte(tc.raw), known); err == nil { + t.Fatal("unverified report accepted") + } + } + for _, tc := range []struct { + code int + raw string + }{ + {0, ""}, {20, "payload/ref-0\n"}, {20, "payload/ref-0\npayload/ref-0\n"}, + } { + if _, err := batchFindings(tc.code, []byte(tc.raw), known); err != nil { + t.Fatal("valid report refused") + } + } + for _, tc := range []struct { + code int + text string + }{ + {0, "12:03PM WRN incomplete scan\n"}, {20, "12:03PM WRN incomplete scan\n"}, + {20, "12:03PM WRN leaks found: 1\n12:03PM WRN incomplete scan\n"}, + {0, "12:03PM WRN leaks found: 1\n"}, {2, ""}, + } { + if validateBatchDiagnostics(tc.code, []byte(tc.text)) == nil { + t.Fatal("unverified diagnostic accepted") + } + } + for _, tc := range []struct { + code int + text string + }{ + {0, ""}, {20, ""}, {20, "12:03PM WRN leaks found: 1\n"}, + } { + if validateBatchDiagnostics(tc.code, []byte(tc.text)) != nil { + t.Fatal("valid diagnostic refused") + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/main.go b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/main.go new file mode 100644 index 00000000..ec28e58d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/main.go @@ -0,0 +1,481 @@ +// receive-secret-scan is a content-silent, Linux pre-receive control adapter. +// It never changes refs, runs repository programs, or retrieves credentials. +package main + +import ( + "bytes" + "context" + "encoding/json" + "errors" + "flag" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "regexp" + "sort" + "strconv" + "strings" + "syscall" + "time" +) + +const scannerHash = "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509" +const scannerVersion = "8.30.1" +const maxInput = 512 * 1024 +const maxObject = 8 * 1024 * 1024 +const maxTotal = 64 * 1024 * 1024 +const maxObjects = 2000 +const maxRefs = 10000 + +var oidPattern = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`) +var errLimit = errors.New("output-limit") + +type result struct { + Status string `json:"status"` + Scope string `json:"scope"` + Reason string `json:"reason,omitempty"` + Scanned int `json:"scanned_objects"` + ScannedRefs int `json:"scanned_refs"` + BlockedID string `json:"blocked_object_id,omitempty"` + Version string `json:"scanner_version"` +} +type update struct{ Old, New, Ref string } +type cappedBuffer struct { + bytes.Buffer + limit int +} + +func (b *cappedBuffer) Write(p []byte) (int, error) { + if len(p) > b.limit-b.Len() { + return 0, errLimit + } + return b.Buffer.Write(p) +} +func zero(s string) bool { return strings.Trim(s, "0") == "" } +func parseUpdates(raw []byte) ([]update, error) { + if len(raw) == 0 || len(raw) > maxInput || raw[len(raw)-1] != '\n' { + return nil, errors.New("invalid-update-input") + } + lines := strings.Split(string(raw[:len(raw)-1]), "\n") + if len(lines) > 256 { + return nil, errors.New("update-limit") + } + seen := map[string]bool{} + var out []update + for _, line := range lines { + fields := strings.Split(line, " ") + if len(fields) != 3 || !oidPattern.MatchString(fields[0]) || !oidPattern.MatchString(fields[1]) || len(fields[0]) != len(fields[1]) || len(fields[2]) > 1024 || !strings.HasPrefix(fields[2], "refs/") || strings.ContainsAny(fields[2], "\x00\r\n\t") || seen[fields[2]] || zero(fields[0]) && zero(fields[1]) { + return nil, errors.New("invalid-update-input") + } + seen[fields[2]] = true + out = append(out, update{fields[0], fields[1], fields[2]}) + } + return out, nil +} + +// Only receive-pack object-location variables cross into Git. Scanner processes +// get none. Never inherit arbitrary GIT_CONFIG_* or credential/provider settings. +func gitEnvironment() []string { + env := []string{"PATH=/usr/local/bin:/usr/bin:/bin", "HOME=/nonexistent", "LANG=C", "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null", "GIT_NO_REPLACE_OBJECTS=1", "GIT_GRAFT_FILE=/dev/null", "GIT_NO_LAZY_FETCH=1", "GIT_TERMINAL_PROMPT=0", "GIT_ASKPASS=/bin/false", "GIT_SSH_COMMAND=/bin/false"} + for _, key := range []string{"GIT_DIR", "GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_QUARANTINE_PATH"} { + if val, ok := os.LookupEnv(key); ok { + env = append(env, key+"="+val) + } + } + return env +} +func git(ctx context.Context, input []byte, limit int, args ...string) ([]byte, error) { + cmd := exec.CommandContext(ctx, "/usr/bin/git", args...) + cmd.Env = gitEnvironment() + cmd.Stdin = bytes.NewReader(input) + b := &cappedBuffer{limit: limit} + cmd.Stdout = b + cmd.Stderr = io.Discard + if runChild(cmd) != nil { + return nil, errors.New("git-" + args[0] + "-failed") + } + return b.Bytes(), nil +} +func refs(ctx context.Context) ([]byte, map[string]string, error) { + raw, err := git(ctx, nil, 2*1024*1024, "for-each-ref", "--format=%(objectname) %(refname)") + if err != nil { + return nil, nil, err + } + found := map[string]string{} + for _, line := range strings.Split(strings.TrimSuffix(string(raw), "\n"), "\n") { + if line == "" { + continue + } + parts := strings.Split(line, " ") + if len(parts) != 2 || !oidPattern.MatchString(parts[0]) || !strings.HasPrefix(parts[1], "refs/") { + return nil, nil, errors.New("invalid-ref-snapshot") + } + found[parts[1]] = parts[0] + } + if len(found) > maxRefs { + return nil, nil, errors.New("ref-limit") + } + return raw, found, nil +} +func pinScanner(path string) (*os.File, error) { + fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0) + if err != nil { + return nil, errors.New("scanner-file-refused") + } + f := os.NewFile(uintptr(fd), path) + ok := false + defer func() { + if !ok { + f.Close() + } + }() + if err = verifyScannerFD(f); err != nil { + return nil, err + } + ok = true + return f, nil +} +func scan(ctx context.Context, f *os.File, dir string, content []byte) (bool, error) { + cmd := exec.CommandContext(ctx, "/proc/self/fd/3", "stdin", "--config", filepath.Join(dir, "scanner.toml"), "--gitleaks-ignore-path", filepath.Join(dir, "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "fatal", "--exit-code", "20", "--timeout", "15") + cmd.ExtraFiles = []*os.File{f} + cmd.Dir = dir + cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + dir, "TMPDIR=" + dir, "LANG=C"} + cmd.Stdin = bytes.NewReader(content) + cmd.Stdout = io.Discard + cmd.Stderr = io.Discard + err := runChild(cmd) + if ctx.Err() != nil { + return false, errors.New("scan-deadline-exceeded") + } + if err == nil { + return false, nil + } + var exit *exec.ExitError + if errors.As(err, &exit) && exit.ExitCode() == 20 { + return true, nil + } + return false, errors.New("scanner-failed") +} + +// Tree object names are covered too. Gitlinks refer to an external repository, +// so this version refuses them rather than claiming transitive coverage. +func treeContent(raw []byte, oidBytes int) ([]byte, error) { + var names []byte + for len(raw) > 0 { + space := bytes.IndexByte(raw, ' ') + nul := bytes.IndexByte(raw, 0) + if space <= 0 || nul <= space || len(raw) < nul+1+oidBytes { + return nil, errors.New("invalid-tree") + } + mode := string(raw[:space]) + if mode == "160000" { + return nil, errors.New("external-gitlink-unverified") + } + if mode != "100644" && mode != "100755" && mode != "120000" && mode != "40000" { + return nil, errors.New("unsupported-tree-entry") + } + names = append(names, raw[space+1:nul]...) + names = append(names, '\n') + raw = raw[nul+1+oidBytes:] + } + return names, nil +} +func check(ctx context.Context, updates []update, binary string) (out result) { + out = result{Status: "unverified", Scope: "introduced-reachable-git-objects-and-updated-ref-names", Version: scannerVersion} + fail := func(err error) result { out.Reason = err.Error(); return out } + scanner, err := pinScanner(binary) + if err != nil { + return fail(err) + } + defer scanner.Close() + format, err := git(ctx, nil, 128, "rev-parse", "--show-object-format") + if err != nil { + return fail(err) + } + width := 40 + if string(format) == "sha256\n" { + width = 64 + } else if string(format) != "sha1\n" { + return fail(errors.New("unsupported-object-format")) + } + shallow, err := git(ctx, nil, 128, "rev-parse", "--is-shallow-repository") + if err != nil { + return fail(err) + } + if string(shallow) != "false\n" { + return fail(errors.New("shallow-repository-unverified")) + } + // Partial repositories may perform network retrieval while reading objects. + config, err := git(ctx, nil, 1024*1024, "config", "--local", "--includes", "--name-only", "--list") + if err != nil { + return fail(err) + } + for _, key := range strings.Split(strings.ToLower(string(config)), "\n") { + if key == "extensions.partialclone" || strings.HasSuffix(key, ".promisor") { + return fail(errors.New("partial-repository-unverified")) + } + } + snapshot, existing, err := refs(ctx) + if err != nil { + return fail(err) + } + tips := map[string]bool{} + for _, u := range updates { + if len(u.Old) != width { + return fail(errors.New("object-format-mismatch")) + } + if _, err = git(ctx, nil, 128, "check-ref-format", u.Ref); err != nil { + return fail(errors.New("invalid-ref-name")) + } + current, exists := existing[u.Ref] + if zero(u.Old) && exists || !zero(u.Old) && current != u.Old { + return fail(errors.New("old-ref-mismatch")) + } + if !zero(u.New) { + tips[u.New] = true + } + } + // Freeze exclusions from the pre-push snapshot, never a mutable --all read. + // Scan all introduced reachable objects, not just a tip diff or first parent. + var revisions strings.Builder + for tip := range tips { + revisions.WriteString(tip + "\n") + } + objects := map[string]bool{} + if len(tips) > 0 { + excluded := map[string]bool{} + for _, oid := range existing { + excluded[oid] = true + } + for oid := range excluded { + revisions.WriteString("^" + oid + "\n") + } + raw, e := git(ctx, []byte(revisions.String()), (maxObjects+1)*(width+1), "rev-list", "--objects", "--no-object-names", "--stdin") + if e != nil { + return fail(e) + } + for _, oid := range strings.Fields(string(raw)) { + if !oidPattern.MatchString(oid) || len(oid) != width { + return fail(errors.New("invalid-object-list")) + } + objects[oid] = true + } + } + if len(objects) > maxObjects { + return fail(errors.New("object-limit")) + } + ids := make([]string, 0, len(objects)) + for oid := range objects { + ids = append(ids, oid) + } + sort.Strings(ids) + var metadata []byte + if len(ids) > 0 { + metadata, err = git(ctx, []byte(strings.Join(ids, "\n")+"\n"), (maxObjects+1)*100, "cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)") + if err != nil { + return fail(err) + } + } + lines := strings.Split(strings.TrimSuffix(string(metadata), "\n"), "\n") + if len(ids) == 0 { + lines = nil + } + if len(lines) != len(ids) { + return fail(errors.New("incomplete-object-metadata")) + } + // Reject oversized batches before reading/scanning any object payload. + type objectInfo struct { + kind string + size int64 + } + var objectMetadata []objectInfo + total := int64(0) + for i, line := range lines { + parts := strings.Split(line, " ") + if len(parts) != 3 || parts[0] != ids[i] { + return fail(errors.New("invalid-object-metadata")) + } + kind := parts[1] + if kind != "blob" && kind != "commit" && kind != "tag" && kind != "tree" { + return fail(errors.New("unsupported-object-type")) + } + size, e := strconv.ParseInt(parts[2], 10, 64) + if e != nil || size < 0 || size > maxObject || total+size > maxTotal { + return fail(errors.New("object-byte-limit")) + } + total += size + objectMetadata = append(objectMetadata, objectInfo{kind, size}) + } + dir, err := os.MkdirTemp("", "forge-secret-scan-") + if err != nil { + return fail(errors.New("temporary-directory-unavailable")) + } + defer os.RemoveAll(dir) + var storage *volatileStorage + defer func() { + if storage != nil { + if e := storage.close(); e != nil { + out.Status = "unverified" + out.Reason = e.Error() + } + } + }() + getStorage := func() error { + if storage == nil { + var e error + storage, e = newVolatileStorage() + return e + } + if !storage.live() { + return errors.New("cleanup-watchdog-unavailable") + } + return nil + } + if os.WriteFile(filepath.Join(dir, "scanner.toml"), []byte("[extend]\nuseDefault = true\n"), 0600) != nil || os.WriteFile(filepath.Join(dir, "ignore"), nil, 0600) != nil { + return fail(errors.New("scanner-config-unavailable")) + } + // Ref names can themselves contain recognized tokens. Never echo them. + for start := 0; start < len(updates); start += directoryBatchInputs { + end := start + directoryBatchInputs + if end > len(updates) { + end = len(updates) + } + if end-start == 1 { + blocked, e := scan(ctx, scanner, dir, []byte(updates[start].Ref)) + if e != nil { + return fail(e) + } + out.ScannedRefs++ + if blocked { + out.Status = "blocked" + out.Reason = "ref-name-detection" + return out + } + continue + } + if e := getStorage(); e != nil { + return fail(e) + } + var batch []scanInput + for i := start; i < end; i++ { + batch = append(batch, scanInput{fmt.Sprintf("ref-%d", i), []byte(updates[i].Ref)}) + } + blocked, e := scanSmall(ctx, scanner, dir, storage, batch) + if e != nil { + return fail(e) + } + out.ScannedRefs += len(batch) + if blocked != "" { + out.Status = "blocked" + out.Reason = "ref-name-detection" + return out + } + } + var pending []scanInput + flush := func() error { + if len(pending) == 0 { + return nil + } + if e := getStorage(); e != nil { + return e + } + blocked, e := scanSmall(ctx, scanner, dir, storage, pending) + if e != nil { + return e + } + out.Scanned += len(pending) + pending = nil + if blocked != "" { + out.Status = "blocked" + out.BlockedID = blocked + } + return nil + } + for i, info := range objectMetadata { + kind, size := info.kind, info.size + raw, e := git(ctx, nil, int(size)+1, "cat-file", kind, ids[i]) + if e != nil { + return fail(e) + } + if int64(len(raw)) != size { + return fail(errors.New("object-size-mismatch")) + } + if kind == "tree" { + raw, e = treeContent(raw, width/2) + if e != nil { + return fail(e) + } + } + if len(raw) <= directoryInputBytes { + pending = append(pending, scanInput{ids[i], raw}) + if len(pending) == directoryBatchInputs { + if e = flush(); e != nil { + return fail(e) + } + if out.Status == "blocked" { + return out + } + } + continue + } + blocked, e := scan(ctx, scanner, dir, raw) + if e != nil { + return fail(e) + } + out.Scanned++ + if blocked { + out.Status = "blocked" + out.BlockedID = ids[i] + return out + } + } + if err = flush(); err != nil { + return fail(err) + } + if out.Status == "blocked" { + return out + } + after, _, err := refs(ctx) + if err != nil { + return fail(err) + } + if !bytes.Equal(snapshot, after) { + return fail(errors.New("refs-changed-during-scan")) + } + out.Status = "clean" + return out +} +func main() { + if code, handled := internalProcess(os.Args[1:]); handled { + os.Exit(code) + } + flags := flag.NewFlagSet("receive-secret-scan", flag.ContinueOnError) + flags.SetOutput(io.Discard) + binary := flags.String("scanner", "", "reviewed Gitleaks executable") + out := result{Status: "unverified", Scope: "introduced-reachable-git-objects-and-updated-ref-names", Version: scannerVersion, Reason: "invalid-invocation"} + if flags.Parse(os.Args[1:]) == nil && *binary != "" && flags.NArg() == 0 { + raw, err := io.ReadAll(io.LimitReader(os.Stdin, maxInput+1)) + if err == nil { + updates, e := parseUpdates(raw) + if e != nil { + out.Reason = e.Error() + } else { + ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second) + out = check(ctx, updates, *binary) + cancel() + } + } + } + // Only fixed reason codes, counts and an object ID may reach the caller. + encoded, _ := json.Marshal(out) + fmt.Println(string(encoded)) + if out.Status == "clean" { + return + } + if out.Status == "blocked" { + os.Exit(1) + } + os.Exit(2) +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/volatile.go b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/volatile.go new file mode 100644 index 00000000..4da2201e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/tools/receive-secret-scan/volatile.go @@ -0,0 +1,268 @@ +// Linux volatile input custody; no raw input is written to ordinary disk. +package main + +import ( + "errors" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "runtime" + "strconv" + "strings" + "syscall" + "time" +) + +type storageIdentity struct { + dev uint64 + ino uint64 + uid uint32 +} + +func volatileIdentity(path string) (storageIdentity, error) { + var id storageIdentity + if filepath.Dir(path) != "/dev/shm" || !strings.HasPrefix(filepath.Base(path), "forge-receive-scan-") { + return id, errors.New("volatile-storage-refused") + } + fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) + if err != nil { + return id, errors.New("volatile-storage-unavailable") + } + defer syscall.Close(fd) + var st syscall.Stat_t + var fs syscall.Statfs_t + if syscall.Fstat(fd, &st) != nil || syscall.Fstatfs(fd, &fs) != nil || fs.Type != 0x01021994 || st.Mode&07777 != 0700 || st.Uid != uint32(os.Getuid()) { + return id, errors.New("volatile-storage-refused") + } + return storageIdentity{uint64(st.Dev), st.Ino, st.Uid}, nil +} + +func removeVolatile(path string, expected storageIdentity) error { + if _, err := os.Lstat(path); os.IsNotExist(err) { + return nil + } + id, err := volatileIdentity(path) + if err != nil || id != expected { + return errors.New("volatile-storage-identity-changed") + } + if os.RemoveAll(path) != nil { + return errors.New("volatile-storage-cleanup-failed") + } + return nil +} + +// Pin the exact parent using Linux pidfd, not a reusable numeric process ID. +func parentDescriptor(parent int) (*os.File, error) { + if runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" { + return nil, errors.New("cleanup-platform-unsupported") + } + if parent <= 1 || os.Getppid() != parent { + return nil, errors.New("cleanup-parent-refused") + } + fd, _, errno := syscall.Syscall(434, uintptr(parent), 0, 0) // pidfd_open, Linux 5.3+ + if errno != 0 { + return nil, errors.New("cleanup-parent-unavailable") + } + f := os.NewFile(fd, "parent-pidfd") + if os.Getppid() != parent || fd >= 1024 { + f.Close() + return nil, errors.New("cleanup-parent-refused") + } + return f, nil +} + +func waitParent(f *os.File, duration time.Duration) bool { + fd := int(f.Fd()) + var deadline time.Time + if duration >= 0 { + deadline = time.Now().Add(duration) + } + for { + // select may mutate both arguments, including when interrupted. + var set syscall.FdSet + set.Bits[fd/64] |= 1 << uint(fd%64) + var timeout *syscall.Timeval + if duration >= 0 { + remaining := time.Until(deadline) + if remaining < 0 { + remaining = 0 + } + value := syscall.NsecToTimeval(remaining.Nanoseconds()) + timeout = &value + } + n, err := syscall.Select(fd+1, &set, nil, nil, timeout) + if err == syscall.EINTR { + continue + } + return err == nil && n > 0 + } +} + +func signalParent(f *os.File, signal syscall.Signal) { + _, _, _ = syscall.Syscall6(424, f.Fd(), uintptr(signal), 0, 0, 0, 0) // pidfd_send_signal +} + +func cleanupProcess(args []string) int { + if len(args) != 5 { + return 4 + } + dev, e1 := strconv.ParseUint(args[1], 10, 64) + ino, e2 := strconv.ParseUint(args[2], 10, 64) + uid, e3 := strconv.ParseUint(args[3], 10, 32) + parent, e4 := strconv.Atoi(args[4]) + if e1 != nil || e2 != nil || e3 != nil || e4 != nil { + return 4 + } + expected := storageIdentity{dev, ino, uint32(uid)} + id, err := volatileIdentity(args[0]) + if err != nil || id != expected { + return 3 + } + process, err := parentDescriptor(parent) + if err != nil { + return 4 + } + defer process.Close() + if _, err = os.Stdout.Write([]byte("R")); err != nil { + return 4 + } + eof := make(chan bool, 1) + go func() { var b [1]byte; n, e := os.Stdin.Read(b[:]); eof <- n == 0 && e == io.EOF }() + select { + case ok := <-eof: + if !ok { + return 4 + } + case <-time.After(180 * time.Second): + signalParent(process, syscall.SIGTERM) + if !waitParent(process, 5*time.Second) { + signalParent(process, syscall.SIGKILL) + if !waitParent(process, -1) { + return 4 + } + } + } + if removeVolatile(args[0], expected) != nil { + return 3 + } + return 0 +} + +type volatileStorage struct { + path string + id storageIdentity + pipe io.WriteCloser + command *exec.Cmd + done chan error +} + +func newVolatileStorage() (*volatileStorage, error) { + root, err := syscall.Open("/dev/shm", syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) + if err != nil { + return nil, errors.New("volatile-storage-unavailable") + } + var fs syscall.Statfs_t + err = syscall.Fstatfs(root, &fs) + syscall.Close(root) + if err != nil || fs.Type != 0x01021994 { + return nil, errors.New("volatile-storage-unavailable") + } + path, err := os.MkdirTemp("/dev/shm", "forge-receive-scan-") + if err != nil { + return nil, errors.New("volatile-storage-unavailable") + } + id, err := volatileIdentity(path) + if err != nil { + os.RemoveAll(path) + return nil, err + } + cmd := exec.Command("/proc/self/exe", "--cleanup-storage", path, fmt.Sprint(id.dev), fmt.Sprint(id.ino), fmt.Sprint(id.uid), strconv.Itoa(os.Getpid())) + cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"} + cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} + writer, err := cmd.StdinPipe() + if err != nil { + removeVolatile(path, id) + return nil, errors.New("cleanup-watchdog-unavailable") + } + reader, err := cmd.StdoutPipe() + if err != nil { + writer.Close() + removeVolatile(path, id) + return nil, errors.New("cleanup-watchdog-unavailable") + } + if err = cmd.Start(); err != nil { + writer.Close() + reader.Close() + removeVolatile(path, id) + return nil, errors.New("cleanup-watchdog-unavailable") + } + v := &volatileStorage{path, id, writer, cmd, make(chan error, 1)} + go func() { v.done <- cmd.Wait() }() + ready := make(chan bool, 1) + go func() { + var b [1]byte + _, e := io.ReadFull(reader, b[:]) + reader.Close() + ready <- e == nil && b[0] == 'R' + }() + select { + case ok := <-ready: + if ok && v.live() { + return v, nil + } + case <-time.After(5 * time.Second): + } + v.close() + return nil, errors.New("cleanup-watchdog-unavailable") +} + +func (v *volatileStorage) live() bool { + select { + case err := <-v.done: + v.done <- err + return false + default: + return true + } +} + +func (v *volatileStorage) close() error { + err := removeVolatile(v.path, v.id) + v.pipe.Close() + select { + case outcome := <-v.done: + if outcome != nil && err == nil { + err = errors.New("cleanup-watchdog-failed") + } + case <-time.After(5 * time.Second): + v.command.Process.Kill() + <-v.done + if err == nil { + err = errors.New("cleanup-watchdog-failed") + } + } + return err +} + +// Source-reading/writing children cannot survive loss of their exact parent. +func runChild(cmd *exec.Cmd) error { + runtime.LockOSThread() + defer runtime.UnlockOSThread() + cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL} + return cmd.Run() +} + +func internalProcess(args []string) (int, bool) { + if len(args) == 0 { + return 0, false + } + switch args[0] { + case "--cleanup-storage": + return cleanupProcess(args[1:]), true + case "--batch-scanner": + return batchScannerProcess(args[1:]), true + } + return 0, false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/workplans/FORGE-WP-0010-receive-scanner-budget.md b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/workplans/FORGE-WP-0010-receive-scanner-budget.md new file mode 100644 index 00000000..bd452d1b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/owner-source/workplans/FORGE-WP-0010-receive-scanner-budget.md @@ -0,0 +1,90 @@ +--- +id: FORGE-WP-0010 +type: workplan +title: "Complete bounded receive scans without per-small-input startup overhead" +domain: financials +repo: railiance-forge +status: proposed +owner: codex +topic_slug: railiance-forge +created: "2026-10-18" +updated: "2026-10-18" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a" +--- + +CUST-WP-0080 discovered an availability defect in the already enforced receive +control: the normal 141-object public Custodian source delta exhausts the +unchanged 90-second budget, with no secret finding. The unmodified owner source +reproduces the refusal in an isolated bare repository. This is a new correction, +not reopening finished FORGE-WP-0006 or promoting FORGE-WP-0008 residual coverage. + +Reuse the existing Repo Manager small-input profile: at most 64 inputs of at most +4096 bytes per directory scan, identical pinned Gitleaks/default rules and strict +report/diagnostic validation. Larger inputs retain the original stdin fragment +path. Preserve every traversal/ref/object/byte/time bound, no override or new +runtime service. Raw batch inputs require checked private tmpfs, independent +parent-bound cleanup and child termination on receiver loss. Source preparation +does not grant native installation, package/owner acceptance or production proof. + +## Reproduce and implement the bounded adapter correction + +```task +id: FORGE-WP-0010-T01 +status: done +priority: high +state_hub_task_id: "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea" +``` + +Retain the exact original failure and source delta. Implement the existing +small-input batching contract in the Linux receive adapter. Verify synthetic +positive/negative parity, real receive-pack quarantine, all prior boundaries, +limits, expired context, diagnostic/report refusal, normal cleanup, receiver +death and changed storage identity. Complete the exact original clean delta +within the same deadline. Failures remain evidence; source proof closes no +native acceptance gate. Independent package/owner review remains under T02. + +Source result: the exact previously refused 141-object/one-ref delta completes +in 52.53 seconds with all objects counted, under the unchanged 90-second budget. +The complete suite passes 49 leaf cases with zero skips; five additional boundary +cases bring the combined distinct leaf coverage to 54. These include 4096-byte +and larger-input detection, multi-ref-name detection, normal and receiver-loss +cleanup, scanner/report/diagnostic failures and changed directory identity. +Unavailable and ordinary-disk storage fail closed in separate actual helper +processes. The original low-entropy canary failure and misconfigured storage +fixture/setup failures are retained rather than counted as successful tests. +Source/proof: Custodian `docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/`. + +## Prepare and approve the immutable native revision + +```task +id: FORGE-WP-0010-T02 +status: progress +priority: high +state_hub_task_id: "b49d34ef-e6e5-5674-b523-ebcf80e0dcca" +``` + +Obtain independent source/package review. Pin exact source/build tool provenance, executable digest, startup-guard and +hook composition. Capture read-only current state, no-op checks and exact +before/after/rollback. Retain permissions, scanner digest, hook ordering and +fail-closed behavior. Obtain the founder's explicit go for this live change +under the existing environment rule; previous activation is not approval for +this different executable. Preserve the original revision and every refinement +in the current supervised-action record. + +## Verify admitted native behavior and ordinary publication + +```task +id: FORGE-WP-0010-T03 +status: wait +priority: high +state_hub_task_id: "863c91e4-7c25-575f-b8b6-f98d0074ce5a" +``` + +Waiting on T02: exact executable/startup admission and founder-authorized native +activation. Verify actual hook clean/refusal/unavailable/cleanup behavior and +the legitimate ordinary source publication without splitting or seeding refs. +Reconcile owner task/source status and independent evidence. Existing remaining +coverage, private incident response and target-wide acceptance retain their +original owners; no residual implementation is inferred. diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/prepare_native.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/prepare_native.py new file mode 100644 index 00000000..52e81b23 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/prepare_native.py @@ -0,0 +1,139 @@ +"""Prepare public source and conditional patch; only read/server dry-run remotely. + +Reuse the existing Forgejo template patch simulator, metadata transport and +server-dry-run helper. Never replay historical Helm release values. +""" +from pathlib import Path +import copy +import hashlib +import importlib.util +import json +import re + +import yaml + +HERE=Path(__file__).resolve().parent +REPO=HERE.parents[3] +OLD=REPO/'docs/changes/CUST-WP-0080' +OLD_DIRECTORY='/data/security/receive-secret-scan/20261012-57a0642b6251' +OLD_HASH='57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec' +OLD_CM='forgejo-secret-template-b1d7cf8cd13f' + +def sha(raw): + return hashlib.sha256(raw).hexdigest() + +def support(): + spec=importlib.util.spec_from_file_location('existing_forge_template',OLD/'activate_forge_template.py') + module=importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + +def replacement_patch(deployment, old_command, new_command, old_cm, new_cm): + spec=deployment['spec']['template']['spec'] + guards=[i for i,c in enumerate(spec['initContainers']) if c['name']=='verify-secret-scanner'] + volumes=[i for i,v in enumerate(spec['volumes']) if v['name']=='secret-scan-template'] + if len(guards)!=1 or len(volumes)!=1: + raise ValueError('missing-or-ambiguous-existing-control') + command_path='/spec/template/spec/initContainers/'+str(guards[0])+'/command' + volume_path='/spec/template/spec/volumes/'+str(volumes[0])+'/configMap/name' + if spec['initContainers'][guards[0]]['command']!=old_command or spec['volumes'][volumes[0]]['configMap']['name']!=old_cm: + raise ValueError('existing-control-drift') + return [ + {'op':'test','path':'/metadata/uid','value':deployment['metadata']['uid']}, + {'op':'test','path':'/metadata/resourceVersion','value':deployment['metadata']['resourceVersion']}, + {'op':'test','path':command_path,'value':old_command}, + {'op':'test','path':volume_path,'value':old_cm}, + {'op':'replace','path':command_path,'value':new_command}, + {'op':'replace','path':volume_path,'value':new_cm}, + ] + +def main(): + t=support() + manifest=json.loads((HERE/'publication-inputs.json').read_text()) + commit=json.loads((HERE/'publication-commit.json').read_text())['commit'] + assert commit=='ea65606c1298db782f721f9443bafeb03cdef138' + source=Path('/home/worsch/railiance-forge') + for row in manifest['files']: + assert sha((source/row['path']).read_bytes())==row['sha256'] + binary=Path('/tmp/custodian-receive-scanner-batch-r1/candidate-hook') + binary_hash=sha(binary.read_bytes()) + assert binary_hash=='73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a' + new_directory='/data/security/receive-secret-scan/20261018-'+binary_hash[:12] + apps=Path('/home/worsch/railiance-apps') + values_text=(apps/'helm/forgejo-values.yaml').read_text() + cm_text=(apps/'manifests/forgejo-secret-scan-template.yaml').read_text() + original_values=yaml.safe_load(values_text) + original_cm=yaml.safe_load(cm_text) + assert original_cm['metadata']['name']==OLD_CM and original_cm['immutable'] is True + old_hook=original_cm['data']['hook'] + assert sha(old_hook.encode())=='b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b' + new_hook=old_hook.replace(OLD_DIRECTORY,new_directory) + hook_hash=sha(new_hook.encode()) + new_cm='forgejo-secret-template-'+hook_hash[:12] + new_values_text=values_text.replace(OLD_DIRECTORY,new_directory).replace(OLD_HASH,binary_hash).replace(OLD_CM,new_cm) + new_cm_text=cm_text.replace(OLD_DIRECTORY,new_directory).replace(OLD_CM,new_cm).replace('FORGE-WP-0006','FORGE-WP-0010') + new_values=yaml.safe_load(new_values_text) + new_configmap=yaml.safe_load(new_cm_text) + assert new_configmap['data']['hook']==new_hook + assert len(original_values['preExtraInitContainers'])==len(new_values['preExtraInitContainers'])==1 + old_command=original_values['preExtraInitContainers'][0]['command'] + new_command=new_values['preExtraInitContainers'][0]['command'] + # Prove the source changes only the existing guard command and CM name. + expected=copy.deepcopy(original_values) + expected['preExtraInitContainers'][0]['command']=new_command + expected['extraVolumes'][0]['configMap']['name']=new_cm + assert expected==new_values + config_expected=copy.deepcopy(original_cm) + config_expected['metadata']['name']=new_cm + config_expected['metadata']['labels']['custodian.coulomb.social/workplan']='FORGE-WP-0010' + config_expected['data']['hook']=new_hook + assert config_expected==new_configmap + nodes=json.loads(t.native.command(['get','nodes','-o','json']))['items'] + assert len(nodes)==1 and any(a['type']=='InternalIP' and a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses']) + d=t.deployment() + assert d['metadata']['uid']=='e8eff0aa-64bb-4b44-9a80-a66612986355' + assert d['spec']['replicas']==1 and d['spec']['strategy']['type']=='Recreate' + before=t.digest(d['spec']['template']) + forward=replacement_patch(d,old_command,new_command,OLD_CM,new_cm) + simulated=t.apply_locally(d,forward) + # Rollback reads fresh metadata, verifies exact new fields, restores the two + # original fields. This simulation changes no image, environment or mounts. + reverse=replacement_patch(simulated,new_command,old_command,new_cm,OLD_CM) + restored=t.apply_locally(simulated,reverse) + assert restored==d + dry=t.patch_remote(forward,dry_run=True) + assert t.digest(dry['spec']['template'])==t.digest(simulated['spec']['template']) + dry_cm=json.loads(t.native.command(['apply','--server-side','--dry-run=server','-f','-','-o','json'],payload=json.dumps(new_configmap).encode())) + assert dry_cm['immutable'] is True and dry_cm['data']['hook']==new_hook + proposal=HERE/'native-preparation' + proposal.mkdir(exist_ok=False) + for path,text in [('helm/forgejo-values.yaml',new_values_text),('manifests/forgejo-secret-scan-template.yaml',new_cm_text)]: + output=proposal/'apps-source'/path + output.parent.mkdir(parents=True,exist_ok=True); output.write_text(text) + (proposal/'deployment-forward.json').write_text(json.dumps(forward,indent=2)+'\n') + (proposal/'configmap.json').write_text(json.dumps(new_configmap,indent=2)+'\n') + (proposal/'old-hook').write_text(old_hook) + (proposal/'new-hook').write_text(new_hook) + result={ + 'proposal_id':'FORGE10-RECEIVE-BATCH-20261018','revision':'preparation-1', + 'source_commit':commit,'candidate_binary_sha256':binary_hash,'new_directory':new_directory, + 'old_directory':OLD_DIRECTORY,'old_binary_sha256':OLD_HASH, + 'old_configmap':OLD_CM,'new_configmap':new_cm,'old_hook_sha256':sha(old_hook.encode()),'new_hook_sha256':hook_hash, + 'deployment_uid':d['metadata']['uid'],'generation':d['metadata']['generation'], + 'original_template_sha256':before,'proposed_template_sha256':t.digest(simulated['spec']['template']), + 'source_fields_only_verified':True,'conditional_forward_and_inverse_verified':True, + 'deployment_server_dry_run_verified':True,'configmap_server_dry_run_verified':True, + 'native_changed':False,'approval_requested':False, + 'remaining':['Pinned activation/recovery executor, drift/refusal checks and resource preflight', + 'Independent owner/package admission and exact founder go', + 'Native exact-binary smoke, 166-hook rollout and ordinary publication proof'], + 'support_hashes':{name:sha((OLD/name).read_bytes()) for name in ['activate_forge_template.py','verify_receive_native.py','activate_receive_hooks.py']}, + 'apps_preimage_hashes':{path:'sha256:'+sha((apps/path).read_bytes()) for path in ['helm/forgejo-values.yaml','manifests/forgejo-secret-scan-template.yaml']}, + 'cost_estimate_eur':0,'cost_note':'No additional infrastructure or paid service; human effort unpriced.', + 'risk_note':'One existing Forgejo Recreate rollout and exact installed-hook copies; availability impact and partial rollout require guarded rollback. No credential, policy, image or database change.' + } + (proposal/'preparation.json').write_text(json.dumps(result,indent=2)+'\n') + print(json.dumps({k:result[k] for k in ['proposal_id','candidate_binary_sha256','new_configmap','conditional_forward_and_inverse_verified','deployment_server_dry_run_verified','configmap_server_dry_run_verified','native_changed','approval_requested']})) + +if __name__=='__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/projection.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/projection.json new file mode 100644 index 00000000..55d45934 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/projection.json @@ -0,0 +1,100 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "railiance-forge", + "commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "requests": 2, + "elapsed_ms": 1419.5, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "railiance-forge", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "derived_commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "railiance-forge", + "commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "status": "applied", + "counts": { + "created": 0, + "updated": 12, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 11, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 1 + }, + "created": [], + "updated": [ + "FORGE-WP-0001", + "FORGE-WP-0002", + "FORGE-WP-0003", + "FORGE-WP-0004", + "FORGE-WP-0005", + "FORGE-WP-0006", + "FORGE-WP-0007", + "FORGE-WP-0008", + "FORGE-WP-0009", + "FORGE-WP-0010", + "RAILIANCE-WP-0001", + "RFORGE-WP-0002" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "FORGE-WP-0008-T01", + "FORGE-WP-0008-T02", + "FORGE-WP-0008-T03", + "FORGE-WP-0008-T04", + "FORGE-WP-0008-T05", + "FORGE-WP-0008-T06", + "FORGE-WP-0009-T01", + "FORGE-WP-0009-T02", + "FORGE-WP-0010-T01", + "FORGE-WP-0010-T02", + "FORGE-WP-0010-T03" + ], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "FORGE-WP-0008", + "from": "FORGE-WP-0008", + "target": "FORGE-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "5334ba5c-a1a6-5579-b482-12e3e968b2b5", + "from_task_id": null, + "to_workplan_id": "69458fdc-d727-5391-b88b-d03da0afe24e", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/projection.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-commit.json new file mode 100644 index 00000000..b929344a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-commit.json @@ -0,0 +1,39 @@ +{ + "exit_code": 0, + "commit": "ea65606c1298db782f721f9443bafeb03cdef138", + "base": "b42206e52bce0e11f9615b4e774f80f9015a1ef7", + "files": [ + { + "path": "tools/receive-secret-scan/main.go", + "sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6" + }, + { + "path": "tools/receive-secret-scan/batch.go", + "sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/volatile.go", + "sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/batch_test.go", + "sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "prior_sha256": null + }, + { + "path": "docs/receive-secret-detection.md", + "sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78", + "prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478" + }, + { + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md", + "sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551", + "prior_sha256": null + } + ], + "stdout": "[main ea65606] Batch small receive inputs within the unchanged scan budget\n 6 files changed, 995 insertions(+), 22 deletions(-)\n create mode 100644 tools/receive-secret-scan/batch.go\n create mode 100644 tools/receive-secret-scan/batch_test.go\n create mode 100644 tools/receive-secret-scan/volatile.go\n create mode 100644 workplans/FORGE-WP-0010-receive-scanner-budget.md\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 6, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-inputs.json new file mode 100644 index 00000000..d0875215 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publication-inputs.json @@ -0,0 +1,38 @@ +{ + "owner": "railiance-forge", + "base_revision": "b42206e52bce0e11f9615b4e774f80f9015a1ef7", + "message": "Batch small receive inputs within the unchanged scan budget", + "files": [ + { + "path": "tools/receive-secret-scan/main.go", + "sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6" + }, + { + "path": "tools/receive-secret-scan/batch.go", + "sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/volatile.go", + "sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/batch_test.go", + "sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "prior_sha256": null + }, + { + "path": "docs/receive-secret-detection.md", + "sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78", + "prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478" + }, + { + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md", + "sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551", + "prior_sha256": null + } + ], + "native_authority": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publish_source.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publish_source.py new file mode 100644 index 00000000..5abcb3d4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/publish_source.py @@ -0,0 +1,13 @@ +"""Apply reviewed source and use the ordinary owner publication workflow.""" +from pathlib import Path +import subprocess +import sys + +HERE=Path(__file__).resolve().parent +REPO=HERE.parents[3] +for argv in [ + [sys.executable,str(HERE/'apply_owner.py')], + [sys.executable,str(REPO/'docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py'),str(HERE/'publication-inputs.json'),'commit'], + [sys.executable,str(REPO/'docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py'),str(HERE/'publication-inputs.json'),'sync'], +]: + subprocess.run(argv,check=True,timeout=600) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/run_candidate.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/run_candidate.py new file mode 100644 index 00000000..779d77a7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/run_candidate.py @@ -0,0 +1,81 @@ +"""Offline candidate checks; private PID namespace, tmpfs inputs, no remote writes.""" +from pathlib import Path +import argparse +import hashlib +import json +import re +import subprocess +import time + +HERE = Path(__file__).resolve().parent +WORK = Path('/tmp/custodian-receive-scanner-batch-r1') +ORIGINAL = Path('/tmp/custodian-receive-scanner-budget-r1') +parser = argparse.ArgumentParser() +parser.add_argument('phase', choices=['build', 'test', 'scan', 'compiletests', 'storage']) +parser.add_argument('--attempt', required=True) +parser.add_argument('--run', default='.') +parser.add_argument('--storage', choices=['private', 'ordinary', 'unavailable'], default='private') +parser.add_argument('--revision', help='Optional exact new commit for the same disposable old-ref fixture') +args = parser.parse_args() +if not args.attempt.isalnum(): + raise SystemExit('invalid receipt suffix') +if args.revision and not re.fullmatch('[0-9a-f]{40}',args.revision): + raise SystemExit('invalid source revision') +stem = HERE / (args.phase + '-' + args.attempt) +assert not stem.with_suffix('.json').exists() +argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session'] +for path in ['/usr', '/lib', '/lib64']: + argv += ['--ro-bind', path, path] +argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev', + '--tmpfs', '/tmp', '--bind', str(WORK), '/work', + '--ro-bind', str(ORIGINAL / 'fixture.git'), '/fixture', + '--ro-bind', '/home/worsch/the-custodian/.git/objects', '/source-objects', + '--ro-bind', '/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks', '/scanner', + '--ro-bind', '/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64', '/toolchain', + '--chdir', '/fixture' if args.phase == 'scan' else '/work/source/tools/receive-secret-scan', '--clearenv'] +if args.storage == 'private': + argv += ['--tmpfs', '/dev/shm'] +elif args.storage == 'ordinary': + ordinary = WORK / 'ordinary-storage' + ordinary.mkdir(exist_ok=True) + argv += ['--ro-bind', str(ordinary), '/dev/shm'] +elif args.storage == 'unavailable': + # Hide bwrap's default /dev/shm as well; the test helper needs only stdio. + argv += ['--tmpfs', '/dev'] +env = {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOTOOLCHAIN': 'local', + 'GOPROXY': 'off', 'GOSUMDB': 'off', 'GOCACHE': '/work/gocache', 'GOMAXPROCS': '2', + 'CGO_ENABLED': '0', 'FORGE_TEST_GITLEAKS': '/scanner'} +if args.phase == 'scan': + env['GIT_DIR'] = '/fixture' +for key, value in env.items(): + argv += ['--setenv', key, value] +command = { + 'build': ['go', 'build', '-buildvcs=false', '-trimpath', '-o', '/work/candidate-hook', '.'], + 'test': ['go', 'test', '-buildvcs=false', '-count=1', '-timeout', '8m', '-v', '-run', args.run, '.'], + 'scan': ['/work/candidate-hook', '--scanner', '/scanner'], + 'compiletests': ['go', 'test', '-buildvcs=false', '-c', '-o', '/work/scanner.test', '.'], + 'storage': ['/work/scanner.test', '--test-storage-refusal'], +}[args.phase] +argv += ['--', *command] +start = time.monotonic() +scan_input=(ORIGINAL / 'input.txt').read_bytes() +if args.revision: + old, _, ref=scan_input.decode().strip().split(' ') + scan_input=(old+' '+args.revision+' '+ref+'\n').encode() +with stem.with_suffix('.txt').open('xb') as output: + result = subprocess.run(argv, input=scan_input if args.phase == 'scan' else None, + stdout=output, stderr=subprocess.STDOUT, timeout=540) +receipt = {'returncode': result.returncode, 'seconds': round(time.monotonic() - start, 2), + 'argv': argv, 'real_remote_ref_changed': False, 'real_credentials': False, + 'native_acceptance': False, + 'source_sha256': {p.name: hashlib.sha256(p.read_bytes()).hexdigest() + for p in sorted((WORK / 'source/tools/receive-secret-scan').glob('*.go'))}} +binary = WORK / 'candidate-hook' +if binary.exists(): + receipt['binary_sha256'] = 'sha256:' + hashlib.sha256(binary.read_bytes()).hexdigest() +if args.phase == 'scan': + receipt['adapter_result'] = json.loads(stem.with_suffix('.txt').read_text()) + receipt['exact_update']=scan_input.decode().strip() +stem.with_suffix('.json').write_text(json.dumps(receipt, indent=2) + '\n') +print(json.dumps({k: receipt[k] for k in ['returncode', 'seconds', 'adapter_result'] if k in receipt})) +raise SystemExit(result.returncode) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.json new file mode 100644 index 00000000..fd6d8063 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.json @@ -0,0 +1,99 @@ +{ + "returncode": 0, + "seconds": 58.33, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/fixture", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--setenv", + "GIT_DIR", + "/fixture", + "--", + "/work/candidate-hook", + "--scanner", + "/scanner" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "adapter_result": { + "status": "clean", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "scanned_objects": 141, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.txt new file mode 100644 index 00000000..3d3632f0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-missing.txt @@ -0,0 +1 @@ +{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.json new file mode 100644 index 00000000..f90ffcc8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.json @@ -0,0 +1,103 @@ +{ + "returncode": 2, + "seconds": 45.36, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/fixture", + "--clearenv", + "--ro-bind", + "/tmp/custodian-receive-scanner-batch-r1/ordinary-storage", + "/dev/shm", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--setenv", + "GIT_DIR", + "/fixture", + "--", + "/work/candidate-hook", + "--scanner", + "/scanner" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "adapter_result": { + "status": "unverified", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "reason": "volatile-storage-unavailable", + "scanned_objects": 36, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.txt new file mode 100644 index 00000000..797ee68e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-ordinary.txt @@ -0,0 +1 @@ +{"status":"unverified","scope":"introduced-reachable-git-objects-and-updated-ref-names","reason":"volatile-storage-unavailable","scanned_objects":36,"scanned_refs":1,"scanner_version":"8.30.1"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.json new file mode 100644 index 00000000..f026b04d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.json @@ -0,0 +1,101 @@ +{ + "returncode": 0, + "seconds": 53.38, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/fixture", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--setenv", + "GIT_DIR", + "/fixture", + "--", + "/work/candidate-hook", + "--scanner", + "/scanner" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2", + "batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489", + "adapter_result": { + "status": "clean", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "scanned_objects": 141, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.txt new file mode 100644 index 00000000..3d3632f0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r1.txt @@ -0,0 +1 @@ +{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.json new file mode 100644 index 00000000..5877b5d1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.json @@ -0,0 +1,101 @@ +{ + "returncode": 0, + "seconds": 52.53, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/fixture", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--setenv", + "GIT_DIR", + "/fixture", + "--", + "/work/candidate-hook", + "--scanner", + "/scanner" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a", + "adapter_result": { + "status": "clean", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "scanned_objects": 141, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.txt new file mode 100644 index 00000000..3d3632f0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-r2.txt @@ -0,0 +1 @@ +{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/source-application.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/source-application.json new file mode 100644 index 00000000..9f89a3ff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/source-application.json @@ -0,0 +1,38 @@ +{ + "source_applied": true, + "base_revision": "b42206e52bce0e11f9615b4e774f80f9015a1ef7", + "files": [ + { + "path": "tools/receive-secret-scan/main.go", + "sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6" + }, + { + "path": "tools/receive-secret-scan/batch.go", + "sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/volatile.go", + "sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610", + "prior_sha256": null + }, + { + "path": "tools/receive-secret-scan/batch_test.go", + "sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "prior_sha256": null + }, + { + "path": "docs/receive-secret-detection.md", + "sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78", + "prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478" + }, + { + "path": "workplans/FORGE-WP-0010-receive-scanner-budget.md", + "sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551", + "prior_sha256": null + } + ], + "original_unrelated_state_preserved": true, + "native_changed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-fixture-correction.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-fixture-correction.json new file mode 100644 index 00000000..0fdb2965 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-fixture-correction.json @@ -0,0 +1,9 @@ +{ + "attempt": "scan-missing", + "expected": "unverified", + "observed": "clean", + "classification": "negative fixture did not remove tmpfs: bwrap --dev supplies /dev/shm", + "accepted_as_missing_storage_proof": false, + "retained": true, + "actual_ordinary_storage_refusal": "scan-ordinary.json" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.json new file mode 100644 index 00000000..4b905b9f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.json @@ -0,0 +1,91 @@ +{ + "returncode": 0, + "seconds": 0.03, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--ro-bind", + "/tmp/custodian-receive-scanner-batch-r1/ordinary-storage", + "/dev/shm", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "/work/scanner.test", + "--test-storage-refusal" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.txt new file mode 100644 index 00000000..eb94c281 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-ordinary.txt @@ -0,0 +1 @@ +{"reason":"volatile-storage-unavailable","status":"unverified"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.json new file mode 100644 index 00000000..741002ea --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.json @@ -0,0 +1,91 @@ +{ + "returncode": 1, + "seconds": 0.02, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--ro-bind", + "/usr/bin/true", + "/dev/shm", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "/work/scanner.test", + "--test-storage-refusal" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.txt new file mode 100644 index 00000000..45b21713 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable.txt @@ -0,0 +1 @@ +bwrap: Can't create file at /dev/shm: Is a directory diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.json new file mode 100644 index 00000000..960d0313 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.json @@ -0,0 +1,90 @@ +{ + "returncode": 0, + "seconds": 0.03, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--tmpfs", + "/dev", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "/work/scanner.test", + "--test-storage-refusal" + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.txt new file mode 100644 index 00000000..eb94c281 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/storage-unavailable2.txt @@ -0,0 +1 @@ +{"reason":"volatile-storage-unavailable","status":"unverified"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.json new file mode 100644 index 00000000..6bed71a8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.json @@ -0,0 +1,98 @@ +{ + "returncode": 1, + "seconds": 39.45, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "test", + "-buildvcs=false", + "-count=1", + "-timeout", + "8m", + "-v", + "-run", + "TestVolatile|TestReceiverDeath|TestSmallInputParity|TestUpdate|TestTree|TestGitEnvironment|TestCapped", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2", + "batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.txt new file mode 100644 index 00000000..56b7c9cc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r1.txt @@ -0,0 +1,41 @@ +=== RUN TestVolatileStorageLifecycle +--- PASS: TestVolatileStorageLifecycle (0.01s) +=== RUN TestVolatileIdentityRefusesReplacement +--- PASS: TestVolatileIdentityRefusesReplacement (0.01s) +=== RUN TestReceiverDeathCleansStorageAndStopsReader +--- PASS: TestReceiverDeathCleansStorageAndStopsReader (0.03s) +=== RUN TestSmallInputParity +=== RUN TestSmallInputParity/empty +=== RUN TestSmallInputParity/clean +=== RUN TestSmallInputParity/exact-limit +=== RUN TestSmallInputParity/private-key +=== RUN TestSmallInputParity/binary-private-key +=== RUN TestSmallInputParity/token + batch_test.go:172: stdin reference outcome differs +=== RUN TestSmallInputParity/binary-token + batch_test.go:172: stdin reference outcome differs +=== RUN TestSmallInputParity/inline-suppression +=== RUN TestSmallInputParity/sixty-four-distinct-inputs +=== RUN TestSmallInputParity/expired-context +--- FAIL: TestSmallInputParity (15.13s) + --- PASS: TestSmallInputParity/empty (1.82s) + --- PASS: TestSmallInputParity/clean (1.90s) + --- PASS: TestSmallInputParity/exact-limit (1.97s) + --- PASS: TestSmallInputParity/private-key (1.90s) + --- PASS: TestSmallInputParity/binary-private-key (1.95s) + --- FAIL: TestSmallInputParity/token (1.21s) + --- FAIL: TestSmallInputParity/binary-token (1.21s) + --- PASS: TestSmallInputParity/inline-suppression (2.08s) + --- PASS: TestSmallInputParity/sixty-four-distinct-inputs (1.07s) + --- PASS: TestSmallInputParity/expired-context (0.00s) +=== RUN TestUpdateInputRefusesAmbiguity +--- PASS: TestUpdateInputRefusesAmbiguity (0.00s) +=== RUN TestTreeRefusesMalformedAndExternalEntries +--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s) +=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets +--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s) +=== RUN TestCappedOutput +--- PASS: TestCappedOutput (0.00s) +FAIL +FAIL railiance-forge/receive-secret-scan 15.178s +FAIL diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.json new file mode 100644 index 00000000..607d31cf --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.json @@ -0,0 +1,98 @@ +{ + "returncode": 0, + "seconds": 64.23, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/dev/shm", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "test", + "-buildvcs=false", + "-count=1", + "-timeout", + "8m", + "-v", + "-run", + ".", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.txt new file mode 100644 index 00000000..903aa9b5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r2.txt @@ -0,0 +1,108 @@ +=== RUN TestVolatileStorageLifecycle +--- PASS: TestVolatileStorageLifecycle (0.01s) +=== RUN TestVolatileIdentityRefusesReplacement +--- PASS: TestVolatileIdentityRefusesReplacement (0.01s) +=== RUN TestReceiverDeathCleansStorageAndStopsReader +--- PASS: TestReceiverDeathCleansStorageAndStopsReader (0.02s) +=== RUN TestSmallInputParity +=== RUN TestSmallInputParity/empty +=== RUN TestSmallInputParity/clean +=== RUN TestSmallInputParity/exact-limit +=== RUN TestSmallInputParity/private-key +=== RUN TestSmallInputParity/binary-private-key +=== RUN TestSmallInputParity/token +=== RUN TestSmallInputParity/binary-token +=== RUN TestSmallInputParity/inline-suppression +=== RUN TestSmallInputParity/sixty-four-distinct-inputs +=== RUN TestSmallInputParity/expired-context +=== RUN TestSmallInputParity/invalid-inputs +=== RUN TestSmallInputParity/scanner-failure +--- PASS: TestSmallInputParity (12.66s) + --- PASS: TestSmallInputParity/empty (1.39s) + --- PASS: TestSmallInputParity/clean (1.36s) + --- PASS: TestSmallInputParity/exact-limit (1.49s) + --- PASS: TestSmallInputParity/private-key (1.43s) + --- PASS: TestSmallInputParity/binary-private-key (1.44s) + --- PASS: TestSmallInputParity/token (1.33s) + --- PASS: TestSmallInputParity/binary-token (1.37s) + --- PASS: TestSmallInputParity/inline-suppression (1.43s) + --- PASS: TestSmallInputParity/sixty-four-distinct-inputs (0.89s) + --- PASS: TestSmallInputParity/expired-context (0.00s) + --- PASS: TestSmallInputParity/invalid-inputs (0.00s) + --- PASS: TestSmallInputParity/scanner-failure (0.50s) +=== RUN TestBatchRefusesUnverifiedReportsAndDiagnostics +--- PASS: TestBatchRefusesUnverifiedReportsAndDiagnostics (0.00s) +=== RUN TestUpdateInputRefusesAmbiguity +--- PASS: TestUpdateInputRefusesAmbiguity (0.00s) +=== RUN TestTreeRefusesMalformedAndExternalEntries +--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s) +=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets +--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s) +=== RUN TestCappedOutput +--- PASS: TestCappedOutput (0.00s) +=== RUN TestNativePushBoundaries +=== RUN TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/false +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/true +=== RUN TestNativePushBoundaries/sha256-object-format +=== RUN TestNativePushBoundaries/secret-in-tip +=== RUN TestNativePushBoundaries/secret-added-then-deleted +=== RUN TestNativePushBoundaries/new-branch-and-force-update +=== RUN TestNativePushBoundaries/merge-second-parent-history +=== RUN TestNativePushBoundaries/commit-message +=== RUN TestNativePushBoundaries/annotated-tag-message +=== RUN TestNativePushBoundaries/tag-direct-to-blob +=== RUN TestNativePushBoundaries/multi-ref-all-refused +=== RUN TestNativePushBoundaries/missing-scanner-and-deletion-refused +=== RUN TestNativePushBoundaries/wrong-executable-refused +=== RUN TestNativePushBoundaries/inline-and-config-suppression-refused +=== RUN TestNativePushBoundaries/replacement-objects-cannot-hide-secret +=== RUN TestNativePushBoundaries/grafts-cannot-hide-introduced-history +=== RUN TestNativePushBoundaries/ref-name-token +=== RUN TestNativePushBoundaries/partial-config-include-refused +=== RUN TestNativePushBoundaries/object-count-limit-refused +=== RUN TestNativePushBoundaries/external-gitlink-refused +=== RUN TestNativePushBoundaries/partial-repository-refused +=== RUN TestNativePushBoundaries/aggregate-byte-limit-refused +=== RUN TestNativePushBoundaries/oversized-object-refused +--- PASS: TestNativePushBoundaries (48.86s) + --- PASS: TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion (3.65s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret (4.73s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/false (2.06s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/true (2.66s) + --- PASS: TestNativePushBoundaries/sha256-object-format (4.16s) + --- PASS: TestNativePushBoundaries/secret-in-tip (2.12s) + --- PASS: TestNativePushBoundaries/secret-added-then-deleted (1.93s) + --- PASS: TestNativePushBoundaries/new-branch-and-force-update (4.81s) + --- PASS: TestNativePushBoundaries/merge-second-parent-history (2.53s) + --- PASS: TestNativePushBoundaries/commit-message (2.06s) + --- PASS: TestNativePushBoundaries/annotated-tag-message (2.07s) + --- PASS: TestNativePushBoundaries/tag-direct-to-blob (1.85s) + --- PASS: TestNativePushBoundaries/multi-ref-all-refused (1.91s) + --- PASS: TestNativePushBoundaries/missing-scanner-and-deletion-refused (0.11s) + --- PASS: TestNativePushBoundaries/wrong-executable-refused (0.10s) + --- PASS: TestNativePushBoundaries/inline-and-config-suppression-refused (1.79s) + --- PASS: TestNativePushBoundaries/replacement-objects-cannot-hide-secret (1.95s) + --- PASS: TestNativePushBoundaries/grafts-cannot-hide-introduced-history (2.35s) + --- PASS: TestNativePushBoundaries/ref-name-token (1.17s) + --- PASS: TestNativePushBoundaries/partial-config-include-refused (0.16s) + --- PASS: TestNativePushBoundaries/object-count-limit-refused (1.10s) + --- PASS: TestNativePushBoundaries/external-gitlink-refused (1.58s) + --- PASS: TestNativePushBoundaries/partial-repository-refused (0.17s) + --- PASS: TestNativePushBoundaries/aggregate-byte-limit-refused (5.22s) + --- PASS: TestNativePushBoundaries/oversized-object-refused (0.64s) +=== RUN TestScannerFileAndTimeoutRefusal +=== RUN TestScannerFileAndTimeoutRefusal/nonexecutable +=== RUN TestScannerFileAndTimeoutRefusal/symlink +=== RUN TestScannerFileAndTimeoutRefusal/expired-context +=== RUN TestScannerFileAndTimeoutRefusal/scanner-process-failure +=== RUN TestScannerFileAndTimeoutRefusal/unknown-old-ref +--- PASS: TestScannerFileAndTimeoutRefusal (1.67s) + --- PASS: TestScannerFileAndTimeoutRefusal/nonexecutable (0.06s) + --- PASS: TestScannerFileAndTimeoutRefusal/symlink (0.00s) + --- PASS: TestScannerFileAndTimeoutRefusal/expired-context (0.04s) + --- PASS: TestScannerFileAndTimeoutRefusal/scanner-process-failure (0.84s) + --- PASS: TestScannerFileAndTimeoutRefusal/unknown-old-ref (0.05s) +PASS +ok railiance-forge/receive-secret-scan 63.236s diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.json new file mode 100644 index 00000000..f8413a7b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.json @@ -0,0 +1,98 @@ +{ + "returncode": 0, + "seconds": 29.92, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-batch-r1", + "/work", + "--ro-bind", + "/tmp/custodian-receive-scanner-budget-r1/fixture.git", + "/fixture", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--tmpfs", + "/dev/shm", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "FORGE_TEST_GITLEAKS", + "/scanner", + "--", + "go", + "test", + "-buildvcs=false", + "-count=1", + "-timeout", + "8m", + "-v", + "-run", + "TestSmallInputParity|TestBatchAndLargerInputPushBoundaries", + "." + ], + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "source_sha256": { + "batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8", + "batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead", + "main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7", + "main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610" + }, + "binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.txt new file mode 100644 index 00000000..9d22db32 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/test-r3.txt @@ -0,0 +1,40 @@ +=== RUN TestSmallInputParity +=== RUN TestSmallInputParity/empty +=== RUN TestSmallInputParity/clean +=== RUN TestSmallInputParity/exact-limit +=== RUN TestSmallInputParity/private-key +=== RUN TestSmallInputParity/exact-limit-private-key +=== RUN TestSmallInputParity/binary-private-key +=== RUN TestSmallInputParity/token +=== RUN TestSmallInputParity/binary-token +=== RUN TestSmallInputParity/inline-suppression +=== RUN TestSmallInputParity/sixty-four-distinct-inputs +=== RUN TestSmallInputParity/expired-context +=== RUN TestSmallInputParity/invalid-inputs +=== RUN TestSmallInputParity/scanner-failure +--- PASS: TestSmallInputParity (15.80s) + --- PASS: TestSmallInputParity/empty (1.49s) + --- PASS: TestSmallInputParity/clean (1.43s) + --- PASS: TestSmallInputParity/exact-limit (1.41s) + --- PASS: TestSmallInputParity/private-key (1.40s) + --- PASS: TestSmallInputParity/exact-limit-private-key (1.33s) + --- PASS: TestSmallInputParity/binary-private-key (1.44s) + --- PASS: TestSmallInputParity/token (1.75s) + --- PASS: TestSmallInputParity/binary-token (1.85s) + --- PASS: TestSmallInputParity/inline-suppression (1.95s) + --- PASS: TestSmallInputParity/sixty-four-distinct-inputs (0.89s) + --- PASS: TestSmallInputParity/expired-context (0.00s) + --- PASS: TestSmallInputParity/invalid-inputs (0.00s) + --- PASS: TestSmallInputParity/scanner-failure (0.82s) +=== RUN TestBatchAndLargerInputPushBoundaries +=== RUN TestBatchAndLargerInputPushBoundaries/exact-limit-key +=== RUN TestBatchAndLargerInputPushBoundaries/larger-stdin-key +=== RUN TestBatchAndLargerInputPushBoundaries/larger-stdin-clean +=== RUN TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection +--- PASS: TestBatchAndLargerInputPushBoundaries (13.27s) + --- PASS: TestBatchAndLargerInputPushBoundaries/exact-limit-key (2.16s) + --- PASS: TestBatchAndLargerInputPushBoundaries/larger-stdin-key (2.90s) + --- PASS: TestBatchAndLargerInputPushBoundaries/larger-stdin-clean (5.46s) + --- PASS: TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection (2.31s) +PASS +ok railiance-forge/receive-secret-scan 29.076s diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/README.md new file mode 100644 index 00000000..19ab7352 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/README.md @@ -0,0 +1,29 @@ +# Receive-scanner availability reproduction + +Custodian source checkpoint `27737fcc` introduces 141 Git objects (one commit, +45 trees, 95 blobs; 2,068,946 bytes). Two exact normal remote publications returned +`unverified/scanner-failed`, after 128 and 118 objects respectively. The local +commit hook passed. The real remote ref remains `7c682d9`; no refusal was bypassed. + +The unchanged current Forge receive adapter source `b42206e5`, compiled locally +with the pinned Gitleaks binary, reproduces the failure on that exact public delta +in a disposable bare repository: 90.06 seconds, 94 objects, unverified. The source +uses one scanner process per object under a 90-second total context. Git object +storage is mounted read-only; network/PID/HOME are isolated and no credential or +real remote ref changes. This is source/environment reproduction, not a native +replacement artifact admission. + +The existing Repo Manager staged scanner already batches inputs up to 4096 bytes +and keeps larger stdin fragment behavior. Reuse that bounded profile and its +private volatile-storage/parent-loss cleanup semantics for the receive adapter. +All reachable object types and updated ref names, fixed scanner digest/rules, +byte/count limits and fail-closed outcomes remain required. Native hook/runtime +custody and any activation require their existing owner/founder change authority. + +The sealed-memfd symlink primitive did **not** establish traversal parity: +Gitleaks returned zero with warnings and missed the text/NUL-prefixed canaries. +That approach is rejected. Regular files inside a private namespace tmpfs detect +both canaries. This narrow primitive success does not prove complete batching, +process-loss cleanup, whole-control parity, workload cost or native admission. +The full correction is still implementation work; no scanner configuration or +canonical Forge source was changed here. diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/baseline.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/baseline.json new file mode 100644 index 00000000..0a783461 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/baseline.json @@ -0,0 +1,12 @@ +{ + "source_owner": "railiance-forge", + "source_revision": "git:b42206e52bce0e11f9615b4e774f80f9015a1ef7", + "scanner_sha256": "sha256:88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "target_commit": "git:27737fcce0c22192578dbd46d1268e5e12cf5615", + "baseline_commit": "git:7c682d9c66f8aaeb2bebe88aa31069fea482338c", + "introduced_objects": 141, + "bytes": 2068946, + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/findings.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/findings.json new file mode 100644 index 00000000..286be16f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/findings.json @@ -0,0 +1,133 @@ +{ + "native_publication_attempts": [ + { + "status": "unverified", + "reason": "scanner-failed", + "scanned_objects": 128, + "scanned_refs": 1, + "receipt": "../cust80-current-callback-publication-r1/projection.json" + }, + { + "status": "unverified", + "reason": "scanner-failed", + "scanned_objects": 118, + "scanned_refs": 1, + "receipt": "../cust80-current-callback-publication-r2/projection.json" + } + ], + "exact_public_delta": { + "introduced_objects": 141, + "commit_objects": 1, + "trees": 45, + "blobs": 95, + "bytes": 2068946 + }, + "actual_owner_adapter_local_reproduction": { + "returncode": 2, + "seconds": 90.06, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-budget-r1", + "/work", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/fixture.git", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "GIT_DIR", + "/work/fixture.git", + "--", + "/work/original-hook", + "--scanner", + "/scanner" + ], + "binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058", + "target": "disposable bare Git refs; read-only exact public object delta", + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "adapter_result": { + "status": "unverified", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "reason": "scanner-failed", + "scanned_objects": 94, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } + }, + "batch_primitive_trials": { + "sealed_memfd_symlinks": { + "status": "refused", + "scanner_exit": 0, + "warnings_present": true, + "canaries_not_reported": true, + "parity_established": false + }, + "private_namespace_tmpfs_regular_files": { + "status": "primitive_passed", + "scanner_exit": 20, + "text_and_NUL_prefixed_canaries_detected": true, + "raw_input_persisted_to_host_filesystem": false, + "full_control_adapter_parity": false + } + }, + "source_or_native_scanner_configuration_changed": false, + "native_change_approved": false, + "root_checkpoint_remote_publication": "pending; both exact normal attempts refused", + "next_source_work": "Reuse bounded <=4096-byte batching and private volatile workspace/parent-loss cleanup semantics from existing Repo Manager adapter; preserve large-object stdin, all Git object/ref scope, fixed producer digest/rules and 90-second fail-closed budget. Implement and test before requesting any native action." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-build.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-build.json new file mode 100644 index 00000000..cc229e04 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-build.json @@ -0,0 +1,84 @@ +{ + "returncode": 0, + "seconds": 11.0, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-budget-r1", + "/work", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/source/tools/receive-secret-scan", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "GIT_DIR", + "/work/fixture.git", + "--", + "go", + "build", + "-buildvcs=false", + "-trimpath", + "-o", + "/work/original-hook", + "." + ], + "binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058", + "target": "disposable bare Git refs; read-only exact public object delta", + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-build.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-build.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.json b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.json new file mode 100644 index 00000000..8eb941c7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.json @@ -0,0 +1,88 @@ +{ + "returncode": 2, + "seconds": 90.06, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-receive-scanner-budget-r1", + "/work", + "--ro-bind", + "/home/worsch/the-custodian/.git/objects", + "/source-objects", + "--ro-bind", + "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks", + "/scanner", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/fixture.git", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "2", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "GIT_DIR", + "/work/fixture.git", + "--", + "/work/original-hook", + "--scanner", + "/scanner" + ], + "binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058", + "target": "disposable bare Git refs; read-only exact public object delta", + "real_remote_ref_changed": false, + "real_credentials": false, + "native_acceptance": false, + "adapter_result": { + "status": "unverified", + "scope": "introduced-reachable-git-objects-and-updated-ref-names", + "reason": "scanner-failed", + "scanned_objects": 94, + "scanned_refs": 1, + "scanner_version": "8.30.1" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.txt b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.txt new file mode 100644 index 00000000..7b436cad --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/original-scan.txt @@ -0,0 +1 @@ +{"status":"unverified","scope":"introduced-reachable-git-objects-and-updated-ref-names","reason":"scanner-failed","scanned_objects":94,"scanned_refs":1,"scanner_version":"8.30.1"} diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_memfd.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_memfd.py new file mode 100644 index 00000000..92bb7df3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_memfd.py @@ -0,0 +1,29 @@ +import fcntl +import hashlib +import json +import os +from pathlib import Path +import subprocess +import tempfile + +assert hashlib.sha256(Path('/scanner').read_bytes()).hexdigest() == '88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509' +with tempfile.TemporaryDirectory() as area: + root=Path(area); inputs=root/'inputs'; inputs.mkdir() + (root/'scanner.toml').write_text('[extend]\nuseDefault = true\n') + (root/'ignore').write_text('') + (root/'template').write_text('{{ range . }}{{ .File }}\n{{ end }}') + token=b'ghp_'+b'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8' + descriptors=[] + for i,raw in enumerate([b'clean public source\n', b'github_token = '+token+b'\n',b'\x00github_token = '+token+b'\n']): + fd=os.memfd_create('forge-source-input',os.MFD_CLOEXEC|os.MFD_ALLOW_SEALING) + os.fchmod(fd,0o600);os.write(fd,raw);os.lseek(fd,0,0) + fcntl.fcntl(fd,fcntl.F_ADD_SEALS,fcntl.F_SEAL_SEAL|fcntl.F_SEAL_SHRINK|fcntl.F_SEAL_GROW|fcntl.F_SEAL_WRITE) + os.symlink('/proc/self/fd/'+str(fd),inputs/str(i));descriptors.append(fd) + command=['/scanner','dir','--follow-symlinks','--config',str(root/'scanner.toml'),'--gitleaks-ignore-path',str(root/'ignore'),'--ignore-gitleaks-allow','--redact=100','--no-banner','--no-color','--log-level','warn','--exit-code','20','--timeout','15','--report-format','template','--report-template',str(root/'template'),'--report-path',str(root/'paths'),'--max-target-megabytes','0',str(inputs)] + result=subprocess.run(command,pass_fds=tuple(descriptors),stdout=subprocess.PIPE,stderr=subprocess.PIPE,env={'PATH':'/usr/bin:/bin','HOME':str(root),'LANG':'C'},cwd=root,timeout=20) + found=(root/'paths').read_text().splitlines() if (root/'paths').exists() else [] + assert token not in result.stdout and token not in result.stderr + print(json.dumps({'observed_exit':result.returncode,'reported_indexes':[Path(x).name for x in found],'diagnostic_bytes':len(result.stderr)})) + assert result.returncode==20 and any(Path(x).name=='1' for x in found) and any(Path(x).name=='2' for x in found), 'memfd traversal/parity not established' + for fd in descriptors:os.close(fd) + print(json.dumps({'returncode':result.returncode,'reported_input_indexes':[Path(x).name for x in found],'sealed_memory_inputs':True,'text_and_NUL_prefixed_canaries_detected':True,'raw_input_written_to_filesystem':False})) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_tmpfs.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_tmpfs.py new file mode 100644 index 00000000..0a1de659 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/probe_tmpfs.py @@ -0,0 +1,29 @@ +import fcntl +import hashlib +import json +import os +from pathlib import Path +import subprocess +import tempfile + +assert hashlib.sha256(Path('/scanner').read_bytes()).hexdigest() == '88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509' +with tempfile.TemporaryDirectory() as area: + root=Path(area); inputs=root/'inputs'; inputs.mkdir() + (root/'scanner.toml').write_text('[extend]\nuseDefault = true\n') + (root/'ignore').write_text('') + (root/'template').write_text('{{ range . }}{{ .File }}\n{{ end }}') + token=b'ghp_'+b'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8' + descriptors=[] + for i,raw in enumerate([b'clean public source\n', b'github_token = '+token+b'\n',b'\x00github_token = '+token+b'\n']): + fd=os.memfd_create('forge-source-input',os.MFD_CLOEXEC|os.MFD_ALLOW_SEALING) + os.fchmod(fd,0o600);os.write(fd,raw);os.lseek(fd,0,0) + fcntl.fcntl(fd,fcntl.F_ADD_SEALS,fcntl.F_SEAL_SEAL|fcntl.F_SEAL_SHRINK|fcntl.F_SEAL_GROW|fcntl.F_SEAL_WRITE) + (inputs/str(i)).write_bytes(raw); (inputs/str(i)).chmod(0o600); descriptors.append(fd) + command=['/scanner','dir','--follow-symlinks','--config',str(root/'scanner.toml'),'--gitleaks-ignore-path',str(root/'ignore'),'--ignore-gitleaks-allow','--redact=100','--no-banner','--no-color','--log-level','warn','--exit-code','20','--timeout','15','--report-format','template','--report-template',str(root/'template'),'--report-path',str(root/'paths'),'--max-target-megabytes','0',str(inputs)] + result=subprocess.run(command,pass_fds=tuple(descriptors),stdout=subprocess.PIPE,stderr=subprocess.PIPE,env={'PATH':'/usr/bin:/bin','HOME':str(root),'LANG':'C'},cwd=root,timeout=20) + found=(root/'paths').read_text().splitlines() if (root/'paths').exists() else [] + assert token not in result.stdout and token not in result.stderr + print(json.dumps({'observed_exit':result.returncode,'reported_indexes':[Path(x).name for x in found],'diagnostic_bytes':len(result.stderr)})) + assert result.returncode==20 and any(Path(x).name=='1' for x in found) and any(Path(x).name=='2' for x in found), 'memfd traversal/parity not established' + for fd in descriptors:os.close(fd) + print(json.dumps({'returncode':result.returncode,'reported_input_indexes':[Path(x).name for x in found],'namespace_private_tmpfs_inputs':True,'text_and_NUL_prefixed_canaries_detected':True,'raw_input_persisted_to_host_filesystem':False})) diff --git a/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/run_reproduction.py b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/run_reproduction.py new file mode 100644 index 00000000..5d3c9c6b --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/receive-scanner-budget-r1/run_reproduction.py @@ -0,0 +1,31 @@ +"""Exercise the unchanged actual receive adapter on the exact public source delta.""" +from pathlib import Path +import argparse +import hashlib +import json +import subprocess +import time + +HERE=Path(__file__).resolve().parent +WORK=Path('/tmp/custodian-receive-scanner-budget-r1') +parser=argparse.ArgumentParser();parser.add_argument('phase',choices=['build','scan']);args=parser.parse_args() +argv=['bwrap','--unshare-net','--unshare-pid','--die-with-parent','--new-session'] +for p in ['/usr','/lib','/lib64']:argv+=['--ro-bind',p,p] +argv+=['--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp', + '--bind',str(WORK),'/work','--ro-bind','/home/worsch/the-custodian/.git/objects','/source-objects', + '--ro-bind','/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks','/scanner', + '--ro-bind','/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64','/toolchain', + '--chdir','/work/source/tools/receive-secret-scan' if args.phase=='build' else '/work/fixture.git','--clearenv'] +for key,value in {'PATH':'/toolchain/bin:/usr/bin:/bin','HOME':'/work/home','GOTOOLCHAIN':'local','GOPROXY':'off','GOSUMDB':'off','GOCACHE':'/work/gocache','GOMAXPROCS':'2','CGO_ENABLED':'0','GIT_DIR':'/work/fixture.git'}.items():argv+=['--setenv',key,value] +command=['go','build','-buildvcs=false','-trimpath','-o','/work/original-hook','.'] if args.phase=='build' else ['/work/original-hook','--scanner','/scanner'] +argv+=['--',*command];stem=HERE/('original-'+args.phase);assert not stem.with_suffix('.json').exists() +start=time.monotonic() +with stem.with_suffix('.txt').open('xb') as output: + r=subprocess.run(argv,input=None if args.phase=='build' else (WORK/'input.txt').read_bytes(),stdout=output,stderr=subprocess.STDOUT,timeout=150) +receipt={'returncode':r.returncode,'seconds':round(time.monotonic()-start,2),'argv':argv, + 'binary_sha256':'sha256:'+hashlib.sha256((WORK/'original-hook').read_bytes()).hexdigest() if (WORK/'original-hook').exists() else None, + 'target':'disposable bare Git refs; read-only exact public object delta','real_remote_ref_changed':False,'real_credentials':False,'native_acceptance':False} +if args.phase=='scan': + receipt['adapter_result']=json.loads(stem.with_suffix('.txt').read_text()) +stem.with_suffix('.json').write_text(json.dumps(receipt,indent=2)+'\n') +print(json.dumps({k:receipt[k] for k in ['returncode','seconds','adapter_result'] if k in receipt}));raise SystemExit(r.returncode) diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/README.md new file mode 100644 index 00000000..d9838420 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/README.md @@ -0,0 +1,42 @@ +# WP-80 progress visibility and task refinement + +The user requested smaller tasks and a transparent account of delivered work. +The active workplan now starts with source/integration/native progress, Now/Next, +publication limits and an explicit update rule. All six original task blocks, +statuses and UUIDs are preserved. The complete former 1,467-line file is retained +byte-for-byte in `workplan-before-refinement.txt`; the current file is much shorter. + +T07-T40 are 34 Custodian evidence checkpoints linked to existing owner work: +seven completed source reviews, one native preparation in progress, 26 pending. +Each pending checkpoint names its owner and completion test. This exposes existing +delivered work and the actual remaining integration, build, runtime, lifecycle, +recovery, audit and consumer acceptance. It creates no replacement owner backlog. + +All 16 target gates and G01-G13 have explicit checkpoint mappings; all 116 original +ledger entries remain unchanged. No complete native gate is closed. The source +review counts are not an overall completion percentage. Active delivery work is +limited to two checkpoints, with one clear current item and a short next sequence. + +The gap register now reflects accepted MFA preview/help corrections, delivered +sandbox and signing/verification source, actual current-token/Forgejo/database +proof and the new scanner source correction. Remaining native acceptance stays +explicit. The detailed implementation history links to the current workplan. + +Normal Repo Manager assigned exactly 34 new canonical task bindings and changed +no old binding. Its actual workplan parser verifies 40 tasks, unique bindings, +9 done / 4 progress / 27 todo across both umbrella and delivery records, all local +links, and an acyclic internal dependency graph. The delivery subset is 7 done / +1 progress / 26 todo. Source and native scopes remain distinct. + +The first ordinary consistency run completed with zero failures/automation errors, +but publication was refused and C-17 skipped task writes because commits remain +unpushed. API readback still has the original six tasks. The new source records +await the normal projection after scanner correction; no API task creation bypass +is used. Existing source/CLI failure receipts are retained. The eight preexisting +worktree/index states remain preserved. + +Decision: `77f88913-e893-42c8-992d-2f67df0a13db`, a Codex planning/reporting +decision implementing the user's request. It grants no runtime authority, owner +assent, residual promotion or changed security requirement. Evidence is in +`identifier-assignment.json`, `refinement-scope.json`, `validation.json`, +`consistency.json` and the projection readback receipt. diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/consistency.json new file mode 100644 index 00000000..5db78525 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/consistency.json @@ -0,0 +1,849 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": null, + "source_revision_reason": "dirty_workplans", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-05", + "message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)", + "file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md", + "db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e", + "file_value": "Domain and Repository Goals", + "db_value": "Workplan Lifecycle Documentation", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T01': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T01", + "db_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8", + "file_value": "Completed the SecurityCanon SEC-DSM and existing-owner architecture review. Delivered [security blueprint](../docs/netki", + "db_value": "Read SecurityCanon SEC-DSM 1.0, accepted NetKingdom layer model and case contracts,\nowner declarations, source implement", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T02': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T02", + "db_id": "5973026f-8ca9-5882-99fe-65a54bc250ac", + "file_value": "Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-se", + "db_value": "Blueprint inspection table records trust boundaries, circular dependency removal,\nidentity-first credential selection, e", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T03': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T03", + "db_id": "87637402-02f1-57c1-8fbc-4141598af8e3", + "file_value": "Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, es", + "db_value": "Start with the reproduced DN-subject validation defect in existing KEY-WP-0040.\nReconcile G04/G07/G08/G10/G12/G13 agains", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T04': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T04", + "db_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "file_value": "Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact curre", + "db_value": "Verify G01\u2013G13 against current source/runtime receipts and the individual SEC-DSM\nrequirement ledger. Existing owner int", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T05': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T05", + "db_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "file_value": "Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da", + "db_value": "User-requested addition on 2026-10-13. Accountable coordinating owner:\n**the-custodian / custodian-codex**. Accept incom", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T06': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T06", + "db_id": "6aca534c-5c7a-556f-b6b6-406433670c29", + "file_value": "Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity,", + "db_value": "Founder implementation request, 2026-10-16. Document the optimized target and\ncoordinate GPT-6.1-Sol medium agents again", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T07' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T07", + "db_id": "bb236dea-30f7-5437-b01c-f14d2509e061", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T08' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T08", + "db_id": "18b885fe-503f-5ebc-b390-808f71316264", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T09' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T09", + "db_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T10' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T10", + "db_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T11' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T11", + "db_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T12' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T12", + "db_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T13' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T13", + "db_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T09' of task 'CUST-WP-0080-T14' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T14", + "db_id": "", + "file_value": "CUST-WP-0080-T09", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T14' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T14", + "db_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T14' of task 'CUST-WP-0080-T15' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T15", + "db_id": "", + "file_value": "CUST-WP-0080-T14", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T15' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T15", + "db_id": "434d9c78-7789-5b78-8d9d-d87b0638b469", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T07' of task 'CUST-WP-0080-T16' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16", + "db_id": "", + "file_value": "CUST-WP-0080-T07", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T08' of task 'CUST-WP-0080-T16' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16", + "db_id": "", + "file_value": "CUST-WP-0080-T08", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T09' of task 'CUST-WP-0080-T16' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16", + "db_id": "", + "file_value": "CUST-WP-0080-T09", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T16' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16", + "db_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T17' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T17", + "db_id": "", + "file_value": "CUST-WP-0080-T16", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T17' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T17", + "db_id": "4de46468-7ae2-59e3-be2b-1a32506153a5", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T10' of task 'CUST-WP-0080-T18' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18", + "db_id": "", + "file_value": "CUST-WP-0080-T10", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T18' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18", + "db_id": "", + "file_value": "CUST-WP-0080-T16", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T18' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18", + "db_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T14' of task 'CUST-WP-0080-T19' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "", + "file_value": "CUST-WP-0080-T14", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T15' of task 'CUST-WP-0080-T19' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "", + "file_value": "CUST-WP-0080-T15", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T19' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "", + "file_value": "CUST-WP-0080-T16", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T17' of task 'CUST-WP-0080-T19' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "", + "file_value": "CUST-WP-0080-T17", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T18' of task 'CUST-WP-0080-T19' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "", + "file_value": "CUST-WP-0080-T18", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T19' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19", + "db_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T11' of task 'CUST-WP-0080-T20' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T20", + "db_id": "", + "file_value": "CUST-WP-0080-T11", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T20' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T20", + "db_id": "0d9df435-b9a2-5b89-833d-799785c969a9", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T07' of task 'CUST-WP-0080-T21' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T21", + "db_id": "", + "file_value": "CUST-WP-0080-T07", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T21' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T21", + "db_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T21' of task 'CUST-WP-0080-T22' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22", + "db_id": "", + "file_value": "CUST-WP-0080-T21", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T22' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22", + "db_id": "", + "file_value": "CUST-WP-0080-T16", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T17' of task 'CUST-WP-0080-T22' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22", + "db_id": "", + "file_value": "CUST-WP-0080-T17", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T18' of task 'CUST-WP-0080-T22' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22", + "db_id": "", + "file_value": "CUST-WP-0080-T18", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T22' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22", + "db_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T19' of task 'CUST-WP-0080-T23' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T23", + "db_id": "", + "file_value": "CUST-WP-0080-T19", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T23' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T23", + "db_id": "266e228b-7754-5323-b0c6-37f860592d90", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T24' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T24", + "db_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T25' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T25", + "db_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T26' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T26", + "db_id": "0491b6b4-a238-58ef-bf3a-505749e5655c", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T13' of task 'CUST-WP-0080-T27' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T27", + "db_id": "", + "file_value": "CUST-WP-0080-T13", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T27' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T27", + "db_id": "19540d29-c4df-5f1a-acf7-127965c9a396", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T28' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T28", + "db_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T29' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T29", + "db_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T29' of task 'CUST-WP-0080-T30' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T30", + "db_id": "", + "file_value": "CUST-WP-0080-T29", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T30' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T30", + "db_id": "457400ad-6c44-5160-a77a-63c6ad5acabc", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T29' of task 'CUST-WP-0080-T31' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T31", + "db_id": "", + "file_value": "CUST-WP-0080-T29", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T31' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T31", + "db_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T22' of task 'CUST-WP-0080-T32' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T32", + "db_id": "", + "file_value": "CUST-WP-0080-T22", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T32' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T32", + "db_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T12' of task 'CUST-WP-0080-T33' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T33", + "db_id": "", + "file_value": "CUST-WP-0080-T12", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T33' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T33", + "db_id": "4547ac4c-8893-54fe-ae6e-362682bb7920", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T34' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T34", + "db_id": "393b9fcc-323b-5182-92c6-44530fce7efb", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T23' of task 'CUST-WP-0080-T35' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T35", + "db_id": "", + "file_value": "CUST-WP-0080-T23", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T35' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T35", + "db_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T23' of task 'CUST-WP-0080-T36' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T36", + "db_id": "", + "file_value": "CUST-WP-0080-T23", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T36' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T36", + "db_id": "586232a1-57b0-5e04-a61b-fb687bcc8999", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T37' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T37", + "db_id": "d533ca34-a691-5f8e-8cc2-5f408b679538", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T38' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T38", + "db_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T20' of task 'CUST-WP-0080-T39' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39", + "db_id": "", + "file_value": "CUST-WP-0080-T20", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T28' of task 'CUST-WP-0080-T39' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39", + "db_id": "", + "file_value": "CUST-WP-0080-T28", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T39' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39", + "db_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Task dependency target 'CUST-WP-0080-T39' of task 'CUST-WP-0080-T40' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T40", + "db_id": "", + "file_value": "CUST-WP-0080-T39", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Derived task 'CUST-WP-0080-T40' is absent from this projection", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T40", + "db_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-17", + "message": "Repo 'the-custodian' has 1 unpushed commit(s) and push failed (remote: {\"status\":\"unverified\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"reason\":\"scanner-failed\",\"scanned_objects\":138,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ! [remote rejected] main -> main (pre-receive hook declined)\nerror: failed to push some refs to 'forgejo-remote:coulomb/the-custodian.git') \u2014 skipping writes to prevent runaway divergence", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 89/89", + "C-17: all write operations skipped \u2014 unpushed commits, push failed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 79, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/consistency.stderr.txt new file mode 100644 index 00000000..e69de29b diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/decision-receipt.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/decision-receipt.json new file mode 100644 index 00000000..097cab1d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/decision-receipt.json @@ -0,0 +1,18 @@ +{ + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "id": "77f88913-e893-42c8-992d-2f67df0a13db", + "topic_id": null, + "title": "Expose WP-80 progress as bounded delivery evidence checkpoints", + "description": "At the user's explicit request, preserve all six existing task UUIDs/statuses and the entire 16-gate/G01-G13/116-requirement scope; add 34 specific Custodian evidence checkpoints linked to existing owner work. Seven dated source reviews are complete, one native preparation is in progress and 26 remain todo. Separate source/integration/build/native/consumer stages, show Now/Next and retain the complete previous history. This is planning and reporting, not runtime approval or conformance. Owner implementation files stay authoritative; no duplicate implementation backlog or new service.", + "decision_type": "made", + "status": "resolved", + "rationale": "The previous 2/6 umbrella count hid real delivered work and concrete remaining acceptance. The user asked for smaller tasks and more transparency. This decomposition records existing evidence without changing any native gate status, prior authority, owner assent, residual promotion or deferral.", + "decided_by": "codex", + "decided_at": "2026-10-18T11:46:35.463476Z", + "deadline": null, + "escalation_note": null, + "superseded_by": null, + "created_at": "2026-10-18T11:46:36.597563Z", + "updated_at": "2026-10-18T11:46:36.597563Z", + "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/hub-readback-pending.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/hub-readback-pending.json new file mode 100644 index 00000000..765b1186 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/hub-readback-pending.json @@ -0,0 +1,40 @@ +{ + "file_task_count": 40, + "hub_task_count": 6, + "normal_sync_completed": true, + "projection_complete": false, + "reason": "C-17 all task writes skipped after normal source publication failed", + "all_6_existing_bindings_statuses_preserved": true, + "hub_rows": [ + { + "id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8", + "title": "Review canon and map actual architecture", + "status": "done" + }, + { + "id": "5973026f-8ca9-5882-99fe-65a54bc250ac", + "title": "Inspect and optimize the blueprint before planning closure", + "status": "done" + }, + { + "id": "87637402-02f1-57c1-8fbc-4141598af8e3", + "title": "Close source defects and reconcile uncovered lifecycle gaps", + "status": "progress" + }, + { + "id": "82378b0f-7004-5c2f-9683-b356a1227576", + "title": "Verify native closure against every requirement", + "status": "todo" + }, + { + "id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "title": "Coordinate self-service Playwright identity delivery", + "status": "progress" + }, + { + "id": "6aca534c-5c7a-556f-b6b6-406433670c29", + "title": "Establish the target architecture and drive the restructuring", + "status": "progress" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/identifier-assignment.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/identifier-assignment.json new file mode 100644 index 00000000..4b76f89f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/identifier-assignment.json @@ -0,0 +1,224 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "the-custodian", + "namespace": "helixforge", + "assignments": [ + { + "kind": "task", + "record_id": "CUST-WP-0080-T07", + "uuid": "bb236dea-30f7-5437-b01c-f14d2509e061", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T08", + "uuid": "18b885fe-503f-5ebc-b390-808f71316264", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T09", + "uuid": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T10", + "uuid": "1f3c78af-5686-58ea-9133-8afc2df36b8f", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T11", + "uuid": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T12", + "uuid": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T13", + "uuid": "793e78f0-7782-5e48-bdc0-b65127b32ecb", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T14", + "uuid": "7ecbd622-03a8-5b49-9621-8d21d7d15890", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T15", + "uuid": "434d9c78-7789-5b78-8d9d-d87b0638b469", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T16", + "uuid": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T17", + "uuid": "4de46468-7ae2-59e3-be2b-1a32506153a5", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T18", + "uuid": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T19", + "uuid": "4ffd2e33-d887-5686-bad1-7f32a56191a8", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T20", + "uuid": "0d9df435-b9a2-5b89-833d-799785c969a9", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T21", + "uuid": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T22", + "uuid": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T23", + "uuid": "266e228b-7754-5323-b0c6-37f860592d90", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T24", + "uuid": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T25", + "uuid": "3be1c76d-a5f3-5dea-9777-349dc97e836e", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T26", + "uuid": "0491b6b4-a238-58ef-bf3a-505749e5655c", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T27", + "uuid": "19540d29-c4df-5f1a-acf7-127965c9a396", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T28", + "uuid": "5ac99f55-0dde-5d1c-b88c-b85f34469abc", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T29", + "uuid": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T30", + "uuid": "457400ad-6c44-5160-a77a-63c6ad5acabc", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T31", + "uuid": "cbf32375-279a-5bf3-b867-06333a1ff2ca", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T32", + "uuid": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T33", + "uuid": "4547ac4c-8893-54fe-ae6e-362682bb7920", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T34", + "uuid": "393b9fcc-323b-5182-92c6-44530fce7efb", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T35", + "uuid": "db274192-07d6-5be7-9c1e-d63c5a9fb57f", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T36", + "uuid": "586232a1-57b0-5e04-a61b-fb687bcc8999", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T37", + "uuid": "d533ca34-a691-5f8e-8cc2-5f408b679538", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T38", + "uuid": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T39", + "uuid": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + }, + { + "kind": "task", + "record_id": "CUST-WP-0080-T40", + "uuid": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e", + "path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + } + ], + "historical_invalid_identifiers": [ + { + "kind": "workplan", + "id": "CUST-WP-ADHOC-2026-08-25-RETIRED", + "source": "workplans/ADHOC-2026-08-25-retired.md" + } + ], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/refinement-scope.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/refinement-scope.json new file mode 100644 index 00000000..310376d3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/refinement-scope.json @@ -0,0 +1,104 @@ +{ + "reason": "Founder requested transparent progress and smaller workplan tasks", + "original_workplan_sha256": "sha256:1aae7ecaf6f3f7e16113c896b5a746f303f5a6e7d6441b3f23ba5d8c2d060299", + "original_task_bindings_and_statuses_preserved": true, + "original_coordinator_tasks": 6, + "new_delivery_checkpoints": 34, + "completed_source_evidence_checkpoints": [ + 7, + 8, + 9, + 10, + 11, + 12, + 13 + ], + "current_delivery_checkpoint": "CUST-WP-0080-T20", + "next_delivery_checkpoints": [ + "CUST-WP-0080-T14", + "CUST-WP-0080-T15" + ], + "acceptance_coverage": { + "TSA-01": [ + 7, + 21 + ], + "TSA-02": [ + 7, + 16, + 22 + ], + "TSA-03": [ + 8, + 10, + 17, + 18, + 22 + ], + "TSA-04": [ + 9, + 10, + 14, + 15, + 16, + 17, + 18, + 19, + 23 + ], + "TSA-05": [ + 24, + 25, + 26 + ], + "TSA-06": [ + 13, + 27, + 28 + ], + "TSA-07": [ + 29, + 30 + ], + "TSA-08": [ + 31 + ], + "TSA-09": [ + 32 + ], + "TSA-10": [ + 11, + 20, + 28, + 39, + 40 + ], + "TSA-11": [ + 12, + 33 + ], + "TSA-12": [ + 34 + ], + "TSA-13": [ + 7, + 8, + 9, + 35 + ], + "TSA-14": [ + 36 + ], + "TSA-15": [ + 37 + ], + "TSA-16": [ + 4, + 38 + ] + }, + "native_gates_closed": 0, + "all_13_gaps_and_116_requirements_retained": true, + "scope_or_runtime_authority_changed": false, + "new_task_binding_assignment": "Official Repo Manager helper; not hand-assigned" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-after.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-after.json new file mode 100644 index 00000000..955c8ed8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-after.json @@ -0,0 +1,3 @@ +{ + "all_original_8_worktree_and_index_states_preserved": true +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-before.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-before.json new file mode 100644 index 00000000..7a3ffcdb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/unrelated-state-before.json @@ -0,0 +1,44 @@ +{ + "files": [ + { + "path": ".custodian-brief.md", + "sha256": "sha256:74e3f825b14c6fe5a0f8cf511e2b85d9010f56109ea5bee700b360766b3dd453", + "index": "100644 6aad3a5788fad3abd60c0f1270f160062dc0168b 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "sha256": "sha256:b8dc1ac2245e7aa59b13af1f62b0ca21b6c5704cafdb5a4de7a81b2d5595265b", + "index": "100644 d535e0f2dcc3d454e041a8f1b547b5dea4493380 0\tWORK-RECORDS.md" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json", + "sha256": "sha256:baecc157233131d17c73e84cd997db922d36ad235cbaa91f4938852220a824a2", + "index": "100644 bbe2969551797f8c0c7c33e1009f1b293a631113 0\tdocs/assessments/netkingdom-2026-10-14/hosted-before-federated.json" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json", + "sha256": "sha256:92916fa2fcabbe3f4b7c4b89ddbd6dc6cb079ffd6f06cf66b2c6e6d6ff5fabde", + "index": "100644 af6b3430909c8cbf8190c53cd541da651291151a 0\tdocs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/owner-access-gate.json", + "sha256": "sha256:059d36b607383c1458dd2909e9adc5ec8be42af7c41412b4ce2d244d20d093df", + "index": "100644 514edc14eb0a48736594bdd1bde2348e3d55e365 0\tdocs/assessments/netkingdom-2026-10-14/owner-access-gate.json" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/publication-preflight.json", + "sha256": "sha256:4b041890abae585ca78536fa12bb9668392f21b7c2c21f5f581e2eed516a1164", + "index": "100644 ee5730a4c683ee71240a4086e34a448cad92d88d 0\tdocs/assessments/netkingdom-2026-10-14/publication-preflight.json" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/published-source-verification.json", + "sha256": "sha256:f0095fc7a8089443f27ad50e358247705a6a5ce83c85f4d57b402b116741e7c0", + "index": "100644 83cdeb35d0ccd0b3a2472f8aa95767437566cbd9 0\tdocs/assessments/netkingdom-2026-10-14/published-source-verification.json" + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json", + "sha256": "sha256:29c43c9909bb8a94ebdc74312a545b66bcc73de1a355158bf247cf8fc405f16b", + "index": "100644 44097c5ea5ab08a0834ab1bd1d42fe4528bbb2c2 0\tdocs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/validation.json b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/validation.json new file mode 100644 index 00000000..cebdc5df --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/validation.json @@ -0,0 +1,26 @@ +{ + "parser": "repo_manager.parse.workplan.parse_workplan_file", + "task_count": 40, + "status_counts": { + "done": 9, + "progress": 4, + "todo": 27 + }, + "delivery_status_counts": { + "done": 7, + "todo": 26, + "progress": 1 + }, + "all_6_original_bindings_and_statuses_preserved": true, + "unique_40_canonical_bindings": true, + "all_16_gates_and_13_gaps_mapped": true, + "all_local_links_resolve": true, + "internal_dependencies_acyclic": true, + "all_116_requirements_retained": true, + "workplan_sha256": "sha256:fdc639c90091157541cfaccef5dc653936d5869c1d4a2344fefbcd48575a13d9", + "unchanged_ledger_sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184", + "requirements_count": 116, + "native_gates_closed": 0, + "hub_projection_complete": false, + "hub_task_count": 6 +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt new file mode 100644 index 00000000..e47ce89c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt @@ -0,0 +1,1467 @@ +--- +id: CUST-WP-0080 +type: workplan +title: "NetKingdom target security architecture and SEC-DSM implementation" +domain: infotech +repo: the-custodian +status: active +owner: codex +topic_slug: custodian +created: "2026-10-12" +updated: "2026-10-18" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" +--- + +User-requested estate assessment and gap closure. Existing owner plans retain +implementation and native acceptance ownership. This plan adds the cross-cutting +SEC-DSM assessment and tracks uncovered findings without duplicating their tasks. +Explicitly deferred or residual work is not silently promoted. + +2026-10-16 founder continuation: document the optimized target architecture and +drive implementation using GPT-6.1-Sol medium subagents. The normative target for +this implementation effort is `docs/netkingdom-target-security-architecture.md`; +`docs/netkingdom-target-implementation.md` links all sixteen acceptance gates to +existing owner work. This extends the existing coordinator rather than creating +a parallel security backlog. T03 retains source/lifecycle implementation, T05 +the browser consumer, and T04 native requirement closure. Existing scoped live +authorizations and deferrals remain applicable. Necessary residual dependencies +receive explicit owner-scoped promotion before implementation, never a blanket +activation. The full target remains incomplete until every acceptance gate is +proved at its stated scope. + +## Review canon and map actual architecture + +```task +id: CUST-WP-0080-T01 +status: done +priority: high +state_hub_task_id: "c770f7e1-25eb-53ec-9a37-1f7794077ff8" +``` + +Read SecurityCanon SEC-DSM 1.0, accepted NetKingdom layer model and case contracts, +owner declarations, source implementation boundaries and open workplans. +Delivered `docs/netkingdom-security-blueprint.md`. The source inventory includes +the named repos, identity, policy, approval, lifecycle, audit and supporting engines. +Role-engine is a documentation catalog; zone-engine is an offline reference. +Neither is described as live enforcement. Emergent knowledge package 0.2.6, +digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, +was withheld for changed sources; current owner sources were reviewed directly. + +## Inspect and optimize the blueprint before planning closure + +```task +id: CUST-WP-0080-T02 +status: done +priority: high +state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac" +``` + +Blueprint inspection table records trust boundaries, circular dependency removal, +identity-first credential selection, exact operation bindings, source/native +evidence separation and lifecycle closure. Gap analysis and sequence are in +`docs/netkingdom-security-gaps.md`. No new broker/PDP or blanket conformance claim. + +## Close source defects and reconcile uncovered lifecycle gaps + +```task +id: CUST-WP-0080-T03 +status: progress +priority: high +state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3" +``` + +Start with the reproduced DN-subject validation defect in existing KEY-WP-0040. +Reconcile G04/G07/G08/G10/G12/G13 against current owner inventory, scanner wiring, +bootstrap callers and approved exception evidence. Reuse owner work where it +already covers the finding. Record new concrete uncovered implementation work +before closing this task. Never populate secret values or invent owner approval. + +2026-10-18 receive-budget correction: the unchanged owner source reproduces the +normal publication refusal at 90.06 seconds after 94 of 141 introduced objects. +Forge `ea65606c` publishes a six-file correction reusing Repo Manager's bounded +small-input profile, private tmpfs and independent cleanup. All scanner rules, +coverage and limits remain unchanged. The complete original delta now scans all +141 objects/one ref in 52.53 seconds. The full source suite and additional boundary +checks cover 54 distinct leaf cases without skips; initial fixture/setup failures +are retained. New FORGE-WP-0010-T01 is done, T02 progress and T03 wait; the finished +baseline and unpromoted residual plan are not reopened. + +Read-only native inventory verifies the old pinned binaries, tmpfs, kernel and +166 identical installed hook fragments. Two proposed Apps source files and a +conditional two-field Deployment patch pass forward/inverse simulation and exact +server dry runs. The old Helm release must not overwrite later live changes. +Sealed activation/recovery, final drift/resource preflight, independent package/ +owner admission and founder go remain open. No native change or gate closure; +the latest root evidence remains locally committed but remotely unpublished. +Source/proof: `docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/`. + +2026-10-18 actual callback/current-grant continuation: two signed access-purpose +counterexamples fail against the prior ID-token verifier. The consumer now +requires independently admitted application tenant/current-token bindings, +separates ID/access purposes, checks the exact signed RS256 at_hash, joins +issuer/client/subject/tenant/type/issuance/assurance/auth-time/provenance and +rechecks current status before and after the PDP. KeyCape `e2c5a947` signs the +exact online human access-grant binding without changing disabled legacy issuance. +Its complete race suite passes 726 test/subtest results with the same six existing +native/external skips. The identical current consumer fails against the old issuer. + +The actual HTTPS PKCE/discovery/UserInfo/status/revocation handlers, real Forgejo +provider/callback and unchanged generated client pass five separate consumer +processes: two current grants accepted; mixed pair, revoked original and suspended +human refused. MFA session seeds and PDP admissions are synthetic. The latest +focused suite passes 91 results without skips; the final four selected composed +packages pass 116 without skips. The initial reused-file fixture skip and its +subsequent correction are retained. No native database/issuer proof is inferred. + +Apps `ab3cf5cd` retains the initial source commit and its validation-scope +correction. The 49-path source package and six issuer source postimages replay +exactly; production code and generated adapter match the tested runtime. +Complete release/static-assets/OCI rebuild, independent owner assent and native +package/type/custody acceptance remain open. Exact source/proof is in +`docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/`. + +The user explicitly selected current KeyCape checks on every ongoing API/Git/SSH +operation for linked accounts, retaining the separate local break-glass path. +The target architecture and decision b96ef564-c713-4a48-9ab2-849958cec681 record +that profile; it grants no live change. Those route/resource/action/group checks +remain actual implementation work under existing RAPPS16-T09/NK48-T43, alongside +current protected operation/inverse, exact effect/approval, journal custody and +all-writer exclusion. Callback proof closes no native gate or coordinator task. +Audit r6 retains all sixteen gates, G01–G13 and all 116 ledger requirements. + +2026-10-18 shared-client/inverse continuation: KeyCape `08c083ba` publishes +one producer current-token implementation, its generated Go adapter and private +current/revoke/independent-inactive CLI commands. Explicit trust/identity/status +joining, per-check trust/credential rereads, post-response lifetime/key checks +and exact token-digest output binding pass 724 full race test/subtest results +with six existing native/external skips. A deliberate generated-consumer-only +change fails the ordinary parity checker. KEY42-T04 records source completion; +independent issuer/profile review and native admission remain open. + +Warden `08c098e6` separates immutable original session provenance from the fresh +current session needed for an exact existing inverse. It verifies original +journal/intent/pins and current identity without granting replay or clearing +uncertainty. Its actual canonical guarded suite passes 796 tests, four deselected. +The cross-owner fixture uses the actual HTTPS issuer, built CLI, generated Go +consumer and Warden kernel: 45 assertions across fresh owner processes pass, +including current/revoked checks, original business replay refusal, exact synthetic +effect restoration and independent inactive cleanup readback. Case/catalog/owner +attestations and target are synthetic; no real Forgejo/native acceptance is claimed. + +All 19 KeyCape and four Warden source delta postimages replay exactly from their +published bases; compiled integration runtime/export bytes match. Original API, +fixture-mode and archive-only metadata failures are retained. Source and evidence: +`docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`. +NK48/Apps retain current authenticated operation/inverse effect/approval bindings, +ongoing HTTP/API/Git/SSH, private journal custody/retention and all release-writer +exclusion. All sixteen gates, G01–G13 and 116 ledger entries remain in scope; +no coordinator task or native gate closes. Completion audit advances to r5. + +2026-10-18 current-token producer continuation: actual owner contracts confirm +that legacy KeyCape JWT validity is expiry-only and Warden's injected session +verifier does not supply a current revocation source. Prepared an explicit, +proposed issuer scope extension in the existing KeyCape service rather than +an application-local token registry. One opt-in bounded hash-only store serves +actual human/service issuance, UserInfo, RFC 7662 introspection and RFC 7009 +revocation. Unique access-token identifiers prevent same-second remint/revival; +ID-token and disabled-profile behavior remain unchanged. Online checks bind +current registration and human disposition and recheck after directory lookup. + +All 659 complete source race test/subtest results pass, with six existing +native/external skips; all 43 new status results pass without skips. The built +standalone server passes 26 actual-process checks, including revocation, real +restart/predecessor refusal, fresh issuance, capacity and disabled routes. A +separate actual-handler HTTPS PKCE flow passes. Omitting the revoked-state +predicate in a controlled source copy fails seven intended checks. All 18 source/publication +postimages replay exactly from the published owner archive; production is +untouched. Process-local status loss deliberately requires reauthentication; +offline consumers retain their existing token lifetime. These limits are part +of the explicit proposed KEY-WP-0042 contract, not an implicit scope promotion. + +Ordinary owner identifier preview exposed a preexisting closed historical task +without its file UUID. The Hub has an exact matching existing binding; normal +consistency audit skips creation in closed workstreams. Its existing helper +restores only that exact already-recorded reference after parent/record/title/ +status/body comparison. Normal Repo Manager assigns the four new canonical +proposal records. KeyCape `67a0869c` publishes the 17-path feature and historical +reference restoration, without changing historical status or any existing UUID. Exact source, refusals and process receipts: +`docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/`. Independent +issuer/profile assent, native issuer admission and existing NK48/Apps operation, +inverse, ongoing-resource and cleanup bindings remain open. All sixteen target +gates, thirteen gaps and 116 ledger entries remain in scope; none closes here. + +2026-10-18 PostgreSQL continuation: the actual Forgejo engine/model schemas and +OAuth configuration types now pass 37 test/subtest results on disposable +PostgreSQL 16.14 across default, explicit-public and named schemas. Separate +client processes verify rollback after death immediately following INSERT, +committed apply survival through an actual database-server restart, and fresh +reconciliation/inverse. Exact restoration, drift/link refusals, trigger rollback, +uncooperative writer exclusion and concurrent preparation pass. Controlled +copies without the table lock or private-query marker fail in all three profiles. + +The diagnostics test exposed a real XORM tracing-context composition panic. +Publishing the task context into the shared query hook fixes the actual path +without changing the incoming private marker. Six SQLite diagnostic checks and +all 94 selected composed package results pass without skips. Earlier container, +fixture and compilation failures, the original panic and both counterexamples +remain retained. All owned test containers and volumes were removed. + +Apps `308e83fc` publishes the 40-path source/build correction at the primary hub +with all nine task UUIDs/statuses preserved. The complete fresh frontend/static +release, all 2,234 embedded assets and 48 release CLI/SQLite checks pass. Two +fresh local no-cache OCI exports reproduce the same archive/manifest/config/index; +no second source build, registry publication or deployed acceptance is claimed. +Evidence: `docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/`. +Current operation/inverse identities, every release writer, private journal +custody/retention, ongoing resource paths and independent/native acceptance remain +under existing T34/T42/T43 and RAPPS16-T07/T08/T09. This source proof closes no +native target gate; the complete goal and ledger scope remain active. + +2026-10-18 goal continuation: implemented the missing producer-owned Go client, +generated export parity check, validated Forgejo policy fixtures/Rego tests and +actual consumer callback coverage. Access Engine source `ca0cb757` is committed +and projected at primary/railiance01 with its original task bindings preserved. +The complete root race suite passes 494 test/subtest results with three existing +optional/fixture skips; the layer check and strict group-shape regressions pass. +The original malformed-group counterexamples, incomplete source files and failed +preparations remain retained. + +Composed the actual Forgejo backend with private input and the source-state +transaction. Recovered the interrupted empty DB-context snapshot from its exact +frozen patch and verified both declared hashes. Actual CLI replay exposed the +Engine/Session logging-guard incompatibility; a shared underlying-logger check +corrects it while retaining raw SQL refusal and real hook redaction. Final actual +package checks pass 76 test/subtest results without skips, and the complete backend +passes 48 isolated CLI/SQLite subprocess checks. All 35 composed patch postimages +reconstruct exactly from the pinned official archive. Source and proof inventory: +`docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/`. + +Actual issuer-source inspection found a further mandatory interoperability gap: +KeyCape emits a structured `assurance` object; the preceding candidate expected a +string. The actual TokenHandler fixture reproduced the rejection. The corrected +consumer preserves the signed object and tenant provenance, validates its actual +authentication time, and bounds identity validity by authentication age, token +age and expiry. All 77 actual-issuer/provider/callback test and subtest results +pass, including real discovery/FetchUser/UserInfo joining, signed ALLOW/DENY and +UserInfo spoof refusal; all 93 selected composed +package results pass without skips. The new 37-path patch replays exactly against +the official source archive. The fresh complete frontend/static release build +passes; all 2,234 embedded assets match and all 48 actual release CLI/SQLite +checks pass. Evidence is in `forgejo-keycape-claims-r1`; these are synthetic +authentication/source and local artifact proofs. +Two fresh no-cache local OCI exports from that verified binary have identical +manifest/config/index/archive digests, preserving all base layers and rootless +runtime configuration. No second source build or operational admission is claimed. +Apps `3fb031a4` publishes the five-file build-source integration at the primary +hub, preserves all nine task UUIDs and starts existing RAPPS16-T09. Independent +owner review and operational admission of that revision remain open. +Existing T43 / +RAPPS16-T09 also retain ongoing HTTP/API/Git/SSH and operation/inverse coverage; +T41/T42 retain full release integration, exclusion and private journal custody. +The full completion audit now enumerates all sixteen gates, thirteen named gaps +and 116 SEC-DSM ledger entries under `cust80-completion-r1`. No native gate or +coordinator task is closed by these source results; the full user goal is active. +`cust80-completion-r2` retains that full scope and records this source progress. + +2026-10-18 resumed application review: completed the interrupted seventeen-file +release-build evidence checkpoint as `8951d324`, preserving the staged brief and +other work. Reconstructed the exact retained Access Engine adapter and producer +candidate against producer source `d328a260` in network-disabled, private-PID +sandboxes. Both full commands fail: the adapter includes an empty Go source file; +the actual producer rejects the Forgejo policy for undeclared attributes and +missing embedded/referenced fixtures and Rego tests. Adapter verifier tests and +two existing producer control functions pass, but do not establish package or +policy acceptance. The consumer callback test file is also empty, and ongoing +HTTP/API/Git/SSH coverage is absent from the candidate. Original interrupted runs +remain unverified; no previous success is overwritten. Evidence and exact source +pins: `docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/`. +NK48-T43 / RAPPS-WP-0016-T09 retain these corrections and full profile acceptance; +T41/T42 retain independent private-input/transaction review and owner integration. +No task or native target gate is closed by this review. + +2026-10-12: KEY-WP-0040 source defect repaired and committed as key-cape `1344fc8`. +Twenty recovery tests and the full Go suite pass. Blue-lane code-volume-only +deployment reached generation 11 Ready; health 200 and anonymous recovery 403 +verified. Exact original proposal, dry-run, initial rollout observation and +final receipt are in `docs/evidence/2026-10-12-netkingdom-security/` and the +existing supervision record. No factor or account was changed. G01 still needs +the founder's authenticated preview/U08. The prepared OTP help link remains +local source only. G13 now explicitly tracks PDP response authentication; the +finished signature producer workplan is not treated as proof of consumer rollout. + +2026-10-12 continuation: reproduced and repaired G13 Check-client credential +forwarding through HTTP redirects and environment proxies, including the approval +flow's unsafe opener override. Strict literal loopback origins and response +bounds are enforced before credential access/decision use. New native owner +SECRETS-WP-0014 records completed transport work and separate open independently +anchored signature enforcement/native acceptance tasks. Focused regressions: +18 failed/5 passed before, 23 passed after; broader focused suite 71 passed. +Real repository full suite 675 passed/1 skipped. Archived sandbox full-suite +ownership/repository-detection failures are retained in the receipt rather than +misrepresented as source regressions. No live credential, policy, entitlement, +PDP deployment or protected backend was touched. G13 stays open. + +2026-10-12 continuation: G08 source repair implemented in NetKingdom. Removed +emergency/reprint root export and generator prefix disclosure; private service +file creation, public-recipient bootstrap, explicit matching custody resume, +non-mutating dry-run and digest-bound encrypted handoff now have disposable +workflow tests. Historic delivery flags are preserved. NK-WP-0049 owns remaining +legacy caller reconciliation and native recovery acceptance; NK-WP-0045's +finished non-secret root-grant recovery does not cover this secret custody path. +No real root/credential was read, generated or rotated and no live bootstrap was +run. Existing CUST-WP-0073-T05 exposure deferral remains effective. Exact source +and validation receipt: `bootstrap-handoff.json` in the evidence directory. + +2026-10-12 additional G08 progress: direct custody/encrypt/decrypt fixes pushed +as NetKingdom `4cf26a9`; 206 tests pass. NK-WP-0049-T02 is progress with specific +remaining Make/rotation/admin output callers. Six SEC-DSM requirements now have +substantive incomplete assessments and scoped proof/missing-evidence fields; +none is marked conformant. `custody-entrypoints.json` preserves the baseline, +source manifest, test coverage and cleanup/isolation limits. No live credentials +or founder-deferred rotation were used. + +2026-10-12 G08 Make follow-through: NetKingdom `681c5b0` pushed; 227 actual checkout +tests pass (21 real-SOPS tests, no skips). Public-only setup, explicit matching-key +private SOPS output, ambient identity isolation, no-overwrite/Git-output guards +and sanitized parser/tool failure handling replace the legacy Make paths. Six +incomplete requirement assessments now cite `sops-make-entrypoints.json` and +state remaining direct/delegated callers, existing copies and native recovery +proof. This neither executes deferred rotation nor admits a production SOPS +version; the disposable binary's official checksum verification is scoped in the +receipt. NK-WP-0049-T02/T03 and G08 remain open. + +2026-10-12 G08/G09 rotation output repair: NetKingdom `6ae4708` pushed. +20 regressions failed against the old +NetKingdom source; 25 focused regressions and all 252 repository tests pass after +repair. Private file validation/atomic handoff, sanitized diagnostics, SQL stdin, +fail-closed database discovery and unattended LDAP refusal remove reproduced +source defects without executing founder-deferred rotations. DSM-ROT-003 now has +an explicit incomplete assessment (seven incomplete, 89 unverified, 20 anti-pattern +references). Native adoption/old-value refusal and admin-bootstrap/RSA/delegated +source gaps remain in NK-WP-0049. Receipt: `rotation-output.json`. + + +2026-10-12 current-profile admin bootstrap repair pushed as NetKingdom `19a1c75`. +It removes automatic obsolete +trigger-admin creation, replaces output/argv/shell-source handling with private +input and stdin delivery, and prevents password/policy overwrite on rerun. +Fourteen baseline tests failed, two passed; 36 focused tests pass including seven +actual privacyIDEA 3.12.2 model tests on disposable SQLite. Full suite: 288 tests +and 29 subtests passed, no skips. No live credential, +account or policy changed. Evidence: `admin-bootstrap.json`. DSM-TRANS-002 now +records the remaining privileged KeyCape token path explicitly (eight incomplete, +88 unverified, 20 reference entries). Native PostgreSQL/image/MFA acceptance, +legacy-object revocation and other delegated helper lifecycle remain open. + +2026-10-12 G07 broadened audit: all 21 review repositories inherit a generated-only +guard; a disposable private-key commit succeeds through it. Repo Manager's new +`secret-scan` adapter (`77fc4c9`, pushed) pins Gitleaks, scans exact staged blobs without content +output and passes 17 focused tests including an actual refused selective commit. +All 249 Repo Manager tests pass, no skips. +RMGR-WP-0021 owns source integration, exact local activation, independent forge/CI +coverage and private detection-to-response acceptance. No global hook/routing +changed and no real credential finding was exposed. Four DSM-DETECT assessments +are now explicitly incomplete (12 incomplete, 84 unverified, 20 references). +Evidence: `secret-detection.json`; G07 stays open pending native enforcement. + +2026-10-12 G07 native workstation activation: RMGR-WP-0021-T02 completed. +Exact proposal CUST80-G07-local-hooks-001 installed the pinned scanner at a +durable local path and composed the two known hooks, preserving routing and +other hooks. All 22 scoped checkouts passed actual configured-hook clean, +disposable-secret, generated-only and non-executable-scanner probes. Temporary +indexes/object stores preserved user source/staging/branches; executable mode was +restored, and an unreviewed checkout kept its prior behavior. Eleven targeted +activation/rollback/guard tests pass. Receipt: `secret-hook-activation.json`; +exact proposal, backups and rollback: `docs/changes/CUST-WP-0080/`. Independent +forge/CI enforcement, other clones/history and detection-to-response remain open. +No DSM requirement or whole G07 closure is inferred from this local acceptance. + +2026-10-12 G07 forge baseline: read-only observation confirmed railiance01 and +Forgejo 11.0.3. Its repository storage has 165 repository directories (not yet an +admitted production denominator). All 22 reviewed repositories exist and their +receive-hook files exactly match the seven distinct hashes generated by upstream +v11.0.3 templates, with no extra hook files/symlinks at the inspected depth. +No custom scanner hook is installed there. Branch-protection/Actions coverage, +internal policies and actual push rejection remain unverified. Metadata and +upstream comparison: `forge-secret-detection-baseline.json`. No server mutation, +credential read, repository-content scan or synthetic push was performed. + +2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native +forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans +introduced reachable Git objects and updated ref names, preserving quarantine +and refusing incomplete/oversized input. Thirty-three leaf cases pass, including +actual disposable pushes for intermediate/deleted secrets, second-parent merges, +messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and +scanner failures. Existing owner Python test passes; the new owner Make target +passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`. +No production hook changed. Exact-binary admission, repository denominator, +SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain +open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open. + +2026-10-12 G07 native admission: the exact adapter/scanner binaries passed +clean/detection/quarantine/tool-failure/recovery checks in disposable repositories +inside the running Forgejo image. Builtin authorization was stubbed only in this +isolated probe; no production hook changed during that probe. Receipt: +`receive-native-probe.json`. Metadata reconciliation now matches 165 database +repositories to 165 directories; none has a protected-branch rule. The initial +22 reviewed repositories pass shallow/partial/gitlink compatibility checks; the +remaining 143 are uncovered, not exempt. `forge-repository-inventory.json` +retains aggregates and reviewed identities only. An exact additive-hook activation +proposal and tested rollback are prepared as FORGE6-RECEIVE-ACTIVATION-001 under +the existing standing blue-lane authorization; outcome is recorded separately. + +2026-10-13 interruption recovery: retained activation receipt proves that +FORGE6-RECEIVE-ACTIVATION-001 completed on October 12 at 17:32 UTC, after the +last progress note. All 22 exact Forgejo repositories gained the additive hook; +actual SSH probes produced clean/blocked scanner results under a temporary veto, +with probe refs/quarantined commits absent and the veto removed. A fresh read-only +inspection confirms the same pod/image, exact original and added hook hashes, +executable pinned binaries and healthy service. Evidence: +`receive-hook-activation.json` in the October 12 directory and +`docs/evidence/2026-10-13-netkingdom-security/receive-profile-recheck.json`. +Ordinary clean-push acceptance, HTTP/frontend/lifecycle coverage, the other 143 +repositories and private response acceptance still need proof. G07 remains open. + +2026-10-13 G07 acceptance follow-through: committed recovered activation as +Custodian `eb93eee` and owner record as railiance-forge `d2d87ca`; both ordinary +SSH source pushes passed through the installed profile via fix-consistency and +remote heads were verified. Owner T02 is progress in both file and hub. Four +installer/rollback tests pass again. An isolated local instance of the exact +Forgejo image with no network or host mounts passes 23 boolean lifecycle checks: +HTTP clean/secret/quarantine behavior, native content API and merge-message +refusal with actual detector evidence, clean merge, hook regeneration, exact +Git-template inheritance on new repository creation, restart and subsequent +refusal. Seven incomplete preparation/assertion attempts are retained; none is +counted as acceptance. The successful receipt and upstream source hashes are in +`docs/evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json`. +The test reproduces the absent default new-repository hook and proves a candidate +Git-template repair, not a deployed repair. Import/mirror clone/fetch bypass the +receive boundary; those and the other 143 repositories, deployed HTTP/SSO/UI and +k3s lifecycle acceptance, CI authority and private response remain open in +FORGE-WP-0006/RMGR-WP-0021. Close-down checklist row 21 now records these unarmed +controls. No gap or requirement is marked closed from isolated acceptance. +A real pre-commit finding on the authored harness was privately classified as a +public binary-checksum false positive. The harness now reuses the immutable +admitted artifact manifest rather than duplicating that metadata. The unchanged +scanner passes the revised staged source; no suppression or exception was added. +`scanner-triage.json` retains value-free classification and resolution evidence; +this does not close RMGR-WP-0021-T04's credential-response requirement. + +2026-10-13 G07 template deployment: source railiance-apps `390a30a` adds the +immutable non-secret ConfigMap, read-only file subPath mounts, encoded Git +configuration and deployment prerequisite. Thirty isolated file-mount/config/ +rollback checks and six conditional-patch regressions pass. Exact proposal +FORGE6-TEMPLATE-LIFECYCLE-001 passed the server dry-run and its additive live patch +reached generation 12 Ready on the unchanged image. Actual Forgejo Git config +selects the template; a native temporary Git repository inherited the regular, +executable exact hook and refused malformed input. All 22 original hook inventories +and both binaries remain unchanged; health passes and probe data was removed. +Existing admin identity and initial-only password mode were checked before restart. +No credential, identity, resource request or policy scope was changed. The first +owner-source sync hit the restart window; retry pushed `390a30a` successfully. +Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json`; +proposal, guarded rollback and source reconciliation instructions are in +`docs/changes/CUST-WP-0080/forge-template-operations.md`. + +Fresh metadata now reconciles 166 database repositories and directories (one more +than October 12): all hook inventories are known; 22 have the admitted profile, +144 are builtin-only. No mirrors, forks or wikis are present; no protected-branch +rules are configured. Full identity inventories remain in mode-0600 local files; +committed receipts contain aggregates only. Production API/SSO/frontend creation, +existing-repository expansion, import/mirror content paths, CI and response +acceptance remain open; T03/T04 and the owner plan are not closed by this rollout. + +2026-10-13 adverse acceptance and recovery: the initial generation-12 health, +hash and malformed-input checks missed a real restart failure. The next ordinary +Forge owner push refused with `scanner-file-refused`; both installed artifacts +had become group-writable 0775, consistent with Kubernetes fsGroup volume +processing. The original trial remains failed in supervision; its original +proposal and receipt are retained, not rewritten as an unchanged success. +Revision 2 verified exact hashes/ownership and restored only 0755. The queued +Forge owner source push `ec1d7c5` then succeeded through the enforced hook. +Revision 3 adds an exact-image unprivileged startup guard, mounted only to the +existing security subtree, persisted in railiance-apps `50b66c4`. Six isolated +checks cover remount permissions, idempotence, wrong hashes, unsafe modes, +symlinks and recovery. Server dry-run and rendered source match; rollback removes +only that init container and explicitly repairs modes after remount. +Generation 13 completed the guard and passed real inherited native receive +checks: clean acceptance, intermediate-secret refusal, quarantine removal and +clean recovery. Builtin authorization is excluded in the temporary native probe; +the ordinary source push separately exercises authenticated SSH. A second +Kubernetes replacement reached generation 14 and repeated all those checks with +a different pod UID; both startup guards exited zero and both binaries remained +0755. Authenticated SSH source acceptance after that replacement is recorded +separately in the recovery summary. +Evidence: `forge-custody-repair.json`, `forge-custody-rollout.json` and +`forge-custody-restart.json` in the October 13 evidence directory. This resolves +an availability regression without weakening scanner refusal or widening access. + +2026-10-13 push compatibility closed: STATE-WP-ADHOC-2026-10-13-T01 is +finished/done in file and hub. State Hub `7183f59` (identifier projection commit +`f6839b5`) and Repo Manager `5a7e838` extend client push deadlines to 120 seconds +for the admitted server scanner's 90-second budget. Timeouts report unverified +remote outcome without retry or child diagnostic disclosure. Seventy targeted +tests and two real 65-second receive-hook acceptance/refusal sequences pass; +the installed State Hub packaged module matches source. Both owner projections +applied against exact pushed commits. Receipt: `push-deadline.json`. + +2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after +all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref +veto. The independent final read-only audit reconciles 167 repositories: 166 +admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All +23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership +markers remain. Each rejected synthetic commit was absent after its probe. +Repository 55 has four external submodules and remains required compatibility +work. Ordinary source acceptance is distinct from vetoed scanner checks. +Production HTTP/API/frontend acceptance remains unverified: the protected API +credential route failed before child handoff and the metadata-only capability +check denied access. Prepare one complete acceptance command for the existing +attended login window. CI, import/mirror, historical/LFS/log/artifact detection +and private response gates remain open; this is no whole-estate closure. +Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json` +and `forge-api-route-readiness.json`. + + +2026-10-13 authenticated-route preparation: FORGE6-ROUTES-001 revision 2 +binds a silent contained operation to one newly created private disposable +repository. The exact shared suite passes 27 isolated pinned-image checks: +creation/inherited hook, anonymous denial, HTTPS clean/secret pushes, API content +acceptance/refusal, merge-message refusal/clean merge, unchanged refs, quarantine +and owned cleanup. Five boundary tests cover changed ownership, ambiguous-create +cleanup refusal, generic-error non-acceptance, redirect credential protection, +and silent digest-bound credential handoff. Read-only live preflight passes +under a private HOME. The failed first rehearsal and source-binding limitation +remain recorded. No production API mutation or credential fetch was performed. +The existing attended-window command is ready for caller OIDC/MFA; live route +and session-revocation receipts remain required. Packet: Custodian +`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence: +`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`. + +2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping +from another pod reproduced the wildcard listener defect. Exact revision 2 of +FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps `706461b`, pinning the +same running images and restricting Docker to loopback with local exec readiness. +The conditional server dry-run and three patch tests pass. Generation 4 is Ready; +loopback ping succeeds, other-pod ping refuses and the socket table contains only +127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after; +resource requests and Recreate strategy are unchanged (node CPU requests 86%). +Fresh runner heartbeat is one second old. Normal source push `706461b` triggered +workflow 7251; host-smoke and container-smoke both succeeded. Receipt: +`docs/evidence/2026-10-13-netkingdom-security/forge-runner-post-change-ci.json`. The original revision-1 preflight is +retained; revision 2 corrects rollback verification for the observed dual-stack +wildcard. Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`. +This closes the reproduced listener exposure only. Host jobs still share the +privileged runner boundary; workflow authority, required detection checks and +job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04. + +2026-10-13 submodule reconciliation: the four declared URLs use the retired +forge NodePort. Two pins are reachable under their current canonical repository +names. The wiki and issue-facade names are absent; a read-only object search +across all 167 admitted-inventory directories found the issue-facade pin in +repository ID 13, but no copy of the wiki pin. Neither pin is present in the two +expected workstation submodule locations. This identifies further mapping and +recovery work; no repository content was fetched, changed or uploaded, and no +scanner exception was introduced. Receipts: `forge-gitlink-reconciliation.json`, +`forge-missing-gitlink-object-search.json`, `forge-gitlink-local-copies.json`. + +2026-10-13 KeyCape custody callers reconciled with existing RPF-WP-0040: +retired personal-admin token mint/refresh entry points and updated bootstrap +configuration to the scoped renewable factor credential mount. First creation +uses private literal inputs, captured diagnostics, stdin-only Secret data and +API create without last-applied annotations or replacement of existing config. +Signing keys are published privately without overwrite and retained on failure. +Legacy RSA/client-secret replacement rotations now refuse before mutation; +configuration-preserving rotation and retained rollback custody remain required. + +The old source failed 21 of 22 new regressions. Final bootstrap/KeyCape suite: +277 passed, 22 dependency-related skips; actual KeyCape Go loader/config and +credential-file adapter suites pass against generated synthetic configuration. +Failed verification preparations are retained in the receipt. No live credential +or deployment changed. NK-WP-0049-T02 remains progress: other callers, historical +object revocation, coordinated rotation and owner-scoped native recovery remain. +Evidence: `docs/evidence/2026-10-13-netkingdom-security/keycape-caller-reconciliation.json`. + +2026-10-13 remaining service generator repair: NetKingdom `b01a30b` replaces +PostgreSQL/privacyIDEA/LLDAP/Authelia shell sourcing, credential argv and raw +apply output with private literal parsing and captured stdin-only Secret writes. +Default apply creates or verifies exact matching fields; named rotation changes +only its allowed field. Patches bind UID/resource version/data, preserve unrelated +fields and remove last-applied copies, then verify returned API state. Authelia +retains its private first-bootstrap key and preserves existing issuer/hash state. +Batch apply suppresses child output; DB rotation includes the previously omitted +CNPG application Secret. The stale attended LDAP/KeyCape replacement path refuses +before mutation. Coordinated/native lifecycle acceptance remains open. + +Final unchanged-source suite: 366 passed, 22 dependency-related skips; native +local OpenSSL/bcrypt and kubectl stdin patch/stale-version checks passed without +a cluster. No live credentials or deployments changed. NK-WP-0049-T02 remains +progress for other diagnostics/bootstrap/SOPS callers and lifecycle requirements; +T03 remains its owner-scoped recovery gate. Evidence: +`docs/evidence/2026-10-13-netkingdom-security/service-secret-callers.json`. + +2026-10-13 SOPS write caller repair: NetKingdom `8f80857` removes Make/shell +argument execution before custody handoff, uses public-only encryption of private +untracked JSON/YAML, and replaces editor-based updates with explicit private +replacement input outside Git. Edit/rotate require the matching temporary key +and exactly the registered recipient; extra recipient metadata is refused. +Original MAC and replacement ciphertext are verified, encryption policy is +preserved, and child diagnostics/plaintext are suppressed. Source checks and +atomic ciphertext replacement do not provide isolation from hostile same-UID +writers. Data-key rotation is explicitly distinct from recipient migration. + +Final unchanged-source suite: 585 passed, one unavailable privacyIDEA module +skip; all real-SOPS cases ran. The initial expanded run's checkout-name failure +and missing sibling-schema skips are retained, then resolved by correcting the +test workspace without changing source. A pre-commit generic-key match on the +redundant public-recipient comment was resolved by removing that comment; parsed +configuration is unchanged, and the normal eight-blob scan passed. Executable +source matches the final test binding. NK-WP-0049-T02 now names the remaining +key-export, MFA diagnostic, LDAP and realm-repair callers plus the complete +inventory reconciliation; T03 still requires exact owner-approved native recovery. +No production custody key was retrieved and no live decryption, Secret write or +deployment change was performed. Evidence: +`docs/evidence/2026-10-13-netkingdom-security/sops-write-callers.json`. + +2026-10-13 continuation: privacyIDEA key export/recovery source repaired in +NetKingdom commit 1cbe00fd78e60ac70f2ea7957a0e1d7477388dcf. Export preserves the existing encryption/audit +keys, validates private custody and exact pod/PVC ownership, and conditionally +creates or verifies DR Secrets. Recovery now restores the actual stopped +application PVC; old Secret-only and unmounted-helper instructions are withdrawn. +The unchanged tested source passed 631 tests, zero skips; actual privacyIDEA +3.12.2 decryption and audit-signature continuity passed in a disposable local +environment. All 15 applied paths match the test binding. This is not live cluster +or off-host recovery acceptance. NK-WP-0049-T02 remains progress for remaining +callers/inventory; T03 remains wait for owner-approved native recovery. Receipt: +`docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json`. + +2026-10-13 continuation: bounded MFA-state diagnostic published in NetKingdom +`96feef46ab22811e3736231f04818655ca7b834e`. Removed retired Secret reads, insecure TLS, token argv +and raw provider errors. Explicit protected input, scoped token listing, inert +realm visibility proof before/after and complete counts distinguish confirmed, +pending and inactive factors. Real privacyIDEA 3.12.2 reproduces HTTP-200 empty +results after permission withdrawal; the diagnostic refuses them and accepts +permission recovery. Real self-service, tampered and expired tokens are refused. +Focused55 pass; full suite 1 failed, 685 passed, 4 warnings in 540.61s (0:09:00). One unchanged 50ms abort timing +assertion missed by 0.49ms; all46 tests in that module pass on unchanged rerun. +The original failure remains in the receipt. All nine applied paths match +the frozen test binding. KeyCape's workload delivery is not shared or expanded; +a live diagnostic needs separate owner admission. Native estate acceptance and +remaining LDAP/realm/inventory work stay open. Receipt: +`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`. + +2026-10-13 continuation: realm/bootstrap source repaired in NetKingdom +`30f0d2784018daa98e36e7c1042d4e2138a05a7c`. Reproduced old credential-file command execution +using a disposable marker; the replacement parses the same bytes literally. +Attended passwords stay in memory. Preview/explicit apply repairs missing core +configuration while preserving bind credentials, custom tuning, realm bindings, +defaults and owner-managed MFA policies; broad legacy policy replay is removed. +The console and guides use the supported flow, including fresh functional MFA +proof. Shared transport blocks unapproved origins, redirects/proxies and raw +error propagation. Actual privacyIDEA 3.12.2 proves minimal resolver updates +preserve omitted fields, correcting the old general replacement claim. +Frozen source passed all 723 tests with zero skips; four upstream deprecation +warnings. All 16 committed blobs match the test binding. Native/PTY/regression +receipts and limits: `docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json`. +No live provider or credential change. Remaining LDAP/incident-cutover callers, +full inventory and owner-approved native recovery keep NK-WP-0049 and G08 open. + +2026-10-14 legacy LLDAP lifecycle callers retired in NetKingdom `84c5dbe`. +Three shell helpers refuse before argument/credential processing or external calls; +Make targets no longer expand user input and console commands refuse before +metadata loading/delegation. Blank lifecycle worksheets no longer prefill successful +checks; existing validators reject unfilled templates. Ordinary onboarding now +points to existing User Engine/identity-provisioner contracts, while platform-root +and recovery remain separate owner procedures. Historical receipts are preserved +and older assessment snapshots explicitly superseded for this tooling. + +Eleven corrected-baseline regressions fail on old source; 28 focused and 76 total +affected tests pass with no skips. All 21 applied source files match the tested +manifest; five changed shell files pass syntax checks and the normal secret scan +is clean. Receipt: `docs/evidence/2026-10-14-netkingdom-security/legacy-lldap-retirement.json`. +No runtime/account/credential changed. Group bootstrap, membership management, +verify-t07, incident-cutover callers, complete inventory and native independent +recovery remain open under NK-WP-0049; G08 and this task remain progress. + +2026-10-14 provider boundary follow-up: NetKingdom `e861f63` reserves +`net-kingdom-` platform groups in the existing service-group request validator. +Prior source rejected `netkingdom-` suspension names but accepted the actual +platform users/admins namespace. Six regressions reproduce reaching directory +login from both ensure/revoke before repair; all 45 provider tests pass afterward. +Mixed requests and delete-if-empty also refuse before login. Receipt: +`docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json`. +No rollout or live directory mutation; exact owner deployment and native checks +remain necessary before claiming live enforcement. NK-WP-0049 stays active. + +2026-10-14 LDAP group caller reconciliation delivered in NetKingdom `ab25dde`. +Bootstrap, membership and T07 wrappers now reuse provider operations and literal +private custody through one adapter. No executable credential sourcing, ambient +password fallback, credential argv, curl/kubectl or KeyCape config Secret read. +Bootstrap only creates missing empty fixed baseline groups; service membership +requires exact existing identities/groups and refuses reserved namespaces. +Preview/apply binds origin, operation, target and observed state; fresh prewrite +and final exact readback preserve unrelated data. Owner-controlled exclusive +maintenance remains necessary because LLDAP has no cross-query CAS; partial +failures require reconciliation, not blind rollback. + +Three old-source regressions failed; all 200 affected tests pass without skips. +An actual isolated local immutable LLDAP image passed preview, preservation, +idempotence, add/remove, reserved/stale refusal and T07 incomplete-exit checks. +The synthetic fixture/container/private files were removed. T07 is explicitly +structural-only (exit 2), not lifecycle/login/recovery acceptance. Receipt: +`docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json`. +No live estate change. Incident-cutover/full inventory and owner-approved native +recovery/estate acceptance keep NK-WP-0049 and G08 open. + +2026-10-14 bounded incident resolver source repair completed in NetKingdom +`4dffe2f`. Both helpers now use attended memory-only input, scoped shared +transport, configuration/target-bound preview, one minimal password update and +native candidate/stored LDAP bind verification. Full reconcile pins cluster +identity/readiness, validates discovery, exact user and token-backed MFA, and +records missing predecessor evidence as incomplete. Raw notes, temporary secret +files, ambient endpoint overrides and default-overwriting writes are removed. + +Validation: 171 affected tests pass, plus disposable real privacyIDEA 3.12.2 and +LLDAP demonstrate bind refusal/replacement, preservation and actual HOTP. The +initial one-test fixture failure is retained; cluster/KeyCape gates are substituted +only in the native fixture, with production acceptance explicitly unverified. +Source docs/inventory and NK-WP-0049 are updated. Evidence: +`docs/evidence/2026-10-14-netkingdom-security/resolver-cutover.json`. +No live cutover or privileged credential retrieval. Full caller/root-output +inventory keeps T02 progress and owner-native recovery keeps T03 wait. The broad +consolidation goal remains cleared; this finishes only the requested current +resolver-helper task. Playwright T05 retains its existing owner-return gates. + +## Verify native closure against every requirement + +```task +id: CUST-WP-0080-T04 +status: todo +depends_on: [CUST-WP-0080-T03] +priority: high +state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" +``` + +Verify G01–G13 against current source/runtime receipts and the individual SEC-DSM +requirement ledger. Existing owner integration, attendance, residual-promotion +and recovery gates remain effective. Mark finished only when all required gaps +are verified closed or covered by complete actually approved exceptions; plans, +source-only tests and owner handoffs are not closure evidence. + +## Coordinate self-service Playwright identity delivery + +```task +id: CUST-WP-0080-T05 +status: progress +priority: high +depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] +state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b" +``` + +User-requested addition on 2026-10-13. Accountable coordinating owner: +**the-custodian / custodian-codex**. Accept incoming request +`1b279bad-a159-43da-8709-1167882e62f8`; retain Platform's RPF-WP-0056-T03 +live acceptance and RAPP-PLAYWRIGHT-WP-0004-T01/T03 provider acceptance. +Delivery tracking: `infra/security-flow/playwright-delivery.json`, a cross-owner +case attached to these existing plans; no duplicate implementation plan. + +The pilot and namespace RBAC are delivered. Real human/agent authentication, +per-caller API transport, one-command trial, renewal/revocation and native +acceptance remain. All identified platform humans and coding agents already +qualify; no further membership decision is requested. The coordinator owns +collecting exact owner task/revision returns, resolving dependency gaps and +checking delivery evidence, not approving another owner's implementation. + +First executable milestone: review the prepared registration/authenticator +candidates with their existing owners, obtain their source task/revision and +rollback references, and document a supported transport for one real human and +one registered agent. Registration and governed custody (KeyCape/NetKingdom/ +Platform), native JWT authenticator (railiance-cluster), and per-caller transport +(ops-bridge/cluster) converge before Platform's integrated consumer command and +real human/agent trials. Existing request IDs and unaccepted owner returns are +preserved in the case; missing task IDs are explicit gaps, not invented commitments. + +Close only after Platform and provider accept native positive/negative identity, +permission, browser, lifecycle and recovery receipts, supported consumer docs, +and the maintained managed-availability discovery update. Message delivery alone +does not close this task. No new access gateway, shared administrator kubeconfig, +shared workstation SSH identity, or broader target/permission grant is required. + +2026-10-13 provider recovery return accepted for coordination: +`a2449fe0-ba12-47b8-9ca3-d7deedc089c3`, rapp-playwright commit +`2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. Reviewed committed local/managed +SIGKILL, partial-artifact cleanup, completed-hash preservation and fresh browser +trial receipts, including the initial transport failure. Same-image abrupt +recovery is delivered; no crash was repeated by the coordinator. Case references +and dependency wording now retain the narrower live gap: exact registration, +custody, native JWT authenticator and per-caller transport owner revisions, then +real human/agent trials and managed acceptance/discovery. Cross-version rollback +remains explicitly unproven in provider T01. No foreign task status was changed; +this task stays progress and no membership decision is reopened. + +2026-10-13 NetKingdom registration dependency advanced: `5dd74df` accepts the +actual implementation request in NK-WP-0050. T01 delivers the exact public +loopback/custom-scope and per-agent registration compiler using existing registry +merge operations. Nine new and 64 existing registration tests pass; native +KeyCape config/startup and generated token/JWKS exchange checks pass. The broader +159-test run retains two unchanged short-window failures; all seven tests in that +module pass unchanged on rerun. Receipt: `playwright-registration-preparation.json` +in the October 13 evidence directory. Case now links NK-WP-0050-T02 for governed +custody and guarded activation, with T03 awaiting actual issuer/consumer receipts. +No browser-case admission, custody grant, real identity trial or live rollout is +inferred. Other identity/authenticator/transport owner returns remain missing. + +2026-10-13 registration activation preparation published in NetKingdom +`eba6e1f`: single-Recreate stop/configure/resume sequencing, native verifier pin, +private proposal digest and exact object/data/spec conditions, pod-quiescence +checks, readback and original-state rollback now have 90 passing focused tests +with no skips plus native synthetic KeyCape startup checks. Follow-up `276b95f` +refuses reproduced implicit-audience and aliased-Secret collisions; both new +regressions failed before repair and pass afterward. Pre-existing clients +and bindings survive rollback; intervening drift refuses stale replay. +NK-WP-0050-T02 is progress. The module has no live CLI or Kubernetes connection; +protected executor/recovery-state integration, admitted identity/custody, exact +current image/cluster and supervised live acceptance remain open. Receipt: +`playwright-activation-preparation.json` in the October 13 evidence directory. +No live credentials or deployments changed; this does not close consumer delivery. + + +## Establish the target architecture and drive the restructuring + +```task +id: CUST-WP-0080-T06 +status: progress +priority: high +state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29" +``` + +Founder implementation request, 2026-10-16. Document the optimized target and +coordinate GPT-6.1-Sol medium agents against the existing owner work. Delivered +`docs/netkingdom-target-security-architecture.md` with sixteen scope-specific +acceptance gates and `docs/netkingdom-target-implementation.md` with ownership, +dependency and evidence rules. First dispatched source work: Secrets Engine +decision authentication, Platform durable cleanup, NetKingdom first-case +compatibility. Exact handles and artifact locations are in the implementation +record. Documentation link/ID checks pass. Implementation and native acceptance +remain open; this task closes only with the target's exit condition and T04 +requirement audit, not with the first source wave. + +2026-10-16 source wave published across eight owner repositories: NetKingdom +`c31d21ba`, Warden `95835208`, Glas `7357115c`, Platform `59d1441c` / `99fd21ee` / +`d042d468`, Secrets `c80a9441`, Access `ec21518e`, Approval `477c6839`, and Mason +`57411f25`. Independent reconstruction tests, actual disposable OpenBao/bwrap +checks and local Access serve-to-Secrets signature verification passed at their +bounded scopes. Exact revisions, failures and publication caveats are recorded in +`docs/changes/netkingdom-target-2026-10-16/source-wave-status.json` and its +coordinator review. No production trust, credential or runtime admission changed. +The subsequent source packages integrate Secrets packaging (`ebca4f5`) and strict +task authorization (`ff1a13d`), Platform journaled consume/confirm/effect +(`e2b832b`), and Approval canonical confirmation (`eece796`). Independent +verification passed 133 combined Secrets checks, seven packaging checks, all 130 +Platform checks and eight final mediator checks with the repaired Approval client. +The actual local provider path uses synthetic admission; the real task policy +still denies. Exact native expected-state readback/recovery and governed +package/key/caller admission are next. All sixteen acceptance gates remain open. + +2026-10-16 next source integration: Platform `d870596` adds exact committed +metadata baseline/readback and separate cleanup confirmation (32 independent +tests). Access `919ce25` adds exact native receipt checking and workload/audience +preparation (nine receipt and two runtime-twin tests); Secrets `5a2099f` records +native CLI/trust preparation and the 11-site/10-handler denominator, with zero +native effect acceptance. Approval `3485415` provides the shared owner Go claim +adapter (14,114 independent actual Python byte/digest comparisons); Access +`4f6946b` adds the real service caller HTTP join and generic task bypass refusal. +Exact commit/publication receipts retain State Hub timeouts and scanner results. +Trusted v2 source, strict consumer successor, authenticated process-loss cleanup +recovery and signer custody are the next reviewed packages. Old positive stack +proof remains pinned to Access `ec21518e`; it does not validate the new task path. +No native gate, live grant, deployment or credential admission is closed here. + +Platform `b9eaa20` adds independently admitted process-loss cleanup recovery after +53 passing root tests. Root review required exact absence semantics and capsule +integrity; failures and revised proof remain retained. Lost token issuance without +persisted accessor and actual custody/isolation remain open. Trusted successor +source passed the full Access Go suite and 176 focused Secrets tests, but actual +whole-stack work found incompatible time budgets and retained-registry digest +correspondence. Owners are repairing those contracts before successor integration; +no empty-registry shortcut or timing waiver establishes acceptance. + +2026-10-16 coordinator checkpoint: all six subsequent canonical receipt file hashes +match their owner commits and every commit is an ancestor of origin/main. The +actual immediate-consumption path also exposes whole-second Approval receipt +precision against fractional decision start times; owner resolution is required. +Access, Secrets and Platform continue the retained-registry end-to-end repair. + +Coordinator independently reproduced expired fractional Approval consumption +against canonical `3485415`: expiry .500, actual clock .750, consumed_at .000. +Owner repair is part of the protected-operation gate. NK-WP-0049 now supplies +actual independent identity archive recovery evidence; remaining service +authentication, token decryption and audit continuity are still required. + +2026-10-16 successor source integration: Access `2b064ee` and Secrets `4dd004a` +now preserve producer-evaluated approval facts and exact numeric types across the +retained-registry join. Approval `d40e842` fixes fractional expiry with a single +post-lock instant; the original counterexample and scanner refusal are retained. +Platform `76fdc0b` adds absolute budgets; `7be8b6e` supplies the complete successor +proof and bounded signer custody source. Root independently passed seven affected +Go packages, 193 Secrets tests, 98 Approval tests, 28 budget tests, eight complete +provider-to-OpenBao cases and twelve disposable signer tests (overlapping suites, +not an estate coverage score). Native issuer/key/grant/deployment/audit gates stay +open. Access outbox process locking and capacity limits, Platform exact native +writer preparation, and Secrets immutable release/install proof are active owner +follow-through. No existing PVC or managed-package identity is assumed. + +2026-10-16 next checkpoint: Access `0a05383`, Warden `d79f065`, Secrets `3718e60` +and Platform `a3e8eb6` published through normal owner synchronization, with exact +committed-file hashes independently verified. Installed Warden routing now selects +the required attended admin lane and retains phase-memory. Root checks passed +Access race/chart validation, 135 routing tests, 56 phase-aware signer tests and +clean reproducible Secrets bundle installation. Original failures are retained. + +Canonical local package `rapp-flex-auth-secrets-engine` now has reviewed commit +`d52f811`, exact tree and local owner/workload resolution; it remains draft with +no remote or native admission. The ordinary Access publisher failed after pushing +source `0a05383` because Python was absent on its runner. Reviewed source repair +`84c78e0` uses Bash/Docker metadata validation and records the package reference; +normal source synchronization and successor CI observation are underway. Audit +`64509d2` specifies existing-API reconciliation against a complete independently +retained producer ledger, with independent contract tests. Its sender/cadence and +operational observer gates remain open. Platform prepared exact custody source +pins and distinct missing owner inputs; no approval or native scope was invented. +All sixteen target gates remain open pending scope-matched native acceptance. + +The ordinary successor publisher run402 and both smoke401 jobs succeeded for +exact `84c78e0`. Root independently verified public commit statuses, the unique +registry digest `sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f` +and explicit source revision label. Exact rollout values, stopped/ready source +renders and Platform projection are prepared separately from native evidence; +consumer pre-key trust and custody P2 remain proposed. Checkpoint `fa0fc15` +published and synchronized 89/89 with no failures; generated-only writeback was +refused without bypass. Original failures and all native gates remain retained. + +2026-10-16 source simplification checkpoint: Access `dc04202` adds exact zero/one +writer Helm maintenance states; Platform `84c529f` separates runtime/storage +review from GitOps ownership. Both are published with normal sync receipts and +exact committed-file hash verification. Independent checks cover 86 actual Helm +renders plus existing outbox tests, 45 Platform native/preparation tests and 54 +overlapping cluster custody tests. Focused CCR0050 validation passes; unconfirmed +claims and unrelated baseline CCR0035 errors remain. The initial public-digest +scanner refusal is retained; typed OCI metadata passed the unchanged scanner. +Cluster own-review record `RCLUSTER-WP-0017` was published at `523669f`; the source +role correction received a bounded owner review. Its prefix warning conflicts +with ADR-007 because the checker infers the retired prefix from historical files; +the correct IDs and assigned UUIDs are preserved. Successor rollout/custody packets are being +prepared. No custody, deployment, trust, storage or protected effect occurred; +all sixteen target gates remain open. + +2026-10-16 source preparation successors: exact rollout R2 and custody P4 now +join published chart `dc04202`, image source `84c78e0` and Platform `84c529f`. +Root reproduced frozen Helm outputs and passed eight packet assembler tests; +P4 corrects preserved P3 ownership prose without changing executor or scope. +Cluster's own T01 source review is complete; its native T02/T03 remain open. +Stopped Helm uses explicit bounded fence verification without PVC waiting or +automatic restart of the running predecessor. Founder identity, expiry, actual +held window, approved CCR and native dispositions remain unresolved. Checkpoint +`50de8be` published and synchronized 89/89 with zero failures. No target gate is +closed by these source preparations. + +2026-10-16 native preparation: coordinator public-metadata observation and exact +seven-resource server dry-run passed on the verified railiance01 target at +18:53 UTC. API admission retained the frozen stopped projection and replicas zero; +the actual release remains running at Helm revision four. No persistent mutation, +held writer fence, credential/custody action or native activation occurred. +Reviewed wrapper, exact payload and actual receipts are retained under +`docs/changes/netkingdom-target-2026-10-16/native-preflight-r1/`. +Parallel owner work now integrates the workload-only combined runtime and native +registry parity checks, with independent Secrets preparatory-package selection. +All sixteen target gates remain open; this is progress toward their native +acceptance rather than a reduced completion criterion. + +2026-10-16 owner checkpoint: Access `d328a260` and Platform `08c1f036` +published independent bounded rollout reviews, separating initial rollout/CCR +authorization from final one-use custody assent. Secrets `a4f1802`/`5356810` +selected and recorded the actual inert local package installation; all ten catalog +rows and empty-key refusal passed without caller/socket access. Rein `9b88cad` +published the combined runtime lock; the actual isolated manager proof passed and +the coordinator independently rehashed all 1447 artifact records unchanged. +Five owner commits and their public evidence are bound in +`docs/changes/netkingdom-target-2026-10-16/source-wave11-coordinator-review.json`. +None establishes live signer/caller admission, an accepted protected effect, +actual interactive-assignment migration or completion of a TSA gate. + +2026-10-16 continued implementation: NetKingdom `015694ee` fixes disagreement +between JSON schema and Python validation of exact machine-descriptor pins; +the coordinator independently passed 21 new tests and verified committed files. +Reuse `dd00b27` strengthens the existing mandatory parity validator; corrected +NetKingdom/Bootstrap indexes are published. Forced hosted composition at 19:25 +returned all 70 reviewed capabilities exactly once with correct owners and both +corrected descriptions/tags. KeyCape `3c71226` reconciles the already-deployed OTP +help link and names the actual remaining attended recovery steps. Independent +NetKingdom recovery evidence now accepts retained token-material decryption and +historical audit signature continuity (T20/T31), while real MFA and service +continuity remain open. Exact owner commits and receipt scope are recorded in +`docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json`. +Separate GPT-6.1-Sol medium owner agents are implementing the missing browser +registration and isolated KeyCape recovery adapters in temporary candidates; +neither candidate is admitted for native execution. + +2026-10-16 checkpoint publication: `cf59a5f` and `5a50901` published the reviewed +native preflight, independent owner plans, inert installation, combined-runtime +proof and follow-up owner/discovery evidence. Both normal reconciliations synced +89/89 bindings with zero failures/automation errors; seven background warnings +and four informational findings remain. Original staged brief bytes/index and +unrelated work were preserved. The initial public-hash scanner refusal was +resolved by typed hash metadata without changing values or bypassing scanning. +Warden `d97652a3` subsequently refreshed its reviewed producer pins; coordinator +verification passed 87 actual integration/refusal checks without pin overrides. +The registration adapter independently passed 36 source checks after binding the +checker executable into its descriptor, and was published at `0775c2bf` with exact +source-file equality independently verified. Normal owner synchronization +reconciled all 16 task records, with four assigned UUIDs and publication evidence +retained in owner `0394484`. All three normal passes returned zero failures and +automation errors; generated-only hook refusals and 25 final warnings remain. +No native checker/callback/identity was admitted. +Recovery adapter revision three independently passed 52 synthetic checks, with +all 14 dependency hashes verified. Exact daemon routing and early plaintext +cleanup registration are corrected; the remaining cleanup-versus-parent-lifetime +race requires a successor before canonical integration or native proof. +All sixteen target gates remain open. + +2026-10-16 continued artifact/runtime review: coordinator reproduced the exact +KeyCape checker executable from published source with all declared source, +toolchain and module hashes verified; eight real-checker/helper/kernel fixtures +pass. Separate KeyCape owner review is underway. The existing NetKingdom caller +needs explicit checker environment and executable-path containment. Recovery R4 +passed 61 independent checks, including disposable deadline/hard-parent-loss +processes, but a reproduced nonzero-Docker uncertainty gap requires a successor. +Native pinned-image fixture preparation continues with policy-lock write access +limited to temporary policy data. No actual credentials or native acceptance +were exercised. Checkpoint `86a5b0d` published and synced 89/89 with zero failures +and seven background warnings; original staged brief and unrelated work preserved. + +2026-10-16 founder-requested pause: stop after current normal publication and +checkpoint sync. NetKingdom `916ba4b` publishes deterministic checker environment/ +path selection, with 39 affected and 11 real-artifact checks independently passed; +KeyCape `834b0d0` publishes its bounded owner review. Recovery R5 passed 67 source/ +process checks, but the actual disposable Docker positive fixture failed before +native verification. All registered resources/plaintext were removed and absence +independently checked. Retain the failed receipt and exact frozen R5; diagnose +before another trial. No actual credential recovery or target acceptance was +claimed. Full resume points and outstanding native gates are in the implementation +record's requested-pause section. Workplan tasks stay open; pause is not completion. + + +2026-10-16 explicit resume: GPT-6.1-Sol medium agents resumed recovery, browser +source and independent target-audit lanes. Browser immutable checker snapshot +passed 49 source and 12 real-artifact integration checks independently, then the +exact five-file patch was applied to the NetKingdom owner checkout. Owner +publication remains a separate receipt. R6 recovery preserves the anonymous-volume +refusal while masking the pinned helper image's declared volume with bounded +tmpfs; 72 checks and the first actual synthetic Docker positive passed. Original +TLS/signer, native service allow/deny, stored bytes and cleanup passed; real +owner-held recovery and all sixteen target gates remain open. Independent +scheduling prerequisites prove host report/hub access but fail the selected rein +startup readiness check. Full evidence and next acceptance steps are linked from +the implementation record's resumed-implementation section. + + +Resume follow-through: all four synthetic R6 native Docker cases passed, including +exact process-loss/deadline quiescence and retained uncertain-response refusal. +Host-device-bound independent checks retained the three reaper outcomes and +confirmed every exact resource/plaintext absent. The sandbox's separate tmpfs +initially hid those receipts; that observation failure remains recorded. +Recovery source is integrated; publication encoding R7 preserves runtime bytes, +uses typed public checksums after a retained normal scanner refusal, and passes +73 checks. NK-WP-0049-T32/T33 separate delivered source proof from preparation of +the real owner-held attempt; T18 remains open. Browser source8790dd18 and record +85a54ab are committed, with19 projected owner tasks matching. Actual local scanner +baseline and refusal cases completed with temporary fixtures removed. Two model +workers hit their usage limit after completed commands; coordinator verified the +receipts and continued integration. No native target gate or rotation deferral +changed; the full goal remains active. + + +Recovery source publication verified at `5fcd5952`: all eight added files match, +all33 projected tasks agree (T32 source proof done, T33 preparation todo, T18 +actual recovery wait), normal sync has zero failures/automation errors and30 +warnings, and the original staged/working brief is preserved. Full frozen fixture +packets remain workspace-local; canonical owner source, published independent +host cleanup/reaper evidence and the canonical integration receipt retain the +bounded delivered result. The target-wide goal remains active. + + +2026-10-17 source implementation follow-through: coordinated GPT-6.1-Sol medium +owner agents delivered group provenance/recovery source (`4f65e41`, NetKingdom) +and bounded staged-scanner batching (`83c521b`, Repo Manager). Independent canonical +runs passed 65/111/42 checks respectively. Actual disposable LLDAP passed 14 oracles +with independent exact-resource cleanup; four generated cases passed through the +configured shared/Custodian hooks using alternate indexes. Thirteen old/new scanner +parity cases match. The 16/64 small-blob medians improved from 12.065/49.172 to +0.884/0.904 seconds; one small blob slowed. These are bounded local results. + +Review corrected production SQLite-volume advice before publication: ADR-0015 +requires CNPG/rapp-postgres or an explicit governed exception. SQLite remains +local/disposable. NK-WP-0048-T20 records delivered preparation; T14 retains native +storage, scope, writer fencing, callbacks, evidence and revocation. NK-WP-0049-T34 +records sealed-custody/preflight source; T35/T36 track original TLS/registration +bindings, T33 readiness and T18 actual recovery. Public source identifies the +railiance-cluster ingress/backup boundary and a historical secrets-engine-openbao +selector without current assent or private reads. RMGR-WP-0021-T05 stays progress +because actual-hook unavailable-scanner acceptance remains pending. All sixteen +target requirements stay open. Publication/task-projection/preservation checks: +`docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/`. +No rotation, live deployment, actual key recovery or authority promotion occurred. + +2026-10-17 continued verification and owner refinement: NetKingdom `70f408ca` +publishes the PostgreSQL provenance backend and real-SOPS regression successor. +Canonical provisioner tests pass 82. The actual disposable PostgreSQL trial passes +21 oracles, including restart/revoke, same-counter divergent forks, lost replies +and dump/restore rollback refusal; all exact resources are independently absent. +LDAP remains synthetic in this SQL fixture. Failed R2/R3/R4 returns are retained; +review repaired a real nested receipt-reference bug and two fixture snapshot +defects. NK-WP-0048-T21 records completed source/SQL proof; T14 retains actual +CNPG, owner callbacks/checkpoints/custody, all-writer fencing and native admission. +NK-WP-0049-T37 records all 65 actual SOPS cases (61 previously skipped plus four +sealed-FD cases); historical T34's skipped result stays unchanged. Actual recovery, +TLS/trust, registration/private admission and MFA remain open. + +Repo Manager `9ebde0a9` completes only RMGR-WP-0021-T05 after ten fixture checks, +six actual configured-hook cases and exact hard-loss cleanup pass. Five projected +task bindings and remote HEAD match; T03/T04 and TSA-10/15 remain open. +Secrets Engine `c59bbf56` publishes SECRETS-WP-0015 with four exact projected task +bindings and both dependency edges. RCLUSTER-WP-0018 source is prepared but remains +unpublished behind the correct immutable-history guard. Do not replace the three +historical parent or 15 task UUIDs to force publication. + +State Hub receiver `51bc70d1` and source-only dry-run repair `086d79a2` are published +and authoritatively projected. The CI image digest and selected receiver/migration/ +hub-core files and 86 package metadata entries are independently verified without +executing or installing the image. Ten disposable actual SQL migration/old-write +compatibility oracles pass; production migration timing/full application behavior +remain unproved. The real server dry-run now passes with server-side dry-run for +the two Secret templates and the existing annotation policy intact. The full +rollout includes the inbox migration already on main; Helm rollback retains that +schema, and its timeout does not automatically stop a running migration Job. +Final exact values-preserving review and scoped founder rollout approval remain +separate. Keep the registrar guard until receiving is delivered and verified. +The one unresolved projected STATE95 dependency deliberately points to the +not-yet-admitted RMGR19 successor; it is not permission to activate it early. + +Evidence: `docs/changes/netkingdom-target-2026-10-17/`, the exact published owner +sources, retained fixture revisions and the implementation record. All sixteen +native target gates remain open; no production rollout, private recovery, +credential rotation or autonomy grant occurred. + +Final checkpoint: the exact packaged-chart, digest-pinned reuse-values server +dry-run passes with eight identities and only three image changes. Revision 4 of +`STATE-WP-0095-T06-cluster-frozen-receiving-r1` is recorded as pending in the +existing supervision record, preserving the original revision/digest, adverse +preparation history and all authority fields. The final proposal explicitly +includes the inbox migration and conditional exact-Job recovery, with unpriced +EUR exposure and unknown mapping requiring attended owner recovery. No live +action is approved or executed. Four coordination receipts attach foreign waits +without messages or worker wakes. Source/remote/Hub readback verifies 66 new +checkpoint owner bindings plus the nine Repo Manager/Secrets bindings; source +counts and native acceptance remain separate. + + +## Approved receiver execution, 2026-10-17 + +This checkpoint supersedes the pending-rollout state recorded above. The founder's +“good, go ahead” approved exact revision 4 of +`STATE-WP-0095-T06-cluster-frozen-receiving-r1`, digest +`63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32`. +Decision `e3798419-8aa9-5425-8c08-20df6bd82a19` records +`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` for that +proposal and its exact conditional recovery, with no autonomy grant. + +The owner Helm upgrade succeeded as revision 76. API and MCP are Ready on the +approved image digest `c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015`; +primary/railiance01 reports applied and expected schema `c4d5e6f7a8b9`. +Delivered historical projection module hash matches the reviewed image. Full-row +hashes and column sets of all three historical workplans and fifteen tasks are +identical before and after deployment. Five actual native receiving cases pass: +preserve, foreign holder, missing task, nonterminal parent and nonterminal task. +Every probe rolled back; zero commits and a fresh-transaction full-row comparison +confirm preservation. Helm succeeded and the migration Job disappeared after +its exact UID and owned Pod were observed; no Job Succeeded event is claimed. +No recovery was needed. The exact owned staging archive/directory was removed. + +Only after these observations was the frozen seven-file registrar source applied. +Canonical focused checks pass 47; the actual read-only Cluster allocator preview +proposes exactly seven missing UUID fields in the new WP0018 and one existing +ADHOC task. Fifteen invalid historical labels and five collisions remain reported; +no archive rewrite, direct database UUID repair or broad syntax exception occurred. +Owner publication and receiving follow-through are recorded separately below. + +Evidence: `docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json` +and its hash-bound actual native receipts; registrar source/application and preview +receipts in `registrar-followthrough-r1/`. The same original supervision trial +retains all preparation revisions and failures; accepted-revised execution earns +no unchanged-success credit. All sixteen native target gates remain open. + + +## Ordinary Cluster publication and retained acceptance failure, 2026-10-17 + +Cluster owner commit `c562d7134c38679952a8ffd17a8a893a900aef0d` is published and +reconciled on primary/railiance01 at the exact expected/derived revision. WP0018's +five task ID/UUID/status bindings and three internal edges match source and the +remote. Exactly seven missing fields were assigned by the normal managed path, +including one existing ADHOC task field. All three frozen archive hashes remain +unchanged, and original staged/dirty generated files were restored exactly. +Registrar source admission `70cd7549` is published and verified, with T05 done; +source preparation and actual Cluster acceptance remain separate outcomes. + +The stronger full-row guard FAILED after the required legacy deep consistency +pass: the three historical parent hashes changed, while all fifteen task full +rows remain identical. The native forge projection reports preservation, but +that does not establish preservation for the whole pipeline. Source review found +that `PUT /workplans/index/bindings` writes backing fields and a new sync timestamp +without consulting the frozen-history guard; ORM update timestamps also advance. +The checker calls this route even during checks. Only whole-row baseline hashes +were retained, so exact changed columns/values cannot be reconstructed from the +baseline. No guessed timestamp or database restoration is performed. + +This later failure does not erase the earlier passing rollout and rollback-only +probe results. It prevents RMGR-WP-0019-T06 and STATE-WP-0095-T07 completion. +The existing State Hub owner record carries the source guard and regression +follow-up plus its separate reviewed runtime-delivery obligation. Source edits, +fixtures and successful publication do not stand in for that new native return. +No further production rollout is authorized by the earlier revision-4 approval. + +Evidence: `docs/changes/netkingdom-target-2026-10-17/cluster-publication-readback.json`, +`railiance-cluster-projection.json`, and +`receiver-rollout-r4/ordinary-pipeline-preservation-finding.json`, including the +retained `post-publication-full-row-hashes-FAILED.json` and exact archive checks. +All sixteen native target gates remain open. + + +## Verified installed-client repair and exact runtime successor, 2026-10-17 + +State Hub source guards and real writeback regression are published through +`c103cbf3c8bed5dba87a03e320595ddded9301a3`; the later WP-only checkpoint is +`9eaa36143ea18111c522ea14d32978495b4e5030`. Canonical guard checks pass 102, +independent review passes 109, and five actual disposable Git checks verify +file-scoped commits with unrelated staged/dirty state and hook refusal preserved. +Normal chart rendering and classification checks pass. The first attempted +client rerun loaded an older installed package and failed again; its actual +receipts stay retained. The installed owner package was then refreshed and its +loaded checker hash verified against R6 source before the next run. + +The corrected actual ordinary Cluster maintenance passes: 20/20 ordinary +bindings, three frozen bindings omitted, and all eighteen CURRENT full-row +hashes unchanged before/after. Original failed parent hashes are not restored +or relabeled as successes. The old writeback helper also included an unrelated +staged brief during legitimate C23 activation. Forward correction +`6ae3f847c83da3402883453ee7110457bfb2d0d6` preserves active WP18, restores the +prior committed brief, and reinstates its exact original staged/worktree bytes; +dirty WORK-RECORDS and archive hashes are preserved. No history was rewritten. +Repo Manager `1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd` retains T05 done/T06 wait +and projects T06's actual dependency on STATE-WP-0095-T10. State Hub T07 also +waits on T10; all ten own task UUIDs remain exact, T09 done/T10 human wait. + +The normal CI guard image at +`sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1` +is inspected read-only against runtime source `c103cbf`. Selected guard/receiver/ +migration/build files match; package metadata and hub-core source hashes equal +the deployed image's observations. Exact pinned-package reuse-values server +dry-run passes eight identities and only three image changes. Fresh explicit +target/headroom/schema checks pass. The prepared eight native cases enforce +commit interception and rollback; their actual schema/interception contracts +are checked without a DB connection, but these new native cases are not executed. + +Exact successor `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 1 is pending, +metadata digest `81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932`, +decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. It requests scoped new-image +approval, current-baseline acceptance with the old failure retained as an +exception, and exact conditional recovery/rollback to Helm 76. Unknown EUR +cost/risk or Job/DB mapping is not a free or bounded exposure. The prior +revision-4 approval does not approve this successor. Current runtime remains +healthy Helm 76 on the approved `51bc70d` image; no new API guard delivery or +native security-gate closure is inferred. The original supervision record +retains successful earlier-stage execution plus later failures; its new request +is pending/not executed and grants no authority. + +Evidence: `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/`, +`receiver-rollout-r4/before-verified-client.json`, `after-verified-client.json`, +`verified-loaded-client.json`, `verified-client-cluster-consistency.json`, +`verified-client-cluster-projection.json`, the exact owner publication packets +and `rollout-owner-bindings.json`. The original receiver/registrar case is +satisfied; the successor attaches to the existing retirement driver and stops +at the human gate. TLS metadata work remains an owner wait. No worker was woken. +All sixteen native target gates remain open. + +The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained. + +The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`. + + +## Approved API guard delivered and verified, 2026-10-17 + +The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2, +SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, +through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned +`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1` +image is delivered at Helm 77. API and MCP are Ready; applied/expected schema +remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone, +and only the verified owned chart staging was removed. No recovery was needed. + +All eight deployed owner-handler cases passed with enforced commit interception, +rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline +passes with the verified installed checker: 20/20 ordinary bindings, three frozen +bindings omitted, and all eighteen CURRENT historical full rows unchanged across +the rollout, native probes and maintenance. All three frozen archives and +unrelated staged/worktree state are preserved. The earlier three-parent mismatch +remains a founder-approved historical exception: unavailable old preimages were +not guessed, restored or relabeled as a passing result. Runtime acceptance is +separate from all sixteen NetKingdom native target gates, which remain open. + +Frozen acceptance return: +`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`, +SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`. +The supervision record retains original revision 1, the approved/executed revision +2, exact digests and successful refined outcome; it grants no autopilot authority. + +Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken. + +## Source-owner follow-through and native preparation, 2026-10-17 + +NetKingdom `c52ca7f405416d437951844c0640b86e677c3523` publishes the exact-one +original client selector guard, four early-refusal regressions and the scoped +unexecuted fixture-manifest successor. Root independently passes those four +checks; the owner's 39 adapter checks and four affected manifest checks pass. +The prior stale-hash refusal and original frozen native receipts stay retained. +This guard acts after decryption and before further runtime inputs; it supplies +no archive/TLS/consumer/native acceptance. NK49-T38 records this completed source +outcome. NK48-T22/T23 record the distinct registration and storage owner reviews. +All 58 old task blocks are preserved; 61 actual source/remote/primary task +bindings and active internal dependencies are verified after normal publication. +Initial overly broad historical-edge verification refused; the corrected check +uses the actual C20 source rule, preserving the refusal and original verifier. + +Secrets Engine `691dc742362eeec45d5bd32d2b468f31a959748e` publishes its exact +original-consumer custody plan and marks SECRETS-WP-0015-T03 done for source +preparation. Four task UUIDs and T04's human-wait dependencies on T03/NK49-T33 +are verified. The candidate observer remains unwired/unexecuted on real input; +five synthetic checks establish only claim parsing/source/input refusals. +Original TLS/archive/private admission, original OpenBao/custody/MFA recovery, +actual signed-token/resource-server denials and revocation remain native owner +work. Existing protected-backend scopes stay in SECRETS0008/0013. + +The completed owner reviews leave NK48-T14/T15/T16 implementation/native gates +open. The proposed package/SQL candidate, original-context seam and six missing +descriptors do not create native authority. GLAS's bounded real-model proposal +retains its existing Claude profile, spend/metering/native approval requirements +and immutable runtime; it does not migrate this Custodian assignment. The private +scanner-response lane still needs an actual owner contract. APPROVAL-WP-0002 +remains residual and was not promoted. All sixteen target native gates are open. + +User-directed NetKingdom source/history investigation locates the requested +StorageShare recovery guide: publication commit +`31f483966cdfca4df1d326dee3ec0b6d33ea0e5e`, actual readback 16 October 18:01 UTC, +Backup account, `railiance-backups/net-kingdom-identity/`, filename +`net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`, with ZIP/checksum. +The local guide matches that recorded publication. Current remote visibility, +original TLS custody and whole-estate recovery are not established by this +identity-only guide. No share, credential, backup or current remote file changed. + +Evidence: dated 17 October native/source/consumer packets listed in +`docs/netkingdom-target-implementation.md`, especially each owner's verified +bindings and `storage-share-tls-r1/source-history-followthrough-r2.json`. +All current task statuses remain appropriate: T03/T05/T06 progress, T04 todo, +T01/T02 done. No completion percentage or native closure is inferred from the +new completed source-review tasks. This remains the active implementation goal. + +## Runtime installation and refined offline verification, 2026-10-17 + +Exact founder-approved installation revision 2 ran once under decision +`b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3`. The inactive f599 runtime is installed +and its complete native digest independently verified. The required offline +launcher rehearsal failed (`phase_receipt_unavailable`, supervision reason +`leader_left_descendants`). Its watchdog reported positive process quiescence; +independent readback verified the full installed digest and owned staging absence. +The same supervised trial records failure; no native target +gate or runtime acceptance is complete. + +The frozen source has a locally reproduced zombie-classification bug, but the +native failure's cause remains unproven. Reviewable verification-only revision 3 +repairs that source defect and preserves a durable public receipt before cleanup, +keeping the full three-launcher acceptance requirement. Root verified 18 candidate +and 29 frozen revision 2 file pins; five focused local process/cleanup checks pass. +The founder approved exact revision 3 under +`bec667cc-15ea-4f87-ae16-111f08562e48`, proposal SHA256 +`7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30`. +Its first read-only preflight refused CPU headroom (99.25% busy; limit 85%). +After the main publication checks finished, one fresh preflight passed at 66.33% +CPU busy. The exact approved controller ran once. All three original empty-egress +offline launcher checks exited zero with complete f599 before/post digest equality; +its journal reports three dead adopted zombies reaped and positive quiescence. +Independent native readback verified full f599 again, owned staging absence and +the retained0600 public checkpoint's exact match to the local precleanup receipt. +The same trial records refined success with the original failed revision 2 +receipt/history preserved; no unchanged original-success credit is inferred. +No reinstall, model call, credential/profile/queue change or autonomous live +retry is authorized by the failed revision 2 run. Revision 3's separate exact +approval covers the completed verification only. EUR cost remains unmeasured. +All six task blocks, UUIDs and statuses remain unchanged; all sixteen native +target gates remain open. Evidence is linked from the implementation document's +dated partial-runtime-installation checkpoint. + +2026-10-17 user-directed KEY-WP-0039 finalization review: its accepted source +deliverables remain done (T01/T03); all 14 reviewed executable/test/decision pins +and three Platform pins still match. Exact Hub readback confirms the existing +registration go covers KEY37-T03's original secrets-engine-openbao client; it +does not admit new probe credentials or coding-client custody. That original +approval remains valid, and the reviewed-command standing attended rule has its +separate existing scope. T02's actual negative/expiry/revoke/cleanup +receipt is absent in the bounded source search; KEY38-T02/T03 and the existing +unadmitted coding-client custody/owner readiness returns remain prerequisites. +The parent stays active, T02 waits, and no native gate closes. No new helper +protocol or repeated original-client registration approval is required. Evidence: +`docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/`. + + +2026-10-17 T03 implementation checkpoint: independent GPT-6.1-Sol medium +reviewers checked the actual Warden kernel, fixed issuer-reference and Apps +inverse candidates. Reviewed kernel corrections plus the narrow ambient-lookup +unit-test fix are integrated and published at Warden `922c26d`; the normal +allocator's existing completed-task UUID addition is retained separately from +implementation `ae7bc73`. All four WP44 task bindings/statuses remain unchanged. +Platform `104ed90` publishes the proposed exact issuer ESO source; NetKingdom +`342a6f25` and `befb0bc6` carry independent mint regressions, valid catalog +fixtures and exact proposed issuer-template text. Source tests and limitations +are recorded in docs/netkingdom-target-implementation.md. NK48 refinement adds +completed source tasks T32/T33/T35 and keeps T34 progress for the real Apps +inverse/backend; T16 and first native case remain open. The fresh inverse-session +prototype is corrected and tested, but no real owner backend or authority is +invented. Earlier rejected reviews, the possible ambient lookup and failed +preparations remain retained. All six coordinator task blocks/statuses/UUIDs +are unchanged; all sixteen target native gates remain open. + + +2026-10-17 T03 safe-unit follow-through: Warden `b593c879` integrates the +ordinary test-entry guard after independent rejection and root review of the +minimal O_TRUNC/provenance corrections. The corrected full ordinary make test +passes 785 tests, four deselected, under synthetic ambient-token/HOME/Python/ +pytest sentinels. Source, pins, catalog and four WP44 task blocks are unchanged. +The known ambient-lookup accident path has a supported isolated test entry; +this is not an OS sandbox or actual assignment isolation, and original adverse +unknown outcomes remain retained. Evidence: dated warden-safe-unit-integration-r1 +and warden-safe-unit-runner-review-r1 packets. Coordinator task statuses and all +sixteen native acceptance gates remain unchanged. + +2026-10-17 T03 concrete owner follow-through: Platform source d35c0f9d is +published/projected with reviewed exact broker source validation and the +human-only issuer catalog correction. New normal-allocator RPF-WP-0060 makes +the four existing owner review obligations live tasks; T02 done, T01 progress, +T03/T04 todo. Independent delivery review rejects the first command candidate +for freshness/defaulting/transport/race defects; no inert prototype counts as +operational delivery. Actual Apps chart/image inspection proves the existing +CLIENT_SECRET reference can work but the exact three-group any-of sign-in gate +cannot be expressed by the current literal field. Nine offline/render checks +are independently reproduced. NK48 task refinement records completed source +proof T36 and real implementation T37, preserving all prior 35 task blocks. +Existing T34 inverse/session/journal/exclusion and T16/T06 admission/native gates +stay open. Evidence is linked in the implementation record. All six coordinator +task blocks/UUIDs/statuses and all sixteen native gates remain unchanged. diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md index 6388cc35..b3ef32f9 100644 --- a/docs/netkingdom-security-gaps.md +++ b/docs/netkingdom-security-gaps.md @@ -1,6 +1,7 @@ # NetKingdom security gaps and closure sequence -Assessment date: 2026-10-12; activation rechecked 2026-10-13. [Blueprint](netkingdom-security-blueprint.md). +Assessment baseline: 2026-10-12; current summary reconciled 2026-10-18. +[Blueprint](netkingdom-security-blueprint.md). Dated entries below retain their original scope. Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses below distinguish actual defects, incomplete integration and missing verification. No whole-estate SEC-DSM conformance or maturity level is claimed. @@ -9,21 +10,24 @@ No whole-estate SEC-DSM conformance or maturity level is claimed. | ID | Gap and current evidence | Existing owner work | Closure evidence | | --- | --- | --- | --- | -| G01 | The DN-subject validation repair is deployed and basic health/anonymous-denial checks passed; authenticated preview and attended U08 acceptance remain open. | KEY-WP-0040-T01/T02; USER-WP-0028-T03 | Regression for real subject shape; value-free field diagnostics; deployed preview without mutation; attended recovery and fresh sign-in | -| G02 | First reusable browser case lacks native structure/execution proof despite substantial local compiler and kernel work. | NK-WP-0048-T06/T07; MASON-WP-0010-T03/T04; WARDEN-WP-0044-T03/T04; KEY-WP-0038 | Exact accepted type/case, independent structure observations, contained issuance/delivery, positive and denied groups, revocation and rollback receipts | +| G01 | KEY-WP-0040 is finished: the founder accepted the authenticated preview and help-link correction on October 17. The remaining U08 factor recovery/re-enrollment/fresh-login journey is still open in USER-WP-0028-T03; its old preview blocker text is stale. Do not repeat the accepted preview. | USER-WP-0028-T03; completed KEY-WP-0040 evidence; CUST-WP-0080-T24 | Existing attended U08 procedure, real-factor recovery and fresh-sign-in acceptance; no factor change inferred from preview acceptance | +| G02 | Actual issuer-to-Forgejo callback, shared current-token client and PostgreSQL inverse/crash mechanics pass bounded source proofs. Ongoing HTTP/API/Git/SSH policy, current protected operation/inverse, all-writer exclusion, final integrated release and native first-case acceptance remain. | Existing NK-WP-0048 / RAPPS-WP-0016 tasks; CUST-WP-0080-T08/T09/T10/T14-T19/T23 | Exact accepted type/case, independent native structure, contained delivery, ongoing positive/denied/revoked access, exact current inverse and rollback | | G03 | OpenBao service-JWT login does not grant task-scoped execution. Backend readiness guard correctly refuses protected handlers. | SECRETS-WP-0013-T01/T03; RPF-WP-0035-T12; SECRETS-WP-0008-T06; KEY-WP-0039 | Owner-reviewed entitlement; native protected effect with exact binding; sibling/actor/body/replay/expiry refusals; no ambient fallback; cleanup | | G04 | Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery. | MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03 | Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings | -| G05 | Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation | +| G05 | Workload-only credential delivery and disposable sandbox denial/redaction/teardown proof are delivered. Effective authority and credential isolation of the actual interactive assignment remain unaccepted; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012; CUST-WP-0080-T13/T27 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation | | G06 | Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness. | AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records | Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion | -| G07 | The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. The additive forge scanner is verified on 166 of 167 repositories, including 143 newly probed targets; one repository with four external submodules remains uncovered. Ordinary SSH source acceptance is verified separately; authenticated HTTP/frontend, CI and response remain open. | RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI via FORGE-WP-0006, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure | +| G07 | Local scanner enforcement and the 166-of-167 Forge hook baseline are delivered; the external-submodule repository remains uncovered. The latest legitimate Custodian publication hits the unchanged receive deadline. Forge ea65606c publishes a bounded source correction: all 141 objects scan in 52.53 seconds, 54 distinct leaf cases pass, native rollout pending. Actual read-only inventory still finds 166 old identical hook copies. Broader HTTP/frontend/import/mirror/CI/private-response acceptance remains open. | RMGR-WP-0021; finished FORGE-WP-0006 baseline; FORGE-WP-0010-T02/T03; CUST-WP-0080-T11/T20/T28/T39/T40 | Native exact-binary correction and ordinary publication; complete declared path/production-repo denominator; private finding-to-response acceptance; explicit promotion before implementing required residual dependencies | | G08 | Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified. | NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work | Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests | | G09 | Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption. | CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07 | For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred | | G10 | Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields. | CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions | Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance | | G11 | Root recovery, independent custody and single-node resilience require scoped native proof. Old successful source preparation is insufficient. | WARDEN-WP-0027-T02; platform recovery records; RPF-WP-0015 residual | Fresh authorized scenario, off-host encrypted backup, independent recovery access, verified restore/return; honor build-mode single-holder decision | | G12 | CI credential authority, Kubernetes delivery-copy lifecycle and at-rest protection lack complete estate coverage. The reproduced unauthenticated cross-pod Docker listener was closed on October 13; runner loopback connectivity and heartbeat remain healthy. Forge metadata shows Actions enabled on 165 repositories and zero protected-branch rules; this does not establish workflow execution or required checks. | RPF-WP-0036/0044; railiance-forge; existing CCRs; CUST-WP-0080-T03 | Pipeline writer scope and job identity, per-store namespace/path isolation, refresh/deletion semantics, consumer adoption, independently governed encryption keys | -| G13 | PDP authenticity is separate from digest binding. FLEX-WP-0024 implements optional signatures; Secrets Engine still lacks independently anchored verification. Its reproduced redirect/proxy credential forwarding defects are now fixed in source (675 tests pass, one skipped). Native signer/consumer acceptance remains open. | SECRETS-WP-0014 T01 done; T02/T03 own trust admission, signed consumer enforcement and native verification. CUST-WP-0080-T03 tracks estate coverage | Independently trusted key or authenticated channel, configured producer, consumer verification, forged/altered/unknown-key/unsigned-downgrade refusals and key-rotation evidence | +| G13 | Producer signing, strict independently configured consumer verification and local cross-owner interoperability are delivered in source. Native package/signer/caller/policy/trust admission and coverage of every privileged PEP remain open. The earlier redirect/proxy credential-forwarding defects are repaired; source verification must not be described as native acceptance. | SECRETS-WP-0014 / FLEX-WP-0024; CUST-WP-0080-T07/T21 | Independently admitted native key/channel and consumer package, exact PEP denominator, forged/altered/unknown-key/unsigned-downgrade/expired/unavailable refusals and rotation proof | -G01 source repair is deployed; authenticated preview/U08 remains open. G02 and G03 require existing owner +G01 preview/help corrections are accepted; only actual U08 journey acceptance remains. +The refined [WP-80](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md) +maps all gaps to specific evidence checkpoints and distinguishes delivered source +from native/consumer acceptance. G02 and G03 require existing owner acceptance and native custody gates; fixture success cannot remove them. G04, G07, G08, G10, G12 and G13 require further inspection and concrete corrections under the coordinator task, with owner records reused when coverage is established. diff --git a/docs/netkingdom-target-implementation.md b/docs/netkingdom-target-implementation.md index a77f92d5..979e7df2 100644 --- a/docs/netkingdom-target-implementation.md +++ b/docs/netkingdom-target-implementation.md @@ -4,6 +4,12 @@ Coordinator: CUST-WP-0080. Target: [security architecture](netkingdom-target-sec Started 16 October 2026 under the founder's explicit implementation and GPT-6.1-Sol medium subagent request. The full architecture remains the goal. +For current delivery checkpoints, completed outputs and the next action, use the +[WP-80 delivery overview](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md). +This implementation record retains detailed history. The workplan separates +bounded source evidence from integration/build work and actual native/consumer +acceptance, while retaining every original owner obligation and target gate. + ## Work ownership and current status | Gate | Existing implementation owner | Current evidence state | Next deliverable | diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 84ef7c2f..4c54aa82 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -14,22 +14,69 @@ depends_on: [] state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" --- -User-requested estate assessment and gap closure. Existing owner plans retain -implementation and native acceptance ownership. This plan adds the cross-cutting -SEC-DSM assessment and tracks uncovered findings without duplicating their tasks. -Explicitly deferred or residual work is not silently promoted. -2026-10-16 founder continuation: document the optimized target architecture and -drive implementation using GPT-6.1-Sol medium subagents. The normative target for -this implementation effort is `docs/netkingdom-target-security-architecture.md`; -`docs/netkingdom-target-implementation.md` links all sixteen acceptance gates to -existing owner work. This extends the existing coordinator rather than creating -a parallel security backlog. T03 retains source/lifecycle implementation, T05 -the browser consumer, and T04 native requirement closure. Existing scoped live -authorizations and deferrals remain applicable. Necessary residual dependencies -receive explicit owner-scoped promotion before implementation, never a blanket -activation. The full target remains incomplete until every acceptance gate is -proved at its stated scope. +# WP-80 delivery overview + +Updated 18 October 2026 after the founder requested clearer progress and smaller tasks. + +| Measure | Current state | Meaning | +| --- | --- | --- | +| Completed source evidence checkpoints | **7 of 7**: T07-T13 | Published/reviewed foundations at their stated scope; no native acceptance inferred. | +| Remaining integration/build checkpoints | **0 of 6**: T14-T19 | Current ongoing access, protected operation/inverse, writer exclusion and final build still need completion. | +| Delivery checkpoints overall | **7 done, 1 in progress, 26 todo**: T07-T40 | Discrete Custodian evidence checkpoints linked to existing owner implementation work. | +| Complete native architecture gates | **0 of 16**: TSA-01-TSA-16 | Each requires its full deployed/consumer evidence. This is not 0% engineering progress. | +| Original coordination records | **2 of 6 done**: T01-T06 | Stable umbrella IDs/UUIDs retained for existing callers; not a delivery percentage. | + +**Now - T20:** finish the sealed scanner activation/recovery procedure and final +resource/drift checks. The published correction scans the refused 141-object +change in **52.53 seconds**, with **54 distinct passing leaf cases**. Exact native +forward/inverse simulation and server dry runs pass. Live installation still +requires independent admission and the founder's go for that exact change. + +**Next - T14/T15:** implement and verify the selected current KeyCape checks on +ongoing browser/API/Git HTTP and SSH paths, using the existing producer clients. +Then T16-T19 finish exact operation/inverse, writer exclusion and the final release. +While one native checkpoint awaits a concrete approval/owner return, one independent +source checkpoint may progress. Limit active delivery work to two checkpoints. + +**Already delivered:** shared signed-decision/approval foundations; the current-token +client and fresh inverse-session verification; actual issuer-to-Forgejo login; +PostgreSQL crash/restart and inverse mechanics; the bounded scanner correction; +provider index/parity repairs; workload-isolation fixture proof. T07-T13 carry the +scope and evidence for each. The new completed records expose existing delivered +work; they do not represent seven newly deployed systems. + +**Publication:** the owner source commits named below are published. Recent +Custodian evidence is locally committed/prepared but its remote publication remains +blocked by the unchanged live receive scanner. A local checkpoint is not a published +or deployed result. + +**Hub view:** the last readback still contains the six original task records. +Normal consistency sync attempted publication and skipped task writes after that +push failed. The 34 new delivery records and counts above are verified in this +source file and await normal projection; they are not yet visible as Hub tasks. +T20 removes this publication blocker as part of its acceptance test. + +**Scope:** all 16 gates, G01-G13 and all 116 SEC-DSM ledger entries remain required. +[Target and acceptance contract](../docs/netkingdom-target-security-architecture.md), +[owner implementation record](../docs/netkingdom-target-implementation.md), +[gap register](../docs/netkingdom-security-gaps.md), +[requirement ledger](../docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json). +Existing scoped approvals, deferrals, independent owner assent and explicit residual +promotion rules remain effective. This refinement grants no runtime authority. + +**Ownership and updates:** T07-T40 are Custodian review/acceptance checkpoints, not +replacement owner implementation tasks. Owner files own implementation status; +this file owns coordination/evidence-checkpoint status; the Hub is its derived view. +Every progress update names the checkpoint, concrete output, exact evidence scope, +remaining acceptance and next action. Link original evidence rather than recopying +it. Re-run checks only for changed inputs, failures or a specific unresolved concern. +Route new findings into the existing owner record and mapped checkpoint before +adding another workplan. Do not infer an overall percentage from mixed-stage counts. + +The complete prior task/session history is preserved byte-for-byte in the +[pre-refinement snapshot](../docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/workplan-before-refinement.txt). +No old task binding or status was replaced; history is evidence, not a second live backlog. ## Review canon and map actual architecture @@ -40,14 +87,7 @@ priority: high state_hub_task_id: "c770f7e1-25eb-53ec-9a37-1f7794077ff8" ``` -Read SecurityCanon SEC-DSM 1.0, accepted NetKingdom layer model and case contracts, -owner declarations, source implementation boundaries and open workplans. -Delivered `docs/netkingdom-security-blueprint.md`. The source inventory includes -the named repos, identity, policy, approval, lifecycle, audit and supporting engines. -Role-engine is a documentation catalog; zone-engine is an offline reference. -Neither is described as live enforcement. Emergent knowledge package 0.2.6, -digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, -was withheld for changed sources; current owner sources were reviewed directly. +Completed the SecurityCanon SEC-DSM and existing-owner architecture review. Delivered [security blueprint](../docs/netkingdom-security-blueprint.md). The inventory distinguishes reference/documentation capabilities from runtime enforcement. This record is retained unchanged in status and identity. ## Inspect and optimize the blueprint before planning closure @@ -58,10 +98,7 @@ priority: high state_hub_task_id: "5973026f-8ca9-5882-99fe-65a54bc250ac" ``` -Blueprint inspection table records trust boundaries, circular dependency removal, -identity-first credential selection, exact operation bindings, source/native -evidence separation and lifecycle closure. Gap analysis and sequence are in -`docs/netkingdom-security-gaps.md`. No new broker/PDP or blanket conformance claim. +Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-security-gaps.md) and target direction. This completed design review does not claim native conformance. ## Close source defects and reconcile uncovered lifecycle gaps @@ -72,647 +109,7 @@ priority: high state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3" ``` -Start with the reproduced DN-subject validation defect in existing KEY-WP-0040. -Reconcile G04/G07/G08/G10/G12/G13 against current owner inventory, scanner wiring, -bootstrap callers and approved exception evidence. Reuse owner work where it -already covers the finding. Record new concrete uncovered implementation work -before closing this task. Never populate secret values or invent owner approval. - -2026-10-18 actual callback/current-grant continuation: two signed access-purpose -counterexamples fail against the prior ID-token verifier. The consumer now -requires independently admitted application tenant/current-token bindings, -separates ID/access purposes, checks the exact signed RS256 at_hash, joins -issuer/client/subject/tenant/type/issuance/assurance/auth-time/provenance and -rechecks current status before and after the PDP. KeyCape `e2c5a947` signs the -exact online human access-grant binding without changing disabled legacy issuance. -Its complete race suite passes 726 test/subtest results with the same six existing -native/external skips. The identical current consumer fails against the old issuer. - -The actual HTTPS PKCE/discovery/UserInfo/status/revocation handlers, real Forgejo -provider/callback and unchanged generated client pass five separate consumer -processes: two current grants accepted; mixed pair, revoked original and suspended -human refused. MFA session seeds and PDP admissions are synthetic. The latest -focused suite passes 91 results without skips; the final four selected composed -packages pass 116 without skips. The initial reused-file fixture skip and its -subsequent correction are retained. No native database/issuer proof is inferred. - -Apps `ab3cf5cd` retains the initial source commit and its validation-scope -correction. The 49-path source package and six issuer source postimages replay -exactly; production code and generated adapter match the tested runtime. -Complete release/static-assets/OCI rebuild, independent owner assent and native -package/type/custody acceptance remain open. Exact source/proof is in -`docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/`. - -The user explicitly selected current KeyCape checks on every ongoing API/Git/SSH -operation for linked accounts, retaining the separate local break-glass path. -The target architecture and decision b96ef564-c713-4a48-9ab2-849958cec681 record -that profile; it grants no live change. Those route/resource/action/group checks -remain actual implementation work under existing RAPPS16-T09/NK48-T43, alongside -current protected operation/inverse, exact effect/approval, journal custody and -all-writer exclusion. Callback proof closes no native gate or coordinator task. -Audit r6 retains all sixteen gates, G01–G13 and all 116 ledger requirements. - -2026-10-18 shared-client/inverse continuation: KeyCape `08c083ba` publishes -one producer current-token implementation, its generated Go adapter and private -current/revoke/independent-inactive CLI commands. Explicit trust/identity/status -joining, per-check trust/credential rereads, post-response lifetime/key checks -and exact token-digest output binding pass 724 full race test/subtest results -with six existing native/external skips. A deliberate generated-consumer-only -change fails the ordinary parity checker. KEY42-T04 records source completion; -independent issuer/profile review and native admission remain open. - -Warden `08c098e6` separates immutable original session provenance from the fresh -current session needed for an exact existing inverse. It verifies original -journal/intent/pins and current identity without granting replay or clearing -uncertainty. Its actual canonical guarded suite passes 796 tests, four deselected. -The cross-owner fixture uses the actual HTTPS issuer, built CLI, generated Go -consumer and Warden kernel: 45 assertions across fresh owner processes pass, -including current/revoked checks, original business replay refusal, exact synthetic -effect restoration and independent inactive cleanup readback. Case/catalog/owner -attestations and target are synthetic; no real Forgejo/native acceptance is claimed. - -All 19 KeyCape and four Warden source delta postimages replay exactly from their -published bases; compiled integration runtime/export bytes match. Original API, -fixture-mode and archive-only metadata failures are retained. Source and evidence: -`docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`. -NK48/Apps retain current authenticated operation/inverse effect/approval bindings, -ongoing HTTP/API/Git/SSH, private journal custody/retention and all release-writer -exclusion. All sixteen gates, G01–G13 and 116 ledger entries remain in scope; -no coordinator task or native gate closes. Completion audit advances to r5. - -2026-10-18 current-token producer continuation: actual owner contracts confirm -that legacy KeyCape JWT validity is expiry-only and Warden's injected session -verifier does not supply a current revocation source. Prepared an explicit, -proposed issuer scope extension in the existing KeyCape service rather than -an application-local token registry. One opt-in bounded hash-only store serves -actual human/service issuance, UserInfo, RFC 7662 introspection and RFC 7009 -revocation. Unique access-token identifiers prevent same-second remint/revival; -ID-token and disabled-profile behavior remain unchanged. Online checks bind -current registration and human disposition and recheck after directory lookup. - -All 659 complete source race test/subtest results pass, with six existing -native/external skips; all 43 new status results pass without skips. The built -standalone server passes 26 actual-process checks, including revocation, real -restart/predecessor refusal, fresh issuance, capacity and disabled routes. A -separate actual-handler HTTPS PKCE flow passes. Omitting the revoked-state -predicate in a controlled source copy fails seven intended checks. All 18 source/publication -postimages replay exactly from the published owner archive; production is -untouched. Process-local status loss deliberately requires reauthentication; -offline consumers retain their existing token lifetime. These limits are part -of the explicit proposed KEY-WP-0042 contract, not an implicit scope promotion. - -Ordinary owner identifier preview exposed a preexisting closed historical task -without its file UUID. The Hub has an exact matching existing binding; normal -consistency audit skips creation in closed workstreams. Its existing helper -restores only that exact already-recorded reference after parent/record/title/ -status/body comparison. Normal Repo Manager assigns the four new canonical -proposal records. KeyCape `67a0869c` publishes the 17-path feature and historical -reference restoration, without changing historical status or any existing UUID. Exact source, refusals and process receipts: -`docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1/`. Independent -issuer/profile assent, native issuer admission and existing NK48/Apps operation, -inverse, ongoing-resource and cleanup bindings remain open. All sixteen target -gates, thirteen gaps and 116 ledger entries remain in scope; none closes here. - -2026-10-18 PostgreSQL continuation: the actual Forgejo engine/model schemas and -OAuth configuration types now pass 37 test/subtest results on disposable -PostgreSQL 16.14 across default, explicit-public and named schemas. Separate -client processes verify rollback after death immediately following INSERT, -committed apply survival through an actual database-server restart, and fresh -reconciliation/inverse. Exact restoration, drift/link refusals, trigger rollback, -uncooperative writer exclusion and concurrent preparation pass. Controlled -copies without the table lock or private-query marker fail in all three profiles. - -The diagnostics test exposed a real XORM tracing-context composition panic. -Publishing the task context into the shared query hook fixes the actual path -without changing the incoming private marker. Six SQLite diagnostic checks and -all 94 selected composed package results pass without skips. Earlier container, -fixture and compilation failures, the original panic and both counterexamples -remain retained. All owned test containers and volumes were removed. - -Apps `308e83fc` publishes the 40-path source/build correction at the primary hub -with all nine task UUIDs/statuses preserved. The complete fresh frontend/static -release, all 2,234 embedded assets and 48 release CLI/SQLite checks pass. Two -fresh local no-cache OCI exports reproduce the same archive/manifest/config/index; -no second source build, registry publication or deployed acceptance is claimed. -Evidence: `docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/`. -Current operation/inverse identities, every release writer, private journal -custody/retention, ongoing resource paths and independent/native acceptance remain -under existing T34/T42/T43 and RAPPS16-T07/T08/T09. This source proof closes no -native target gate; the complete goal and ledger scope remain active. - -2026-10-18 goal continuation: implemented the missing producer-owned Go client, -generated export parity check, validated Forgejo policy fixtures/Rego tests and -actual consumer callback coverage. Access Engine source `ca0cb757` is committed -and projected at primary/railiance01 with its original task bindings preserved. -The complete root race suite passes 494 test/subtest results with three existing -optional/fixture skips; the layer check and strict group-shape regressions pass. -The original malformed-group counterexamples, incomplete source files and failed -preparations remain retained. - -Composed the actual Forgejo backend with private input and the source-state -transaction. Recovered the interrupted empty DB-context snapshot from its exact -frozen patch and verified both declared hashes. Actual CLI replay exposed the -Engine/Session logging-guard incompatibility; a shared underlying-logger check -corrects it while retaining raw SQL refusal and real hook redaction. Final actual -package checks pass 76 test/subtest results without skips, and the complete backend -passes 48 isolated CLI/SQLite subprocess checks. All 35 composed patch postimages -reconstruct exactly from the pinned official archive. Source and proof inventory: -`docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/`. - -Actual issuer-source inspection found a further mandatory interoperability gap: -KeyCape emits a structured `assurance` object; the preceding candidate expected a -string. The actual TokenHandler fixture reproduced the rejection. The corrected -consumer preserves the signed object and tenant provenance, validates its actual -authentication time, and bounds identity validity by authentication age, token -age and expiry. All 77 actual-issuer/provider/callback test and subtest results -pass, including real discovery/FetchUser/UserInfo joining, signed ALLOW/DENY and -UserInfo spoof refusal; all 93 selected composed -package results pass without skips. The new 37-path patch replays exactly against -the official source archive. The fresh complete frontend/static release build -passes; all 2,234 embedded assets match and all 48 actual release CLI/SQLite -checks pass. Evidence is in `forgejo-keycape-claims-r1`; these are synthetic -authentication/source and local artifact proofs. -Two fresh no-cache local OCI exports from that verified binary have identical -manifest/config/index/archive digests, preserving all base layers and rootless -runtime configuration. No second source build or operational admission is claimed. -Apps `3fb031a4` publishes the five-file build-source integration at the primary -hub, preserves all nine task UUIDs and starts existing RAPPS16-T09. Independent -owner review and operational admission of that revision remain open. -Existing T43 / -RAPPS16-T09 also retain ongoing HTTP/API/Git/SSH and operation/inverse coverage; -T41/T42 retain full release integration, exclusion and private journal custody. -The full completion audit now enumerates all sixteen gates, thirteen named gaps -and 116 SEC-DSM ledger entries under `cust80-completion-r1`. No native gate or -coordinator task is closed by these source results; the full user goal is active. -`cust80-completion-r2` retains that full scope and records this source progress. - -2026-10-18 resumed application review: completed the interrupted seventeen-file -release-build evidence checkpoint as `8951d324`, preserving the staged brief and -other work. Reconstructed the exact retained Access Engine adapter and producer -candidate against producer source `d328a260` in network-disabled, private-PID -sandboxes. Both full commands fail: the adapter includes an empty Go source file; -the actual producer rejects the Forgejo policy for undeclared attributes and -missing embedded/referenced fixtures and Rego tests. Adapter verifier tests and -two existing producer control functions pass, but do not establish package or -policy acceptance. The consumer callback test file is also empty, and ongoing -HTTP/API/Git/SSH coverage is absent from the candidate. Original interrupted runs -remain unverified; no previous success is overwritten. Evidence and exact source -pins: `docs/changes/netkingdom-target-2026-10-17/application-resume-review-r1/`. -NK48-T43 / RAPPS-WP-0016-T09 retain these corrections and full profile acceptance; -T41/T42 retain independent private-input/transaction review and owner integration. -No task or native target gate is closed by this review. - -2026-10-12: KEY-WP-0040 source defect repaired and committed as key-cape `1344fc8`. -Twenty recovery tests and the full Go suite pass. Blue-lane code-volume-only -deployment reached generation 11 Ready; health 200 and anonymous recovery 403 -verified. Exact original proposal, dry-run, initial rollout observation and -final receipt are in `docs/evidence/2026-10-12-netkingdom-security/` and the -existing supervision record. No factor or account was changed. G01 still needs -the founder's authenticated preview/U08. The prepared OTP help link remains -local source only. G13 now explicitly tracks PDP response authentication; the -finished signature producer workplan is not treated as proof of consumer rollout. - -2026-10-12 continuation: reproduced and repaired G13 Check-client credential -forwarding through HTTP redirects and environment proxies, including the approval -flow's unsafe opener override. Strict literal loopback origins and response -bounds are enforced before credential access/decision use. New native owner -SECRETS-WP-0014 records completed transport work and separate open independently -anchored signature enforcement/native acceptance tasks. Focused regressions: -18 failed/5 passed before, 23 passed after; broader focused suite 71 passed. -Real repository full suite 675 passed/1 skipped. Archived sandbox full-suite -ownership/repository-detection failures are retained in the receipt rather than -misrepresented as source regressions. No live credential, policy, entitlement, -PDP deployment or protected backend was touched. G13 stays open. - -2026-10-12 continuation: G08 source repair implemented in NetKingdom. Removed -emergency/reprint root export and generator prefix disclosure; private service -file creation, public-recipient bootstrap, explicit matching custody resume, -non-mutating dry-run and digest-bound encrypted handoff now have disposable -workflow tests. Historic delivery flags are preserved. NK-WP-0049 owns remaining -legacy caller reconciliation and native recovery acceptance; NK-WP-0045's -finished non-secret root-grant recovery does not cover this secret custody path. -No real root/credential was read, generated or rotated and no live bootstrap was -run. Existing CUST-WP-0073-T05 exposure deferral remains effective. Exact source -and validation receipt: `bootstrap-handoff.json` in the evidence directory. - -2026-10-12 additional G08 progress: direct custody/encrypt/decrypt fixes pushed -as NetKingdom `4cf26a9`; 206 tests pass. NK-WP-0049-T02 is progress with specific -remaining Make/rotation/admin output callers. Six SEC-DSM requirements now have -substantive incomplete assessments and scoped proof/missing-evidence fields; -none is marked conformant. `custody-entrypoints.json` preserves the baseline, -source manifest, test coverage and cleanup/isolation limits. No live credentials -or founder-deferred rotation were used. - -2026-10-12 G08 Make follow-through: NetKingdom `681c5b0` pushed; 227 actual checkout -tests pass (21 real-SOPS tests, no skips). Public-only setup, explicit matching-key -private SOPS output, ambient identity isolation, no-overwrite/Git-output guards -and sanitized parser/tool failure handling replace the legacy Make paths. Six -incomplete requirement assessments now cite `sops-make-entrypoints.json` and -state remaining direct/delegated callers, existing copies and native recovery -proof. This neither executes deferred rotation nor admits a production SOPS -version; the disposable binary's official checksum verification is scoped in the -receipt. NK-WP-0049-T02/T03 and G08 remain open. - -2026-10-12 G08/G09 rotation output repair: NetKingdom `6ae4708` pushed. -20 regressions failed against the old -NetKingdom source; 25 focused regressions and all 252 repository tests pass after -repair. Private file validation/atomic handoff, sanitized diagnostics, SQL stdin, -fail-closed database discovery and unattended LDAP refusal remove reproduced -source defects without executing founder-deferred rotations. DSM-ROT-003 now has -an explicit incomplete assessment (seven incomplete, 89 unverified, 20 anti-pattern -references). Native adoption/old-value refusal and admin-bootstrap/RSA/delegated -source gaps remain in NK-WP-0049. Receipt: `rotation-output.json`. - - -2026-10-12 current-profile admin bootstrap repair pushed as NetKingdom `19a1c75`. -It removes automatic obsolete -trigger-admin creation, replaces output/argv/shell-source handling with private -input and stdin delivery, and prevents password/policy overwrite on rerun. -Fourteen baseline tests failed, two passed; 36 focused tests pass including seven -actual privacyIDEA 3.12.2 model tests on disposable SQLite. Full suite: 288 tests -and 29 subtests passed, no skips. No live credential, -account or policy changed. Evidence: `admin-bootstrap.json`. DSM-TRANS-002 now -records the remaining privileged KeyCape token path explicitly (eight incomplete, -88 unverified, 20 reference entries). Native PostgreSQL/image/MFA acceptance, -legacy-object revocation and other delegated helper lifecycle remain open. - -2026-10-12 G07 broadened audit: all 21 review repositories inherit a generated-only -guard; a disposable private-key commit succeeds through it. Repo Manager's new -`secret-scan` adapter (`77fc4c9`, pushed) pins Gitleaks, scans exact staged blobs without content -output and passes 17 focused tests including an actual refused selective commit. -All 249 Repo Manager tests pass, no skips. -RMGR-WP-0021 owns source integration, exact local activation, independent forge/CI -coverage and private detection-to-response acceptance. No global hook/routing -changed and no real credential finding was exposed. Four DSM-DETECT assessments -are now explicitly incomplete (12 incomplete, 84 unverified, 20 references). -Evidence: `secret-detection.json`; G07 stays open pending native enforcement. - -2026-10-12 G07 native workstation activation: RMGR-WP-0021-T02 completed. -Exact proposal CUST80-G07-local-hooks-001 installed the pinned scanner at a -durable local path and composed the two known hooks, preserving routing and -other hooks. All 22 scoped checkouts passed actual configured-hook clean, -disposable-secret, generated-only and non-executable-scanner probes. Temporary -indexes/object stores preserved user source/staging/branches; executable mode was -restored, and an unreviewed checkout kept its prior behavior. Eleven targeted -activation/rollback/guard tests pass. Receipt: `secret-hook-activation.json`; -exact proposal, backups and rollback: `docs/changes/CUST-WP-0080/`. Independent -forge/CI enforcement, other clones/history and detection-to-response remain open. -No DSM requirement or whole G07 closure is inferred from this local acceptance. - -2026-10-12 G07 forge baseline: read-only observation confirmed railiance01 and -Forgejo 11.0.3. Its repository storage has 165 repository directories (not yet an -admitted production denominator). All 22 reviewed repositories exist and their -receive-hook files exactly match the seven distinct hashes generated by upstream -v11.0.3 templates, with no extra hook files/symlinks at the inspected depth. -No custom scanner hook is installed there. Branch-protection/Actions coverage, -internal policies and actual push rejection remain unverified. Metadata and -upstream comparison: `forge-secret-detection-baseline.json`. No server mutation, -credential read, repository-content scan or synthetic push was performed. - -2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native -forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans -introduced reachable Git objects and updated ref names, preserving quarantine -and refusing incomplete/oversized input. Thirty-three leaf cases pass, including -actual disposable pushes for intermediate/deleted secrets, second-parent merges, -messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and -scanner failures. Existing owner Python test passes; the new owner Make target -passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`. -No production hook changed. Exact-binary admission, repository denominator, -SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain -open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open. - -2026-10-12 G07 native admission: the exact adapter/scanner binaries passed -clean/detection/quarantine/tool-failure/recovery checks in disposable repositories -inside the running Forgejo image. Builtin authorization was stubbed only in this -isolated probe; no production hook changed during that probe. Receipt: -`receive-native-probe.json`. Metadata reconciliation now matches 165 database -repositories to 165 directories; none has a protected-branch rule. The initial -22 reviewed repositories pass shallow/partial/gitlink compatibility checks; the -remaining 143 are uncovered, not exempt. `forge-repository-inventory.json` -retains aggregates and reviewed identities only. An exact additive-hook activation -proposal and tested rollback are prepared as FORGE6-RECEIVE-ACTIVATION-001 under -the existing standing blue-lane authorization; outcome is recorded separately. - -2026-10-13 interruption recovery: retained activation receipt proves that -FORGE6-RECEIVE-ACTIVATION-001 completed on October 12 at 17:32 UTC, after the -last progress note. All 22 exact Forgejo repositories gained the additive hook; -actual SSH probes produced clean/blocked scanner results under a temporary veto, -with probe refs/quarantined commits absent and the veto removed. A fresh read-only -inspection confirms the same pod/image, exact original and added hook hashes, -executable pinned binaries and healthy service. Evidence: -`receive-hook-activation.json` in the October 12 directory and -`docs/evidence/2026-10-13-netkingdom-security/receive-profile-recheck.json`. -Ordinary clean-push acceptance, HTTP/frontend/lifecycle coverage, the other 143 -repositories and private response acceptance still need proof. G07 remains open. - -2026-10-13 G07 acceptance follow-through: committed recovered activation as -Custodian `eb93eee` and owner record as railiance-forge `d2d87ca`; both ordinary -SSH source pushes passed through the installed profile via fix-consistency and -remote heads were verified. Owner T02 is progress in both file and hub. Four -installer/rollback tests pass again. An isolated local instance of the exact -Forgejo image with no network or host mounts passes 23 boolean lifecycle checks: -HTTP clean/secret/quarantine behavior, native content API and merge-message -refusal with actual detector evidence, clean merge, hook regeneration, exact -Git-template inheritance on new repository creation, restart and subsequent -refusal. Seven incomplete preparation/assertion attempts are retained; none is -counted as acceptance. The successful receipt and upstream source hashes are in -`docs/evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json`. -The test reproduces the absent default new-repository hook and proves a candidate -Git-template repair, not a deployed repair. Import/mirror clone/fetch bypass the -receive boundary; those and the other 143 repositories, deployed HTTP/SSO/UI and -k3s lifecycle acceptance, CI authority and private response remain open in -FORGE-WP-0006/RMGR-WP-0021. Close-down checklist row 21 now records these unarmed -controls. No gap or requirement is marked closed from isolated acceptance. -A real pre-commit finding on the authored harness was privately classified as a -public binary-checksum false positive. The harness now reuses the immutable -admitted artifact manifest rather than duplicating that metadata. The unchanged -scanner passes the revised staged source; no suppression or exception was added. -`scanner-triage.json` retains value-free classification and resolution evidence; -this does not close RMGR-WP-0021-T04's credential-response requirement. - -2026-10-13 G07 template deployment: source railiance-apps `390a30a` adds the -immutable non-secret ConfigMap, read-only file subPath mounts, encoded Git -configuration and deployment prerequisite. Thirty isolated file-mount/config/ -rollback checks and six conditional-patch regressions pass. Exact proposal -FORGE6-TEMPLATE-LIFECYCLE-001 passed the server dry-run and its additive live patch -reached generation 12 Ready on the unchanged image. Actual Forgejo Git config -selects the template; a native temporary Git repository inherited the regular, -executable exact hook and refused malformed input. All 22 original hook inventories -and both binaries remain unchanged; health passes and probe data was removed. -Existing admin identity and initial-only password mode were checked before restart. -No credential, identity, resource request or policy scope was changed. The first -owner-source sync hit the restart window; retry pushed `390a30a` successfully. -Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json`; -proposal, guarded rollback and source reconciliation instructions are in -`docs/changes/CUST-WP-0080/forge-template-operations.md`. - -Fresh metadata now reconciles 166 database repositories and directories (one more -than October 12): all hook inventories are known; 22 have the admitted profile, -144 are builtin-only. No mirrors, forks or wikis are present; no protected-branch -rules are configured. Full identity inventories remain in mode-0600 local files; -committed receipts contain aggregates only. Production API/SSO/frontend creation, -existing-repository expansion, import/mirror content paths, CI and response -acceptance remain open; T03/T04 and the owner plan are not closed by this rollout. - -2026-10-13 adverse acceptance and recovery: the initial generation-12 health, -hash and malformed-input checks missed a real restart failure. The next ordinary -Forge owner push refused with `scanner-file-refused`; both installed artifacts -had become group-writable 0775, consistent with Kubernetes fsGroup volume -processing. The original trial remains failed in supervision; its original -proposal and receipt are retained, not rewritten as an unchanged success. -Revision 2 verified exact hashes/ownership and restored only 0755. The queued -Forge owner source push `ec1d7c5` then succeeded through the enforced hook. -Revision 3 adds an exact-image unprivileged startup guard, mounted only to the -existing security subtree, persisted in railiance-apps `50b66c4`. Six isolated -checks cover remount permissions, idempotence, wrong hashes, unsafe modes, -symlinks and recovery. Server dry-run and rendered source match; rollback removes -only that init container and explicitly repairs modes after remount. -Generation 13 completed the guard and passed real inherited native receive -checks: clean acceptance, intermediate-secret refusal, quarantine removal and -clean recovery. Builtin authorization is excluded in the temporary native probe; -the ordinary source push separately exercises authenticated SSH. A second -Kubernetes replacement reached generation 14 and repeated all those checks with -a different pod UID; both startup guards exited zero and both binaries remained -0755. Authenticated SSH source acceptance after that replacement is recorded -separately in the recovery summary. -Evidence: `forge-custody-repair.json`, `forge-custody-rollout.json` and -`forge-custody-restart.json` in the October 13 evidence directory. This resolves -an availability regression without weakening scanner refusal or widening access. - -2026-10-13 push compatibility closed: STATE-WP-ADHOC-2026-10-13-T01 is -finished/done in file and hub. State Hub `7183f59` (identifier projection commit -`f6839b5`) and Repo Manager `5a7e838` extend client push deadlines to 120 seconds -for the admitted server scanner's 90-second budget. Timeouts report unverified -remote outcome without retry or child diagnostic disclosure. Seventy targeted -tests and two real 65-second receive-hook acceptance/refusal sequences pass; -the installed State Hub packaged module matches source. Both owner projections -applied against exact pushed commits. Receipt: `push-deadline.json`. - -2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after -all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref -veto. The independent final read-only audit reconciles 167 repositories: 166 -admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All -23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership -markers remain. Each rejected synthetic commit was absent after its probe. -Repository 55 has four external submodules and remains required compatibility -work. Ordinary source acceptance is distinct from vetoed scanner checks. -Production HTTP/API/frontend acceptance remains unverified: the protected API -credential route failed before child handoff and the metadata-only capability -check denied access. Prepare one complete acceptance command for the existing -attended login window. CI, import/mirror, historical/LFS/log/artifact detection -and private response gates remain open; this is no whole-estate closure. -Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json` -and `forge-api-route-readiness.json`. - - -2026-10-13 authenticated-route preparation: FORGE6-ROUTES-001 revision 2 -binds a silent contained operation to one newly created private disposable -repository. The exact shared suite passes 27 isolated pinned-image checks: -creation/inherited hook, anonymous denial, HTTPS clean/secret pushes, API content -acceptance/refusal, merge-message refusal/clean merge, unchanged refs, quarantine -and owned cleanup. Five boundary tests cover changed ownership, ambiguous-create -cleanup refusal, generic-error non-acceptance, redirect credential protection, -and silent digest-bound credential handoff. Read-only live preflight passes -under a private HOME. The failed first rehearsal and source-binding limitation -remain recorded. No production API mutation or credential fetch was performed. -The existing attended-window command is ready for caller OIDC/MFA; live route -and session-revocation receipts remain required. Packet: Custodian -`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence: -`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`. - -2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping -from another pod reproduced the wildcard listener defect. Exact revision 2 of -FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps `706461b`, pinning the -same running images and restricting Docker to loopback with local exec readiness. -The conditional server dry-run and three patch tests pass. Generation 4 is Ready; -loopback ping succeeds, other-pod ping refuses and the socket table contains only -127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after; -resource requests and Recreate strategy are unchanged (node CPU requests 86%). -Fresh runner heartbeat is one second old. Normal source push `706461b` triggered -workflow 7251; host-smoke and container-smoke both succeeded. Receipt: -`docs/evidence/2026-10-13-netkingdom-security/forge-runner-post-change-ci.json`. The original revision-1 preflight is -retained; revision 2 corrects rollback verification for the observed dual-stack -wildcard. Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`. -This closes the reproduced listener exposure only. Host jobs still share the -privileged runner boundary; workflow authority, required detection checks and -job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04. - -2026-10-13 submodule reconciliation: the four declared URLs use the retired -forge NodePort. Two pins are reachable under their current canonical repository -names. The wiki and issue-facade names are absent; a read-only object search -across all 167 admitted-inventory directories found the issue-facade pin in -repository ID 13, but no copy of the wiki pin. Neither pin is present in the two -expected workstation submodule locations. This identifies further mapping and -recovery work; no repository content was fetched, changed or uploaded, and no -scanner exception was introduced. Receipts: `forge-gitlink-reconciliation.json`, -`forge-missing-gitlink-object-search.json`, `forge-gitlink-local-copies.json`. - -2026-10-13 KeyCape custody callers reconciled with existing RPF-WP-0040: -retired personal-admin token mint/refresh entry points and updated bootstrap -configuration to the scoped renewable factor credential mount. First creation -uses private literal inputs, captured diagnostics, stdin-only Secret data and -API create without last-applied annotations or replacement of existing config. -Signing keys are published privately without overwrite and retained on failure. -Legacy RSA/client-secret replacement rotations now refuse before mutation; -configuration-preserving rotation and retained rollback custody remain required. - -The old source failed 21 of 22 new regressions. Final bootstrap/KeyCape suite: -277 passed, 22 dependency-related skips; actual KeyCape Go loader/config and -credential-file adapter suites pass against generated synthetic configuration. -Failed verification preparations are retained in the receipt. No live credential -or deployment changed. NK-WP-0049-T02 remains progress: other callers, historical -object revocation, coordinated rotation and owner-scoped native recovery remain. -Evidence: `docs/evidence/2026-10-13-netkingdom-security/keycape-caller-reconciliation.json`. - -2026-10-13 remaining service generator repair: NetKingdom `b01a30b` replaces -PostgreSQL/privacyIDEA/LLDAP/Authelia shell sourcing, credential argv and raw -apply output with private literal parsing and captured stdin-only Secret writes. -Default apply creates or verifies exact matching fields; named rotation changes -only its allowed field. Patches bind UID/resource version/data, preserve unrelated -fields and remove last-applied copies, then verify returned API state. Authelia -retains its private first-bootstrap key and preserves existing issuer/hash state. -Batch apply suppresses child output; DB rotation includes the previously omitted -CNPG application Secret. The stale attended LDAP/KeyCape replacement path refuses -before mutation. Coordinated/native lifecycle acceptance remains open. - -Final unchanged-source suite: 366 passed, 22 dependency-related skips; native -local OpenSSL/bcrypt and kubectl stdin patch/stale-version checks passed without -a cluster. No live credentials or deployments changed. NK-WP-0049-T02 remains -progress for other diagnostics/bootstrap/SOPS callers and lifecycle requirements; -T03 remains its owner-scoped recovery gate. Evidence: -`docs/evidence/2026-10-13-netkingdom-security/service-secret-callers.json`. - -2026-10-13 SOPS write caller repair: NetKingdom `8f80857` removes Make/shell -argument execution before custody handoff, uses public-only encryption of private -untracked JSON/YAML, and replaces editor-based updates with explicit private -replacement input outside Git. Edit/rotate require the matching temporary key -and exactly the registered recipient; extra recipient metadata is refused. -Original MAC and replacement ciphertext are verified, encryption policy is -preserved, and child diagnostics/plaintext are suppressed. Source checks and -atomic ciphertext replacement do not provide isolation from hostile same-UID -writers. Data-key rotation is explicitly distinct from recipient migration. - -Final unchanged-source suite: 585 passed, one unavailable privacyIDEA module -skip; all real-SOPS cases ran. The initial expanded run's checkout-name failure -and missing sibling-schema skips are retained, then resolved by correcting the -test workspace without changing source. A pre-commit generic-key match on the -redundant public-recipient comment was resolved by removing that comment; parsed -configuration is unchanged, and the normal eight-blob scan passed. Executable -source matches the final test binding. NK-WP-0049-T02 now names the remaining -key-export, MFA diagnostic, LDAP and realm-repair callers plus the complete -inventory reconciliation; T03 still requires exact owner-approved native recovery. -No production custody key was retrieved and no live decryption, Secret write or -deployment change was performed. Evidence: -`docs/evidence/2026-10-13-netkingdom-security/sops-write-callers.json`. - -2026-10-13 continuation: privacyIDEA key export/recovery source repaired in -NetKingdom commit 1cbe00fd78e60ac70f2ea7957a0e1d7477388dcf. Export preserves the existing encryption/audit -keys, validates private custody and exact pod/PVC ownership, and conditionally -creates or verifies DR Secrets. Recovery now restores the actual stopped -application PVC; old Secret-only and unmounted-helper instructions are withdrawn. -The unchanged tested source passed 631 tests, zero skips; actual privacyIDEA -3.12.2 decryption and audit-signature continuity passed in a disposable local -environment. All 15 applied paths match the test binding. This is not live cluster -or off-host recovery acceptance. NK-WP-0049-T02 remains progress for remaining -callers/inventory; T03 remains wait for owner-approved native recovery. Receipt: -`docs/evidence/2026-10-13-netkingdom-security/privacyidea-key-custody.json`. - -2026-10-13 continuation: bounded MFA-state diagnostic published in NetKingdom -`96feef46ab22811e3736231f04818655ca7b834e`. Removed retired Secret reads, insecure TLS, token argv -and raw provider errors. Explicit protected input, scoped token listing, inert -realm visibility proof before/after and complete counts distinguish confirmed, -pending and inactive factors. Real privacyIDEA 3.12.2 reproduces HTTP-200 empty -results after permission withdrawal; the diagnostic refuses them and accepts -permission recovery. Real self-service, tampered and expired tokens are refused. -Focused55 pass; full suite 1 failed, 685 passed, 4 warnings in 540.61s (0:09:00). One unchanged 50ms abort timing -assertion missed by 0.49ms; all46 tests in that module pass on unchanged rerun. -The original failure remains in the receipt. All nine applied paths match -the frozen test binding. KeyCape's workload delivery is not shared or expanded; -a live diagnostic needs separate owner admission. Native estate acceptance and -remaining LDAP/realm/inventory work stay open. Receipt: -`docs/evidence/2026-10-13-netkingdom-security/mfa-state-diagnostic.json`. - -2026-10-13 continuation: realm/bootstrap source repaired in NetKingdom -`30f0d2784018daa98e36e7c1042d4e2138a05a7c`. Reproduced old credential-file command execution -using a disposable marker; the replacement parses the same bytes literally. -Attended passwords stay in memory. Preview/explicit apply repairs missing core -configuration while preserving bind credentials, custom tuning, realm bindings, -defaults and owner-managed MFA policies; broad legacy policy replay is removed. -The console and guides use the supported flow, including fresh functional MFA -proof. Shared transport blocks unapproved origins, redirects/proxies and raw -error propagation. Actual privacyIDEA 3.12.2 proves minimal resolver updates -preserve omitted fields, correcting the old general replacement claim. -Frozen source passed all 723 tests with zero skips; four upstream deprecation -warnings. All 16 committed blobs match the test binding. Native/PTY/regression -receipts and limits: `docs/evidence/2026-10-13-netkingdom-security/realm-bootstrap-repair.json`. -No live provider or credential change. Remaining LDAP/incident-cutover callers, -full inventory and owner-approved native recovery keep NK-WP-0049 and G08 open. - -2026-10-14 legacy LLDAP lifecycle callers retired in NetKingdom `84c5dbe`. -Three shell helpers refuse before argument/credential processing or external calls; -Make targets no longer expand user input and console commands refuse before -metadata loading/delegation. Blank lifecycle worksheets no longer prefill successful -checks; existing validators reject unfilled templates. Ordinary onboarding now -points to existing User Engine/identity-provisioner contracts, while platform-root -and recovery remain separate owner procedures. Historical receipts are preserved -and older assessment snapshots explicitly superseded for this tooling. - -Eleven corrected-baseline regressions fail on old source; 28 focused and 76 total -affected tests pass with no skips. All 21 applied source files match the tested -manifest; five changed shell files pass syntax checks and the normal secret scan -is clean. Receipt: `docs/evidence/2026-10-14-netkingdom-security/legacy-lldap-retirement.json`. -No runtime/account/credential changed. Group bootstrap, membership management, -verify-t07, incident-cutover callers, complete inventory and native independent -recovery remain open under NK-WP-0049; G08 and this task remain progress. - -2026-10-14 provider boundary follow-up: NetKingdom `e861f63` reserves -`net-kingdom-` platform groups in the existing service-group request validator. -Prior source rejected `netkingdom-` suspension names but accepted the actual -platform users/admins namespace. Six regressions reproduce reaching directory -login from both ensure/revoke before repair; all 45 provider tests pass afterward. -Mixed requests and delete-if-empty also refuse before login. Receipt: -`docs/evidence/2026-10-14-netkingdom-security/platform-group-boundary.json`. -No rollout or live directory mutation; exact owner deployment and native checks -remain necessary before claiming live enforcement. NK-WP-0049 stays active. - -2026-10-14 LDAP group caller reconciliation delivered in NetKingdom `ab25dde`. -Bootstrap, membership and T07 wrappers now reuse provider operations and literal -private custody through one adapter. No executable credential sourcing, ambient -password fallback, credential argv, curl/kubectl or KeyCape config Secret read. -Bootstrap only creates missing empty fixed baseline groups; service membership -requires exact existing identities/groups and refuses reserved namespaces. -Preview/apply binds origin, operation, target and observed state; fresh prewrite -and final exact readback preserve unrelated data. Owner-controlled exclusive -maintenance remains necessary because LLDAP has no cross-query CAS; partial -failures require reconciliation, not blind rollback. - -Three old-source regressions failed; all 200 affected tests pass without skips. -An actual isolated local immutable LLDAP image passed preview, preservation, -idempotence, add/remove, reserved/stale refusal and T07 incomplete-exit checks. -The synthetic fixture/container/private files were removed. T07 is explicitly -structural-only (exit 2), not lifecycle/login/recovery acceptance. Receipt: -`docs/evidence/2026-10-14-netkingdom-security/lldap-group-maintenance.json`. -No live estate change. Incident-cutover/full inventory and owner-approved native -recovery/estate acceptance keep NK-WP-0049 and G08 open. - -2026-10-14 bounded incident resolver source repair completed in NetKingdom -`4dffe2f`. Both helpers now use attended memory-only input, scoped shared -transport, configuration/target-bound preview, one minimal password update and -native candidate/stored LDAP bind verification. Full reconcile pins cluster -identity/readiness, validates discovery, exact user and token-backed MFA, and -records missing predecessor evidence as incomplete. Raw notes, temporary secret -files, ambient endpoint overrides and default-overwriting writes are removed. - -Validation: 171 affected tests pass, plus disposable real privacyIDEA 3.12.2 and -LLDAP demonstrate bind refusal/replacement, preservation and actual HOTP. The -initial one-test fixture failure is retained; cluster/KeyCape gates are substituted -only in the native fixture, with production acceptance explicitly unverified. -Source docs/inventory and NK-WP-0049 are updated. Evidence: -`docs/evidence/2026-10-14-netkingdom-security/resolver-cutover.json`. -No live cutover or privileged credential retrieval. Full caller/root-output -inventory keeps T02 progress and owner-native recovery keeps T03 wait. The broad -consolidation goal remains cleared; this finishes only the requested current -resolver-helper task. Playwright T05 retains its existing owner-return gates. +Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, especially T14-T19, T29-T31 and T38-T40. Preserve G04/G07/G08/G10/G12/G13, original source defects and all existing owner obligations. T07-T13 expose completed bounded source reviews; they do not close this umbrella. Close only when all source/lifecycle findings have verified completion or a valid governed handoff consistent with the full target. ## Verify native closure against every requirement @@ -724,11 +121,7 @@ priority: high state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" ``` -Verify G01–G13 against current source/runtime receipts and the individual SEC-DSM -requirement ledger. Existing owner integration, attendance, residual-promotion -and recovery gates remain effective. Mark finished only when all required gaps -are verified closed or covered by complete actually approved exceptions; plans, -source-only tests and owner handoffs are not closure evidence. +Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact current evidence or an actually approved applicable exception. Require the human/agent journeys, second real consumer, clean installation and operational acceptance. Plans, source tests and owner handoffs are insufficient. Transfer any permitted residuals into live records before finishing; preserve required work and explicit deferrals. ## Coordinate self-service Playwright identity delivery @@ -740,73 +133,7 @@ depends_on: [RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] state_hub_task_id: "ed8b909a-23bf-5e5f-b600-e477fbae136b" ``` -User-requested addition on 2026-10-13. Accountable coordinating owner: -**the-custodian / custodian-codex**. Accept incoming request -`1b279bad-a159-43da-8709-1167882e62f8`; retain Platform's RPF-WP-0056-T03 -live acceptance and RAPP-PLAYWRIGHT-WP-0004-T01/T03 provider acceptance. -Delivery tracking: `infra/security-flow/playwright-delivery.json`, a cross-owner -case attached to these existing plans; no duplicate implementation plan. - -The pilot and namespace RBAC are delivered. Real human/agent authentication, -per-caller API transport, one-command trial, renewal/revocation and native -acceptance remain. All identified platform humans and coding agents already -qualify; no further membership decision is requested. The coordinator owns -collecting exact owner task/revision returns, resolving dependency gaps and -checking delivery evidence, not approving another owner's implementation. - -First executable milestone: review the prepared registration/authenticator -candidates with their existing owners, obtain their source task/revision and -rollback references, and document a supported transport for one real human and -one registered agent. Registration and governed custody (KeyCape/NetKingdom/ -Platform), native JWT authenticator (railiance-cluster), and per-caller transport -(ops-bridge/cluster) converge before Platform's integrated consumer command and -real human/agent trials. Existing request IDs and unaccepted owner returns are -preserved in the case; missing task IDs are explicit gaps, not invented commitments. - -Close only after Platform and provider accept native positive/negative identity, -permission, browser, lifecycle and recovery receipts, supported consumer docs, -and the maintained managed-availability discovery update. Message delivery alone -does not close this task. No new access gateway, shared administrator kubeconfig, -shared workstation SSH identity, or broader target/permission grant is required. - -2026-10-13 provider recovery return accepted for coordination: -`a2449fe0-ba12-47b8-9ca3-d7deedc089c3`, rapp-playwright commit -`2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. Reviewed committed local/managed -SIGKILL, partial-artifact cleanup, completed-hash preservation and fresh browser -trial receipts, including the initial transport failure. Same-image abrupt -recovery is delivered; no crash was repeated by the coordinator. Case references -and dependency wording now retain the narrower live gap: exact registration, -custody, native JWT authenticator and per-caller transport owner revisions, then -real human/agent trials and managed acceptance/discovery. Cross-version rollback -remains explicitly unproven in provider T01. No foreign task status was changed; -this task stays progress and no membership decision is reopened. - -2026-10-13 NetKingdom registration dependency advanced: `5dd74df` accepts the -actual implementation request in NK-WP-0050. T01 delivers the exact public -loopback/custom-scope and per-agent registration compiler using existing registry -merge operations. Nine new and 64 existing registration tests pass; native -KeyCape config/startup and generated token/JWKS exchange checks pass. The broader -159-test run retains two unchanged short-window failures; all seven tests in that -module pass unchanged on rerun. Receipt: `playwright-registration-preparation.json` -in the October 13 evidence directory. Case now links NK-WP-0050-T02 for governed -custody and guarded activation, with T03 awaiting actual issuer/consumer receipts. -No browser-case admission, custody grant, real identity trial or live rollout is -inferred. Other identity/authenticator/transport owner returns remain missing. - -2026-10-13 registration activation preparation published in NetKingdom -`eba6e1f`: single-Recreate stop/configure/resume sequencing, native verifier pin, -private proposal digest and exact object/data/spec conditions, pod-quiescence -checks, readback and original-state rollback now have 90 passing focused tests -with no skips plus native synthetic KeyCape startup checks. Follow-up `276b95f` -refuses reproduced implicit-audience and aliased-Secret collisions; both new -regressions failed before repair and pass afterward. Pre-existing clients -and bindings survive rollback; intervening drift refuses stale replay. -NK-WP-0050-T02 is progress. The module has no live CLI or Kubernetes connection; -protected executor/recovery-state integration, admitted identity/custody, exact -current image/cluster and supervised live acceptance remain open. Receipt: -`playwright-activation-preparation.json` in the October 13 evidence directory. -No live credentials or deployments changed; this does not close consumer delivery. - +Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da-8709-1167882e62f8`, [existing delivery case](../infra/security-flow/playwright-delivery.json), RPF-WP-0056-T03 and RAPP-PLAYWRIGHT-WP-0004-T01/T03. Existing eligible platform humans/coding agents need no renewed membership decision. Collect exact registration/custody/authenticator/per-caller transport returns and Platform/provider native acceptance. Do not substitute a deployed browser, shared admin kubeconfig or accepted provider-only crash proof for the actual human/agent journeys. ## Establish the target architecture and drive the restructuring @@ -817,632 +144,521 @@ priority: high state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29" ``` -Founder implementation request, 2026-10-16. Document the optimized target and -coordinate GPT-6.1-Sol medium agents against the existing owner work. Delivered -`docs/netkingdom-target-security-architecture.md` with sixteen scope-specific -acceptance gates and `docs/netkingdom-target-implementation.md` with ownership, -dependency and evidence rules. First dispatched source work: Secrets Engine -decision authentication, Platform durable cleanup, NetKingdom first-case -compatibility. Exact handles and artifact locations are in the implementation -record. Documentation link/ID checks pass. Implementation and native acceptance -remain open; this task closes only with the target's exit condition and T04 -requirement audit, not with the first source wave. - -2026-10-16 source wave published across eight owner repositories: NetKingdom -`c31d21ba`, Warden `95835208`, Glas `7357115c`, Platform `59d1441c` / `99fd21ee` / -`d042d468`, Secrets `c80a9441`, Access `ec21518e`, Approval `477c6839`, and Mason -`57411f25`. Independent reconstruction tests, actual disposable OpenBao/bwrap -checks and local Access serve-to-Secrets signature verification passed at their -bounded scopes. Exact revisions, failures and publication caveats are recorded in -`docs/changes/netkingdom-target-2026-10-16/source-wave-status.json` and its -coordinator review. No production trust, credential or runtime admission changed. -The subsequent source packages integrate Secrets packaging (`ebca4f5`) and strict -task authorization (`ff1a13d`), Platform journaled consume/confirm/effect -(`e2b832b`), and Approval canonical confirmation (`eece796`). Independent -verification passed 133 combined Secrets checks, seven packaging checks, all 130 -Platform checks and eight final mediator checks with the repaired Approval client. -The actual local provider path uses synthetic admission; the real task policy -still denies. Exact native expected-state readback/recovery and governed -package/key/caller admission are next. All sixteen acceptance gates remain open. - -2026-10-16 next source integration: Platform `d870596` adds exact committed -metadata baseline/readback and separate cleanup confirmation (32 independent -tests). Access `919ce25` adds exact native receipt checking and workload/audience -preparation (nine receipt and two runtime-twin tests); Secrets `5a2099f` records -native CLI/trust preparation and the 11-site/10-handler denominator, with zero -native effect acceptance. Approval `3485415` provides the shared owner Go claim -adapter (14,114 independent actual Python byte/digest comparisons); Access -`4f6946b` adds the real service caller HTTP join and generic task bypass refusal. -Exact commit/publication receipts retain State Hub timeouts and scanner results. -Trusted v2 source, strict consumer successor, authenticated process-loss cleanup -recovery and signer custody are the next reviewed packages. Old positive stack -proof remains pinned to Access `ec21518e`; it does not validate the new task path. -No native gate, live grant, deployment or credential admission is closed here. - -Platform `b9eaa20` adds independently admitted process-loss cleanup recovery after -53 passing root tests. Root review required exact absence semantics and capsule -integrity; failures and revised proof remain retained. Lost token issuance without -persisted accessor and actual custody/isolation remain open. Trusted successor -source passed the full Access Go suite and 176 focused Secrets tests, but actual -whole-stack work found incompatible time budgets and retained-registry digest -correspondence. Owners are repairing those contracts before successor integration; -no empty-registry shortcut or timing waiver establishes acceptance. - -2026-10-16 coordinator checkpoint: all six subsequent canonical receipt file hashes -match their owner commits and every commit is an ancestor of origin/main. The -actual immediate-consumption path also exposes whole-second Approval receipt -precision against fractional decision start times; owner resolution is required. -Access, Secrets and Platform continue the retained-registry end-to-end repair. - -Coordinator independently reproduced expired fractional Approval consumption -against canonical `3485415`: expiry .500, actual clock .750, consumed_at .000. -Owner repair is part of the protected-operation gate. NK-WP-0049 now supplies -actual independent identity archive recovery evidence; remaining service -authentication, token decryption and audit continuity are still required. - -2026-10-16 successor source integration: Access `2b064ee` and Secrets `4dd004a` -now preserve producer-evaluated approval facts and exact numeric types across the -retained-registry join. Approval `d40e842` fixes fractional expiry with a single -post-lock instant; the original counterexample and scanner refusal are retained. -Platform `76fdc0b` adds absolute budgets; `7be8b6e` supplies the complete successor -proof and bounded signer custody source. Root independently passed seven affected -Go packages, 193 Secrets tests, 98 Approval tests, 28 budget tests, eight complete -provider-to-OpenBao cases and twelve disposable signer tests (overlapping suites, -not an estate coverage score). Native issuer/key/grant/deployment/audit gates stay -open. Access outbox process locking and capacity limits, Platform exact native -writer preparation, and Secrets immutable release/install proof are active owner -follow-through. No existing PVC or managed-package identity is assumed. - -2026-10-16 next checkpoint: Access `0a05383`, Warden `d79f065`, Secrets `3718e60` -and Platform `a3e8eb6` published through normal owner synchronization, with exact -committed-file hashes independently verified. Installed Warden routing now selects -the required attended admin lane and retains phase-memory. Root checks passed -Access race/chart validation, 135 routing tests, 56 phase-aware signer tests and -clean reproducible Secrets bundle installation. Original failures are retained. - -Canonical local package `rapp-flex-auth-secrets-engine` now has reviewed commit -`d52f811`, exact tree and local owner/workload resolution; it remains draft with -no remote or native admission. The ordinary Access publisher failed after pushing -source `0a05383` because Python was absent on its runner. Reviewed source repair -`84c78e0` uses Bash/Docker metadata validation and records the package reference; -normal source synchronization and successor CI observation are underway. Audit -`64509d2` specifies existing-API reconciliation against a complete independently -retained producer ledger, with independent contract tests. Its sender/cadence and -operational observer gates remain open. Platform prepared exact custody source -pins and distinct missing owner inputs; no approval or native scope was invented. -All sixteen target gates remain open pending scope-matched native acceptance. - -The ordinary successor publisher run402 and both smoke401 jobs succeeded for -exact `84c78e0`. Root independently verified public commit statuses, the unique -registry digest `sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f` -and explicit source revision label. Exact rollout values, stopped/ready source -renders and Platform projection are prepared separately from native evidence; -consumer pre-key trust and custody P2 remain proposed. Checkpoint `fa0fc15` -published and synchronized 89/89 with no failures; generated-only writeback was -refused without bypass. Original failures and all native gates remain retained. - -2026-10-16 source simplification checkpoint: Access `dc04202` adds exact zero/one -writer Helm maintenance states; Platform `84c529f` separates runtime/storage -review from GitOps ownership. Both are published with normal sync receipts and -exact committed-file hash verification. Independent checks cover 86 actual Helm -renders plus existing outbox tests, 45 Platform native/preparation tests and 54 -overlapping cluster custody tests. Focused CCR0050 validation passes; unconfirmed -claims and unrelated baseline CCR0035 errors remain. The initial public-digest -scanner refusal is retained; typed OCI metadata passed the unchanged scanner. -Cluster own-review record `RCLUSTER-WP-0017` was published at `523669f`; the source -role correction received a bounded owner review. Its prefix warning conflicts -with ADR-007 because the checker infers the retired prefix from historical files; -the correct IDs and assigned UUIDs are preserved. Successor rollout/custody packets are being -prepared. No custody, deployment, trust, storage or protected effect occurred; -all sixteen target gates remain open. - -2026-10-16 source preparation successors: exact rollout R2 and custody P4 now -join published chart `dc04202`, image source `84c78e0` and Platform `84c529f`. -Root reproduced frozen Helm outputs and passed eight packet assembler tests; -P4 corrects preserved P3 ownership prose without changing executor or scope. -Cluster's own T01 source review is complete; its native T02/T03 remain open. -Stopped Helm uses explicit bounded fence verification without PVC waiting or -automatic restart of the running predecessor. Founder identity, expiry, actual -held window, approved CCR and native dispositions remain unresolved. Checkpoint -`50de8be` published and synchronized 89/89 with zero failures. No target gate is -closed by these source preparations. - -2026-10-16 native preparation: coordinator public-metadata observation and exact -seven-resource server dry-run passed on the verified railiance01 target at -18:53 UTC. API admission retained the frozen stopped projection and replicas zero; -the actual release remains running at Helm revision four. No persistent mutation, -held writer fence, credential/custody action or native activation occurred. -Reviewed wrapper, exact payload and actual receipts are retained under -`docs/changes/netkingdom-target-2026-10-16/native-preflight-r1/`. -Parallel owner work now integrates the workload-only combined runtime and native -registry parity checks, with independent Secrets preparatory-package selection. -All sixteen target gates remain open; this is progress toward their native -acceptance rather than a reduced completion criterion. - -2026-10-16 owner checkpoint: Access `d328a260` and Platform `08c1f036` -published independent bounded rollout reviews, separating initial rollout/CCR -authorization from final one-use custody assent. Secrets `a4f1802`/`5356810` -selected and recorded the actual inert local package installation; all ten catalog -rows and empty-key refusal passed without caller/socket access. Rein `9b88cad` -published the combined runtime lock; the actual isolated manager proof passed and -the coordinator independently rehashed all 1447 artifact records unchanged. -Five owner commits and their public evidence are bound in -`docs/changes/netkingdom-target-2026-10-16/source-wave11-coordinator-review.json`. -None establishes live signer/caller admission, an accepted protected effect, -actual interactive-assignment migration or completion of a TSA gate. - -2026-10-16 continued implementation: NetKingdom `015694ee` fixes disagreement -between JSON schema and Python validation of exact machine-descriptor pins; -the coordinator independently passed 21 new tests and verified committed files. -Reuse `dd00b27` strengthens the existing mandatory parity validator; corrected -NetKingdom/Bootstrap indexes are published. Forced hosted composition at 19:25 -returned all 70 reviewed capabilities exactly once with correct owners and both -corrected descriptions/tags. KeyCape `3c71226` reconciles the already-deployed OTP -help link and names the actual remaining attended recovery steps. Independent -NetKingdom recovery evidence now accepts retained token-material decryption and -historical audit signature continuity (T20/T31), while real MFA and service -continuity remain open. Exact owner commits and receipt scope are recorded in -`docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json`. -Separate GPT-6.1-Sol medium owner agents are implementing the missing browser -registration and isolated KeyCape recovery adapters in temporary candidates; -neither candidate is admitted for native execution. - -2026-10-16 checkpoint publication: `cf59a5f` and `5a50901` published the reviewed -native preflight, independent owner plans, inert installation, combined-runtime -proof and follow-up owner/discovery evidence. Both normal reconciliations synced -89/89 bindings with zero failures/automation errors; seven background warnings -and four informational findings remain. Original staged brief bytes/index and -unrelated work were preserved. The initial public-hash scanner refusal was -resolved by typed hash metadata without changing values or bypassing scanning. -Warden `d97652a3` subsequently refreshed its reviewed producer pins; coordinator -verification passed 87 actual integration/refusal checks without pin overrides. -The registration adapter independently passed 36 source checks after binding the -checker executable into its descriptor, and was published at `0775c2bf` with exact -source-file equality independently verified. Normal owner synchronization -reconciled all 16 task records, with four assigned UUIDs and publication evidence -retained in owner `0394484`. All three normal passes returned zero failures and -automation errors; generated-only hook refusals and 25 final warnings remain. -No native checker/callback/identity was admitted. -Recovery adapter revision three independently passed 52 synthetic checks, with -all 14 dependency hashes verified. Exact daemon routing and early plaintext -cleanup registration are corrected; the remaining cleanup-versus-parent-lifetime -race requires a successor before canonical integration or native proof. -All sixteen target gates remain open. - -2026-10-16 continued artifact/runtime review: coordinator reproduced the exact -KeyCape checker executable from published source with all declared source, -toolchain and module hashes verified; eight real-checker/helper/kernel fixtures -pass. Separate KeyCape owner review is underway. The existing NetKingdom caller -needs explicit checker environment and executable-path containment. Recovery R4 -passed 61 independent checks, including disposable deadline/hard-parent-loss -processes, but a reproduced nonzero-Docker uncertainty gap requires a successor. -Native pinned-image fixture preparation continues with policy-lock write access -limited to temporary policy data. No actual credentials or native acceptance -were exercised. Checkpoint `86a5b0d` published and synced 89/89 with zero failures -and seven background warnings; original staged brief and unrelated work preserved. - -2026-10-16 founder-requested pause: stop after current normal publication and -checkpoint sync. NetKingdom `916ba4b` publishes deterministic checker environment/ -path selection, with 39 affected and 11 real-artifact checks independently passed; -KeyCape `834b0d0` publishes its bounded owner review. Recovery R5 passed 67 source/ -process checks, but the actual disposable Docker positive fixture failed before -native verification. All registered resources/plaintext were removed and absence -independently checked. Retain the failed receipt and exact frozen R5; diagnose -before another trial. No actual credential recovery or target acceptance was -claimed. Full resume points and outstanding native gates are in the implementation -record's requested-pause section. Workplan tasks stay open; pause is not completion. - - -2026-10-16 explicit resume: GPT-6.1-Sol medium agents resumed recovery, browser -source and independent target-audit lanes. Browser immutable checker snapshot -passed 49 source and 12 real-artifact integration checks independently, then the -exact five-file patch was applied to the NetKingdom owner checkout. Owner -publication remains a separate receipt. R6 recovery preserves the anonymous-volume -refusal while masking the pinned helper image's declared volume with bounded -tmpfs; 72 checks and the first actual synthetic Docker positive passed. Original -TLS/signer, native service allow/deny, stored bytes and cleanup passed; real -owner-held recovery and all sixteen target gates remain open. Independent -scheduling prerequisites prove host report/hub access but fail the selected rein -startup readiness check. Full evidence and next acceptance steps are linked from -the implementation record's resumed-implementation section. - - -Resume follow-through: all four synthetic R6 native Docker cases passed, including -exact process-loss/deadline quiescence and retained uncertain-response refusal. -Host-device-bound independent checks retained the three reaper outcomes and -confirmed every exact resource/plaintext absent. The sandbox's separate tmpfs -initially hid those receipts; that observation failure remains recorded. -Recovery source is integrated; publication encoding R7 preserves runtime bytes, -uses typed public checksums after a retained normal scanner refusal, and passes -73 checks. NK-WP-0049-T32/T33 separate delivered source proof from preparation of -the real owner-held attempt; T18 remains open. Browser source8790dd18 and record -85a54ab are committed, with19 projected owner tasks matching. Actual local scanner -baseline and refusal cases completed with temporary fixtures removed. Two model -workers hit their usage limit after completed commands; coordinator verified the -receipts and continued integration. No native target gate or rotation deferral -changed; the full goal remains active. - - -Recovery source publication verified at `5fcd5952`: all eight added files match, -all33 projected tasks agree (T32 source proof done, T33 preparation todo, T18 -actual recovery wait), normal sync has zero failures/automation errors and30 -warnings, and the original staged/working brief is preserved. Full frozen fixture -packets remain workspace-local; canonical owner source, published independent -host cleanup/reaper evidence and the canonical integration receipt retain the -bounded delivered result. The target-wide goal remains active. - - -2026-10-17 source implementation follow-through: coordinated GPT-6.1-Sol medium -owner agents delivered group provenance/recovery source (`4f65e41`, NetKingdom) -and bounded staged-scanner batching (`83c521b`, Repo Manager). Independent canonical -runs passed 65/111/42 checks respectively. Actual disposable LLDAP passed 14 oracles -with independent exact-resource cleanup; four generated cases passed through the -configured shared/Custodian hooks using alternate indexes. Thirteen old/new scanner -parity cases match. The 16/64 small-blob medians improved from 12.065/49.172 to -0.884/0.904 seconds; one small blob slowed. These are bounded local results. - -Review corrected production SQLite-volume advice before publication: ADR-0015 -requires CNPG/rapp-postgres or an explicit governed exception. SQLite remains -local/disposable. NK-WP-0048-T20 records delivered preparation; T14 retains native -storage, scope, writer fencing, callbacks, evidence and revocation. NK-WP-0049-T34 -records sealed-custody/preflight source; T35/T36 track original TLS/registration -bindings, T33 readiness and T18 actual recovery. Public source identifies the -railiance-cluster ingress/backup boundary and a historical secrets-engine-openbao -selector without current assent or private reads. RMGR-WP-0021-T05 stays progress -because actual-hook unavailable-scanner acceptance remains pending. All sixteen -target requirements stay open. Publication/task-projection/preservation checks: -`docs/changes/netkingdom-target-2026-10-16/resume-integration-r1/`. -No rotation, live deployment, actual key recovery or authority promotion occurred. - -2026-10-17 continued verification and owner refinement: NetKingdom `70f408ca` -publishes the PostgreSQL provenance backend and real-SOPS regression successor. -Canonical provisioner tests pass 82. The actual disposable PostgreSQL trial passes -21 oracles, including restart/revoke, same-counter divergent forks, lost replies -and dump/restore rollback refusal; all exact resources are independently absent. -LDAP remains synthetic in this SQL fixture. Failed R2/R3/R4 returns are retained; -review repaired a real nested receipt-reference bug and two fixture snapshot -defects. NK-WP-0048-T21 records completed source/SQL proof; T14 retains actual -CNPG, owner callbacks/checkpoints/custody, all-writer fencing and native admission. -NK-WP-0049-T37 records all 65 actual SOPS cases (61 previously skipped plus four -sealed-FD cases); historical T34's skipped result stays unchanged. Actual recovery, -TLS/trust, registration/private admission and MFA remain open. - -Repo Manager `9ebde0a9` completes only RMGR-WP-0021-T05 after ten fixture checks, -six actual configured-hook cases and exact hard-loss cleanup pass. Five projected -task bindings and remote HEAD match; T03/T04 and TSA-10/15 remain open. -Secrets Engine `c59bbf56` publishes SECRETS-WP-0015 with four exact projected task -bindings and both dependency edges. RCLUSTER-WP-0018 source is prepared but remains -unpublished behind the correct immutable-history guard. Do not replace the three -historical parent or 15 task UUIDs to force publication. - -State Hub receiver `51bc70d1` and source-only dry-run repair `086d79a2` are published -and authoritatively projected. The CI image digest and selected receiver/migration/ -hub-core files and 86 package metadata entries are independently verified without -executing or installing the image. Ten disposable actual SQL migration/old-write -compatibility oracles pass; production migration timing/full application behavior -remain unproved. The real server dry-run now passes with server-side dry-run for -the two Secret templates and the existing annotation policy intact. The full -rollout includes the inbox migration already on main; Helm rollback retains that -schema, and its timeout does not automatically stop a running migration Job. -Final exact values-preserving review and scoped founder rollout approval remain -separate. Keep the registrar guard until receiving is delivered and verified. -The one unresolved projected STATE95 dependency deliberately points to the -not-yet-admitted RMGR19 successor; it is not permission to activate it early. - -Evidence: `docs/changes/netkingdom-target-2026-10-17/`, the exact published owner -sources, retained fixture revisions and the implementation record. All sixteen -native target gates remain open; no production rollout, private recovery, -credential rotation or autonomy grant occurred. - -Final checkpoint: the exact packaged-chart, digest-pinned reuse-values server -dry-run passes with eight identities and only three image changes. Revision 4 of -`STATE-WP-0095-T06-cluster-frozen-receiving-r1` is recorded as pending in the -existing supervision record, preserving the original revision/digest, adverse -preparation history and all authority fields. The final proposal explicitly -includes the inbox migration and conditional exact-Job recovery, with unpriced -EUR exposure and unknown mapping requiring attended owner recovery. No live -action is approved or executed. Four coordination receipts attach foreign waits -without messages or worker wakes. Source/remote/Hub readback verifies 66 new -checkpoint owner bindings plus the nine Repo Manager/Secrets bindings; source -counts and native acceptance remain separate. - - -## Approved receiver execution, 2026-10-17 - -This checkpoint supersedes the pending-rollout state recorded above. The founder's -“good, go ahead” approved exact revision 4 of -`STATE-WP-0095-T06-cluster-frozen-receiving-r1`, digest -`63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32`. -Decision `e3798419-8aa9-5425-8c08-20df6bd82a19` records -`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` for that -proposal and its exact conditional recovery, with no autonomy grant. - -The owner Helm upgrade succeeded as revision 76. API and MCP are Ready on the -approved image digest `c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015`; -primary/railiance01 reports applied and expected schema `c4d5e6f7a8b9`. -Delivered historical projection module hash matches the reviewed image. Full-row -hashes and column sets of all three historical workplans and fifteen tasks are -identical before and after deployment. Five actual native receiving cases pass: -preserve, foreign holder, missing task, nonterminal parent and nonterminal task. -Every probe rolled back; zero commits and a fresh-transaction full-row comparison -confirm preservation. Helm succeeded and the migration Job disappeared after -its exact UID and owned Pod were observed; no Job Succeeded event is claimed. -No recovery was needed. The exact owned staging archive/directory was removed. - -Only after these observations was the frozen seven-file registrar source applied. -Canonical focused checks pass 47; the actual read-only Cluster allocator preview -proposes exactly seven missing UUID fields in the new WP0018 and one existing -ADHOC task. Fifteen invalid historical labels and five collisions remain reported; -no archive rewrite, direct database UUID repair or broad syntax exception occurred. -Owner publication and receiving follow-through are recorded separately below. - -Evidence: `docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json` -and its hash-bound actual native receipts; registrar source/application and preview -receipts in `registrar-followthrough-r1/`. The same original supervision trial -retains all preparation revisions and failures; accepted-revised execution earns -no unchanged-success credit. All sixteen native target gates remain open. - - -## Ordinary Cluster publication and retained acceptance failure, 2026-10-17 - -Cluster owner commit `c562d7134c38679952a8ffd17a8a893a900aef0d` is published and -reconciled on primary/railiance01 at the exact expected/derived revision. WP0018's -five task ID/UUID/status bindings and three internal edges match source and the -remote. Exactly seven missing fields were assigned by the normal managed path, -including one existing ADHOC task field. All three frozen archive hashes remain -unchanged, and original staged/dirty generated files were restored exactly. -Registrar source admission `70cd7549` is published and verified, with T05 done; -source preparation and actual Cluster acceptance remain separate outcomes. - -The stronger full-row guard FAILED after the required legacy deep consistency -pass: the three historical parent hashes changed, while all fifteen task full -rows remain identical. The native forge projection reports preservation, but -that does not establish preservation for the whole pipeline. Source review found -that `PUT /workplans/index/bindings` writes backing fields and a new sync timestamp -without consulting the frozen-history guard; ORM update timestamps also advance. -The checker calls this route even during checks. Only whole-row baseline hashes -were retained, so exact changed columns/values cannot be reconstructed from the -baseline. No guessed timestamp or database restoration is performed. - -This later failure does not erase the earlier passing rollout and rollback-only -probe results. It prevents RMGR-WP-0019-T06 and STATE-WP-0095-T07 completion. -The existing State Hub owner record carries the source guard and regression -follow-up plus its separate reviewed runtime-delivery obligation. Source edits, -fixtures and successful publication do not stand in for that new native return. -No further production rollout is authorized by the earlier revision-4 approval. - -Evidence: `docs/changes/netkingdom-target-2026-10-17/cluster-publication-readback.json`, -`railiance-cluster-projection.json`, and -`receiver-rollout-r4/ordinary-pipeline-preservation-finding.json`, including the -retained `post-publication-full-row-hashes-FAILED.json` and exact archive checks. -All sixteen native target gates remain open. - - -## Verified installed-client repair and exact runtime successor, 2026-10-17 - -State Hub source guards and real writeback regression are published through -`c103cbf3c8bed5dba87a03e320595ddded9301a3`; the later WP-only checkpoint is -`9eaa36143ea18111c522ea14d32978495b4e5030`. Canonical guard checks pass 102, -independent review passes 109, and five actual disposable Git checks verify -file-scoped commits with unrelated staged/dirty state and hook refusal preserved. -Normal chart rendering and classification checks pass. The first attempted -client rerun loaded an older installed package and failed again; its actual -receipts stay retained. The installed owner package was then refreshed and its -loaded checker hash verified against R6 source before the next run. - -The corrected actual ordinary Cluster maintenance passes: 20/20 ordinary -bindings, three frozen bindings omitted, and all eighteen CURRENT full-row -hashes unchanged before/after. Original failed parent hashes are not restored -or relabeled as successes. The old writeback helper also included an unrelated -staged brief during legitimate C23 activation. Forward correction -`6ae3f847c83da3402883453ee7110457bfb2d0d6` preserves active WP18, restores the -prior committed brief, and reinstates its exact original staged/worktree bytes; -dirty WORK-RECORDS and archive hashes are preserved. No history was rewritten. -Repo Manager `1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd` retains T05 done/T06 wait -and projects T06's actual dependency on STATE-WP-0095-T10. State Hub T07 also -waits on T10; all ten own task UUIDs remain exact, T09 done/T10 human wait. - -The normal CI guard image at -`sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1` -is inspected read-only against runtime source `c103cbf`. Selected guard/receiver/ -migration/build files match; package metadata and hub-core source hashes equal -the deployed image's observations. Exact pinned-package reuse-values server -dry-run passes eight identities and only three image changes. Fresh explicit -target/headroom/schema checks pass. The prepared eight native cases enforce -commit interception and rollback; their actual schema/interception contracts -are checked without a DB connection, but these new native cases are not executed. - -Exact successor `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 1 is pending, -metadata digest `81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932`, -decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. It requests scoped new-image -approval, current-baseline acceptance with the old failure retained as an -exception, and exact conditional recovery/rollback to Helm 76. Unknown EUR -cost/risk or Job/DB mapping is not a free or bounded exposure. The prior -revision-4 approval does not approve this successor. Current runtime remains -healthy Helm 76 on the approved `51bc70d` image; no new API guard delivery or -native security-gate closure is inferred. The original supervision record -retains successful earlier-stage execution plus later failures; its new request -is pending/not executed and grants no authority. - -Evidence: `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/`, -`receiver-rollout-r4/before-verified-client.json`, `after-verified-client.json`, -`verified-loaded-client.json`, `verified-client-cluster-consistency.json`, -`verified-client-cluster-projection.json`, the exact owner publication packets -and `rollout-owner-bindings.json`. The original receiver/registrar case is -satisfied; the successor attaches to the existing retirement driver and stops -at the human gate. TLS metadata work remains an owner wait. No worker was woken. -All sixteen native target gates remain open. - -The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained. - -The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`. - - -## Approved API guard delivered and verified, 2026-10-17 - -The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2, -SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, -through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned -`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1` -image is delivered at Helm 77. API and MCP are Ready; applied/expected schema -remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone, -and only the verified owned chart staging was removed. No recovery was needed. - -All eight deployed owner-handler cases passed with enforced commit interception, -rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline -passes with the verified installed checker: 20/20 ordinary bindings, three frozen -bindings omitted, and all eighteen CURRENT historical full rows unchanged across -the rollout, native probes and maintenance. All three frozen archives and -unrelated staged/worktree state are preserved. The earlier three-parent mismatch -remains a founder-approved historical exception: unavailable old preimages were -not guessed, restored or relabeled as a passing result. Runtime acceptance is -separate from all sixteen NetKingdom native target gates, which remain open. - -Frozen acceptance return: -`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`, -SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`. -The supervision record retains original revision 1, the approved/executed revision -2, exact digests and successful refined outcome; it grants no autopilot authority. - -Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken. - -## Source-owner follow-through and native preparation, 2026-10-17 - -NetKingdom `c52ca7f405416d437951844c0640b86e677c3523` publishes the exact-one -original client selector guard, four early-refusal regressions and the scoped -unexecuted fixture-manifest successor. Root independently passes those four -checks; the owner's 39 adapter checks and four affected manifest checks pass. -The prior stale-hash refusal and original frozen native receipts stay retained. -This guard acts after decryption and before further runtime inputs; it supplies -no archive/TLS/consumer/native acceptance. NK49-T38 records this completed source -outcome. NK48-T22/T23 record the distinct registration and storage owner reviews. -All 58 old task blocks are preserved; 61 actual source/remote/primary task -bindings and active internal dependencies are verified after normal publication. -Initial overly broad historical-edge verification refused; the corrected check -uses the actual C20 source rule, preserving the refusal and original verifier. - -Secrets Engine `691dc742362eeec45d5bd32d2b468f31a959748e` publishes its exact -original-consumer custody plan and marks SECRETS-WP-0015-T03 done for source -preparation. Four task UUIDs and T04's human-wait dependencies on T03/NK49-T33 -are verified. The candidate observer remains unwired/unexecuted on real input; -five synthetic checks establish only claim parsing/source/input refusals. -Original TLS/archive/private admission, original OpenBao/custody/MFA recovery, -actual signed-token/resource-server denials and revocation remain native owner -work. Existing protected-backend scopes stay in SECRETS0008/0013. - -The completed owner reviews leave NK48-T14/T15/T16 implementation/native gates -open. The proposed package/SQL candidate, original-context seam and six missing -descriptors do not create native authority. GLAS's bounded real-model proposal -retains its existing Claude profile, spend/metering/native approval requirements -and immutable runtime; it does not migrate this Custodian assignment. The private -scanner-response lane still needs an actual owner contract. APPROVAL-WP-0002 -remains residual and was not promoted. All sixteen target native gates are open. - -User-directed NetKingdom source/history investigation locates the requested -StorageShare recovery guide: publication commit -`31f483966cdfca4df1d326dee3ec0b6d33ea0e5e`, actual readback 16 October 18:01 UTC, -Backup account, `railiance-backups/net-kingdom-identity/`, filename -`net-kingdom-recovery-57d1940947aa25ff-START-HERE.md`, with ZIP/checksum. -The local guide matches that recorded publication. Current remote visibility, -original TLS custody and whole-estate recovery are not established by this -identity-only guide. No share, credential, backup or current remote file changed. - -Evidence: dated 17 October native/source/consumer packets listed in -`docs/netkingdom-target-implementation.md`, especially each owner's verified -bindings and `storage-share-tls-r1/source-history-followthrough-r2.json`. -All current task statuses remain appropriate: T03/T05/T06 progress, T04 todo, -T01/T02 done. No completion percentage or native closure is inferred from the -new completed source-review tasks. This remains the active implementation goal. - -## Runtime installation and refined offline verification, 2026-10-17 - -Exact founder-approved installation revision 2 ran once under decision -`b6abb6ab-b182-4b4f-9f84-79ddc5ad91f3`. The inactive f599 runtime is installed -and its complete native digest independently verified. The required offline -launcher rehearsal failed (`phase_receipt_unavailable`, supervision reason -`leader_left_descendants`). Its watchdog reported positive process quiescence; -independent readback verified the full installed digest and owned staging absence. -The same supervised trial records failure; no native target -gate or runtime acceptance is complete. - -The frozen source has a locally reproduced zombie-classification bug, but the -native failure's cause remains unproven. Reviewable verification-only revision 3 -repairs that source defect and preserves a durable public receipt before cleanup, -keeping the full three-launcher acceptance requirement. Root verified 18 candidate -and 29 frozen revision 2 file pins; five focused local process/cleanup checks pass. -The founder approved exact revision 3 under -`bec667cc-15ea-4f87-ae16-111f08562e48`, proposal SHA256 -`7d5741abc7da042d4de6cd36437801309b844760f606b3145d615fd75d6b2d30`. -Its first read-only preflight refused CPU headroom (99.25% busy; limit 85%). -After the main publication checks finished, one fresh preflight passed at 66.33% -CPU busy. The exact approved controller ran once. All three original empty-egress -offline launcher checks exited zero with complete f599 before/post digest equality; -its journal reports three dead adopted zombies reaped and positive quiescence. -Independent native readback verified full f599 again, owned staging absence and -the retained0600 public checkpoint's exact match to the local precleanup receipt. -The same trial records refined success with the original failed revision 2 -receipt/history preserved; no unchanged original-success credit is inferred. -No reinstall, model call, credential/profile/queue change or autonomous live -retry is authorized by the failed revision 2 run. Revision 3's separate exact -approval covers the completed verification only. EUR cost remains unmeasured. -All six task blocks, UUIDs and statuses remain unchanged; all sixteen native -target gates remain open. Evidence is linked from the implementation document's -dated partial-runtime-installation checkpoint. - -2026-10-17 user-directed KEY-WP-0039 finalization review: its accepted source -deliverables remain done (T01/T03); all 14 reviewed executable/test/decision pins -and three Platform pins still match. Exact Hub readback confirms the existing -registration go covers KEY37-T03's original secrets-engine-openbao client; it -does not admit new probe credentials or coding-client custody. That original -approval remains valid, and the reviewed-command standing attended rule has its -separate existing scope. T02's actual negative/expiry/revoke/cleanup -receipt is absent in the bounded source search; KEY38-T02/T03 and the existing -unadmitted coding-client custody/owner readiness returns remain prerequisites. -The parent stays active, T02 waits, and no native gate closes. No new helper -protocol or repeated original-client registration approval is required. Evidence: -`docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/`. - - -2026-10-17 T03 implementation checkpoint: independent GPT-6.1-Sol medium -reviewers checked the actual Warden kernel, fixed issuer-reference and Apps -inverse candidates. Reviewed kernel corrections plus the narrow ambient-lookup -unit-test fix are integrated and published at Warden `922c26d`; the normal -allocator's existing completed-task UUID addition is retained separately from -implementation `ae7bc73`. All four WP44 task bindings/statuses remain unchanged. -Platform `104ed90` publishes the proposed exact issuer ESO source; NetKingdom -`342a6f25` and `befb0bc6` carry independent mint regressions, valid catalog -fixtures and exact proposed issuer-template text. Source tests and limitations -are recorded in docs/netkingdom-target-implementation.md. NK48 refinement adds -completed source tasks T32/T33/T35 and keeps T34 progress for the real Apps -inverse/backend; T16 and first native case remain open. The fresh inverse-session -prototype is corrected and tested, but no real owner backend or authority is -invented. Earlier rejected reviews, the possible ambient lookup and failed -preparations remain retained. All six coordinator task blocks/statuses/UUIDs -are unchanged; all sixteen target native gates remain open. - - -2026-10-17 T03 safe-unit follow-through: Warden `b593c879` integrates the -ordinary test-entry guard after independent rejection and root review of the -minimal O_TRUNC/provenance corrections. The corrected full ordinary make test -passes 785 tests, four deselected, under synthetic ambient-token/HOME/Python/ -pytest sentinels. Source, pins, catalog and four WP44 task blocks are unchanged. -The known ambient-lookup accident path has a supported isolated test entry; -this is not an OS sandbox or actual assignment isolation, and original adverse -unknown outcomes remain retained. Evidence: dated warden-safe-unit-integration-r1 -and warden-safe-unit-runner-review-r1 packets. Coordinator task statuses and all -sixteen native acceptance gates remain unchanged. - -2026-10-17 T03 concrete owner follow-through: Platform source d35c0f9d is -published/projected with reviewed exact broker source validation and the -human-only issuer catalog correction. New normal-allocator RPF-WP-0060 makes -the four existing owner review obligations live tasks; T02 done, T01 progress, -T03/T04 todo. Independent delivery review rejects the first command candidate -for freshness/defaulting/transport/race defects; no inert prototype counts as -operational delivery. Actual Apps chart/image inspection proves the existing -CLIENT_SECRET reference can work but the exact three-group any-of sign-in gate -cannot be expressed by the current literal field. Nine offline/render checks -are independently reproduced. NK48 task refinement records completed source -proof T36 and real implementation T37, preserving all prior 35 task blocks. -Existing T34 inverse/session/journal/exclusion and T16/T06 admission/native gates -stay open. Evidence is linked in the implementation record. All six coordinator -task blocks/UUIDs/statuses and all sixteen native gates remain unchanged. +Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity, authorization, approval, custody and audit; reuse producer clients, case templates and owner workplans. Keep all sixteen gates and the complete ledger in scope. This task closes with the target exit condition and T04 audit, not another source wave. Prior delegation is historical evidence, not an inherited runtime/autopilot grant. + +## T07 - Review signed decision and approval interoperability + +```task +id: CUST-WP-0080-T07 +status: done +priority: high +state_hub_task_id: "bb236dea-30f7-5437-b01c-f14d2509e061" +``` + +Stage: source evidence. Owner implementation: Access Engine / Secrets / Approval; FLEX-WP-0024, SECRETS-WP-0014, APPROVAL-WP-0004. + +Completed source review of actual producer-to-consumer signing, strict handoff, precise approval consumption and independent confirmation. Published implementations and local/disposable cross-owner proofs exist. Live signer, caller, policy and package admission remain T21/T22. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json). + +## T08 - Review the shared current-token client and fresh inverse session + +```task +id: CUST-WP-0080-T08 +status: done +priority: high +state_hub_task_id: "18b885fe-503f-5ebc-b390-808f71316264" +``` + +Stage: source evidence. Owner implementation: KeyCape / Warden; KEY-WP-0042-T04, WARDEN-WP-0044. + +Published producer-owned current-token client, generated adapter/drift check and fresh inverse-session verification. The actual cross-owner fixture passed 45 assertions. Immutable original provenance grants no replay authority. Actual target operation/inverse remains T16/T17. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md). + +## T09 - Review actual issuer-to-Forgejo current-token login + +```task +id: CUST-WP-0080-T09 +status: done +priority: high +state_hub_task_id: "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410" +``` + +Stage: source evidence. Owner implementation: KeyCape / Apps; KEY-WP-0042, RAPPS-WP-0016-T09. + +Actual issuer/provider/callback passed five process scenarios: two current grants accepted; mixed pair, revoked grant and suspended human refused. The selected composed suite passed 116 test/subtest results without skips. MFA/PDP admissions were synthetic. Ongoing operations remain T14/T15; live acceptance remains T23. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/validation-summary.json). + +## T10 - Review Forgejo PostgreSQL recovery and inverse mechanics + +```task +id: CUST-WP-0080-T10 +status: done +priority: high +state_hub_task_id: "1f3c78af-5686-58ea-9133-8afc2df36b8f" +``` + +Stage: source evidence. Owner implementation: Apps / NetKingdom; RAPPS-WP-0016-T07/T08, NK-WP-0048. + +Actual Forgejo model/schema tests passed 37 results across three PostgreSQL profiles, including process death and actual database restart, exact inverse, drift and writer-lock counterexamples. This is disposable database/source proof. Fresh operation authority, durable journal custody and exclusion of every release writer remain T16-T18. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/README.md). + +## T11 - Review the bounded receive-scanner correction + +```task +id: CUST-WP-0080-T11 +status: done +priority: high +state_hub_task_id: "bffd4e10-2cf0-5835-a8d0-ae1763ca3873" +``` + +Stage: source evidence. Owner implementation: Forge / Repo Manager; FORGE-WP-0010-T01. + +Forge ea65606c is published. The exact refused 141-object/one-ref delta passes in 52.53 seconds under the unchanged 90-second deadline. There are 54 distinct passing leaf cases and no skips. Original failures are retained. Native rollout and ordinary publication remain T20. + +[Evidence](../docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md). + +## T12 - Review provider discovery and source/index parity repairs + +```task +id: CUST-WP-0080-T12 +status: done +priority: high +state_hub_task_id: "bb09e414-6d79-5dcd-b8e6-b73a046a4dda" +``` + +Stage: source evidence. Owner implementation: Reuse / Bootstrap / NetKingdom; existing provider records. + +Verified published provider index/parity changes and owner source bindings. This closes the dated source review, not ongoing hosted freshness, source-link/version correctness or recurring drift acceptance; those remain T33. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json). + +## T13 - Review workload-credential isolation in the sandbox fixture + +```task +id: CUST-WP-0080-T13 +status: done +priority: high +state_hub_task_id: "793e78f0-7782-5e48-bdc0-b65127b32ecb" +``` + +Stage: source evidence. Owner implementation: Glas / rein; GLAS-WP-0012, CUST-WP-0073. + +Published workload-only credential delivery passed 141 tests and actual disposable bwrap host/environment/subprocess denial, redaction and teardown checks. The current interactive Custodian assignment is not admitted by that fixture. Real assignment and runner acceptance remain T27/T28. + +[Evidence](../docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json). + +## T14 - Verify current identity on browser, API and Git HTTP paths + +```task +id: CUST-WP-0080-T14 +status: todo +priority: high +depends_on: [CUST-WP-0080-T09] +state_hub_task_id: "7ecbd622-03a8-5b49-9621-8d21d7d15890" +``` + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: Actual shared authentication routes enforce current linked account/source/subject/application-tenant bindings, current groups and exact resource/action policy. Tests must cover revoked, suspended, expired, unavailable and mismatched identity, plus terminal refusal without fallback. Preserve the separate local break-glass path and prevent federated unlink/downgrade escape. + +## T15 - Verify current identity on the independent SSH path + +```task +id: CUST-WP-0080-T15 +status: todo +priority: high +depends_on: [CUST-WP-0080-T14] +state_hub_task_id: "434d9c78-7789-5b78-8d9d-d87b0638b469" +``` + +Stage: source integration. Owner implementation: Apps / KeyCape / Access; RAPPS-WP-0016-T09, NK-WP-0048-T43. + +Completion test: The actual private SSH service checks the same producer-owned identity and policy contract before repository creation or effects. Native SSH keys cannot bypass current linked identity. Positive, denial, revocation, unavailable and account/source mismatch cases pass; local break-glass behavior is covered. + +## T16 - Verify exact current authority for the protected Forgejo operation + +```task +id: CUST-WP-0080-T16 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07, CUST-WP-0080-T08, CUST-WP-0080-T09] +state_hub_task_id: "e6183073-cc8e-5c6f-8fbd-db50bb1a466c" +``` + +Stage: source integration. Owner implementation: NetKingdom / Warden / Apps / Approval / Access; existing NK-WP-0048 operation tasks. + +Completion test: The actual operation entry path authenticates the current actor/session and binds tenant, exact target/action, payload/source revision, decision and required approval before journal writes or owner effects. Wrong actor/body/tenant, expired authority, unavailable producers and business replay refuse. Existing producer contracts remain authoritative. + +## T17 - Verify the fresh inverse and durable private recovery journal + +```task +id: CUST-WP-0080-T17 +status: todo +priority: high +depends_on: [CUST-WP-0080-T16] +state_hub_task_id: "4de46468-7ae2-59e3-be2b-1a32506153a5" +``` + +Stage: source integration. Owner implementation: Apps / Warden / NetKingdom; RAPPS-WP-0016-T07/T08 and existing NK-WP-0048 inverse tasks. + +Completion test: An exact prior operation can be reconciled and inversed with fresh current authority while retaining original provenance and unknown outcomes. Private journal custody, permissions, persistence, retention and recovery are explicit. Cover public client, unchanged secret delivery and failure before hand-over receipt; receipt deletion alone is not the inverse. + +## T18 - Verify exclusion of every Forgejo release writer + +```task +id: CUST-WP-0080-T18 +status: todo +priority: high +depends_on: [CUST-WP-0080-T10, CUST-WP-0080-T16] +state_hub_task_id: "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f" +``` + +Stage: source integration. Owner implementation: Apps / NetKingdom / deployment owners; existing NK-WP-0048 writer obligations. + +Completion test: Inventory and constrain every actual release/configuration writer for prepare/check/effect/inverse, including uncooperative writers. Demonstrate target drift and concurrent-write refusals at the declared database/release scope. A local advisory lock or the earlier source transaction test alone cannot close this checkpoint. + +## T19 - Verify the complete final Forgejo release and OCI artifact + +```task +id: CUST-WP-0080-T19 +status: todo +priority: high +depends_on: [CUST-WP-0080-T14, CUST-WP-0080-T15, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] +state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8" +``` + +Stage: artifact build. Owner implementation: Apps; RAPPS-WP-0016 build/operation tasks. + +Completion test: Build the final integrated revision with pinned source/tool/dependency inputs, all frontend/static assets and the static backend. Verify release CLI/source parity, complete required checks, artifact hashes and the local OCI package. Prior 40-path build evidence does not establish a later integrated release. Independent admission and live acceptance remain T23. + +## T20 - Accept the native receive-scanner correction and ordinary publication + +```task +id: CUST-WP-0080-T20 +status: progress +priority: high +depends_on: [CUST-WP-0080-T11] +state_hub_task_id: "0d9df435-b9a2-5b89-833d-799785c969a9" +``` + +Stage: native acceptance. Owner implementation: Forge / Apps / Repo Manager; FORGE-WP-0010-T02/T03. + +Completion test: Current work: seal the activation/recovery executor, finish resource/drift preflight and obtain independent package/owner admission plus exact founder go. Verify the exact installed binary, guarded startup, 166 declared hook copies, new-repository inheritance, clean/blocked/unavailable behavior, cleanup and ordinary queued source publication. Conditional forward/inverse and server dry runs already pass; no live change has occurred. + +## T21 - Accept signed decisions at the native privileged consumers + +```task +id: CUST-WP-0080-T21 +status: todo +priority: high +depends_on: [CUST-WP-0080-T07] +state_hub_task_id: "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258" +``` + +Stage: native acceptance. Owner implementation: Secrets / Access / Platform; SECRETS-WP-0014, FLEX-WP-0024. + +Completion test: Admit exact producer package, signer/channel, independent consumer trust and caller/policy bindings. Account for the privileged PEP denominator and prove native forged, altered, wrong-key, unsigned/downgrade, expired, unavailable and rotation refusals. Source fixtures do not close TSA-01. + +## T22 - Accept one native approved operation and crash recovery + +```task +id: CUST-WP-0080-T22 +status: todo +priority: high +depends_on: [CUST-WP-0080-T21, CUST-WP-0080-T16, CUST-WP-0080-T17, CUST-WP-0080-T18] +state_hub_task_id: "88588db8-8c6e-5d15-a85b-2c068f4e8a2a" +``` + +Stage: native acceptance. Owner implementation: Platform / Secrets / Approval / Audit; RPF-WP-0035-T12, SECRETS-WP-0013, APPROVAL-WP-0004. + +Completion test: One exact approved effect passes authoritative consume/confirmation, target precondition/readback and independently verified cleanup. Native crash/restart/concurrency preserves unknown outcomes and forbids blind replay; actor/tenant/body/replay/expiry/unavailable negatives pass. Admit real custody and recovery grants. Closes only the declared TSA-02/TSA-03 scope. + +## T23 - Accept the complete first Forgejo browser security case + +```task +id: CUST-WP-0080-T23 +status: todo +priority: high +depends_on: [CUST-WP-0080-T19] +state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90" +``` + +Stage: native acceptance. Owner implementation: NetKingdom / Mason / Warden / KeyCape / Apps; NK-WP-0048. + +Completion test: Admit exact case/type/provider/package revisions and private execution custody. Independently verify native structure, contained registration/delivery, sign-in, denied groups/actions, current ongoing API/Git/SSH access, revocation, exact inverse and rollback. Owner assent and actual deployed receipts are mandatory; a compiled patch or acknowledged case is insufficient. + +## T24 - Accept attended U08 factor recovery and fresh sign-in + +```task +id: CUST-WP-0080-T24 +status: todo +priority: high +state_hub_task_id: "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853" +``` + +Stage: human journey. Owner implementation: User / KeyCape; USER-WP-0028-T03, KEY-WP-0040. + +Completion test: Requalify the existing User task to the actual founder-attended disable/re-enroll/fresh-login window and obtain its value-free acceptance. KEY-WP-0040 preview/help-link corrections are already accepted; do not request or repeat that preview. No factor mutation is authorized by this plan refinement. + +## T25 - Accept the real human Playwright journey + +```task +id: CUST-WP-0080-T25 +status: todo +priority: high +state_hub_task_id: "3be1c76d-a5f3-5dea-9777-349dc97e836e" +``` + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; RPF-WP-0056-T03, RAPP-PLAYWRIGHT-WP-0004, NK-WP-0050. + +Completion test: Collect exact registration/custody/JWT-authenticator/per-caller transport owner returns, then run the supported command as one real human. Verify sign-in, scope/permission denial, browser operation, renewal/revocation and recovery, accepted by Platform and provider. Existing qualified humans need no new membership decision. + +## T26 - Accept the registered agent Playwright journey + +```task +id: CUST-WP-0080-T26 +status: todo +priority: high +state_hub_task_id: "0491b6b4-a238-58ef-bf3a-505749e5655c" +``` + +Stage: consumer acceptance. Owner implementation: Platform / Playwright / NetKingdom / cluster / bridge; same existing consumer case as T25. + +Completion test: Use one distinguishable registered agent and its admitted per-caller transport, not a shared admin kubeconfig or workstation identity. Verify the supported command, allowed/denied browser/API actions, expiry/cancellation, revocation and cleanup, with Platform/provider acceptance and supported consumer documentation. + +## T27 - Accept the actual interactive agent isolation profile + +```task +id: CUST-WP-0080-T27 +status: todo +priority: high +depends_on: [CUST-WP-0080-T13] +state_hub_task_id: "19540d29-c4df-5f1a-acf7-127965c9a396" +``` + +Stage: runtime acceptance. Owner implementation: Glas / selected rein / Platform / Warden; GLAS-WP-0012, CUST-WP-0073-T02/T04. + +Completion test: Admit this identified running assignment and verify admin-material read denial through files, mounts, environment, subprocesses and available tools, plus allowed task effects, expiry/cancel cleanup and no cross-task credential accumulation. Fixture success or another agent's authority record cannot substitute. + +## T28 - Accept per-job runner authority and workflow-abuse refusals + +```task +id: CUST-WP-0080-T28 +status: todo +priority: high +state_hub_task_id: "5ac99f55-0dde-5d1c-b88c-b85f34469abc" +``` + +Stage: runtime acceptance. Owner implementation: Forge / Platform / enablement; existing runner and CI owner work. + +Completion test: Verify actual job-specific credential/repository/deployment scope, teardown and abuse tests using repository-controlled workflows. Reuse the accepted Docker listener repair; do not repeat it as new progress. Prove jobs cannot disable the independent receive control or reach unrelated deployment credentials. + +## T29 - Reconcile the current credential and consumer metadata inventory + +```task +id: CUST-WP-0080-T29 +status: todo +priority: high +state_hub_task_id: "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec" +``` + +Stage: lifecycle evidence. Owner implementation: Secrets / Mason / Platform / NetKingdom; MASON-WP-0004, NK-WP-0049. + +Completion test: Produce a current metadata-only denominator with owner, purpose, exact scope, issuer/delivery, consumers, copies, expiry/rotation/revocation and recovery/deletion procedures. Unknown/orphan entries remain findings. Identify native-identity elimination candidates. Never retrieve values to improve the inventory. + +## T30 - Accept sampled credential replacement, revocation and copy deletion + +```task +id: CUST-WP-0080-T30 +status: todo +priority: high +depends_on: [CUST-WP-0080-T29] +state_hub_task_id: "457400ad-6c44-5160-a77a-63c6ad5acabc" +``` + +Stage: lifecycle acceptance. Owner implementation: Secrets / Platform / credential consumers; existing lifecycle plans. + +Completion test: For the admitted samples, demonstrate replacement adoption, old-credential refusal, refresh/deletion semantics and reconciled delivery copies. Preserve the founder-deferred exposure rotation; it requires its actual governing exception/decision rather than silent execution or a completion claim. + +## T31 - Accept independent root recovery with the normal issuer unavailable + +```task +id: CUST-WP-0080-T31 +status: todo +priority: high +depends_on: [CUST-WP-0080-T29] +state_hub_task_id: "cbf32375-279a-5bf3-b867-06333a1ff2ca" +``` + +Stage: recovery acceptance. Owner implementation: NetKingdom / Warden / Platform / recovery owners; NK-WP-0049, WARDEN-WP-0027. + +Completion test: In a fresh authorized scenario verify independent/off-host custody and access, restore, existing MFA/service/consumer continuity, reconnect and audit continuity; measure RTO/RPO. Reuse accepted archive/source proofs without equating them to complete native recovery. Honor scoped authority and the build-mode single-holder decision. + +## T32 - Accept independent effect-to-outbox-to-audit reconciliation + +```task +id: CUST-WP-0080-T32 +status: todo +priority: high +depends_on: [CUST-WP-0080-T22] +state_hub_task_id: "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18" +``` + +Stage: audit acceptance. Owner implementation: Audit Core / emitting owners; AUDIT-WP-0013/0014/0015 and existing emission tasks. + +Completion test: Admit actual sender/source/class inventory and reconcile the first protected effect, atomic outbox and durable independent receiver readback. Account for lag, duplicates, missing classes and failure recovery. Archive custody alone is not source completeness; State Hub remains an index, not credential/evidence custody. + +## T33 - Accept current discovery, version and package-family accuracy + +```task +id: CUST-WP-0080-T33 +status: todo +priority: high +depends_on: [CUST-WP-0080-T12] +state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920" +``` + +Stage: discovery acceptance. Owner implementation: Reuse / Repo Manager / capability owners. + +Completion test: Recheck all 70 reviewed capability IDs exactly once against owner source, usable links, truthful limits, versions/aliases and package-family disposition. Verify hosted/provider index parity and recurring drift behavior. Source owners remain authoritative; do not create another capability catalog. + +## T34 - Accept the first unassisted security-flow run + +```task +id: CUST-WP-0080-T34 +status: todo +priority: high +state_hub_task_id: "393b9fcc-323b-5182-92c6-44530fce7efb" +``` + +Stage: operational acceptance. Owner implementation: Activity / Coordination / Custodian; ACTIVITY-WP-0047, CUST-WP-0079. + +Completion test: Admit and activate the existing schedule through its owner path, observe an unassisted firing, checkpoint and changed-state notification, and verify adopted cadence at runtime and receiver. A schedule acknowledgement or source cadence constant does not count. Scheduling never creates action authority. + +## T35 - Accept a second real consumer using the shared adapters + +```task +id: CUST-WP-0080-T35 +status: todo +priority: high +depends_on: [CUST-WP-0080-T23] +state_hub_task_id: "db274192-07d6-5be7-9c1e-d63c5a9fb57f" +``` + +Stage: reuse acceptance. Owner implementation: NetKingdom / provider owners / selected second consumer. + +Completion test: The second actual consumer uses the same producer-owned identity/decision/approval adapters and case contracts. Verify allowed/denied-path parity, version compatibility, upgrade and rollback without a second PDP, token registry or independently copied evaluator. Record the per-consumer integration work. + +## T36 - Accept a clean second installation of the minimal profile + +```task +id: CUST-WP-0080-T36 +status: todo +priority: high +depends_on: [CUST-WP-0080-T23] +state_hub_task_id: "586232a1-57b0-5e04-a61b-fb687bcc8999" +``` + +Stage: installation acceptance. Owner implementation: NetKingdom / provider and installation owners. + +Completion test: Use locked versions/providers and declared optional dependencies to install a minimal profile from clean state. Complete positive/negative journeys and upgrade/recovery instructions with independently checked results. Source reuse alone does not prove installability or portability. + +## T37 - Measure delivery time, runtime cost and performance improvement + +```task +id: CUST-WP-0080-T37 +status: todo +priority: high +state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538" +``` + +Stage: measurement. Owner implementation: Resource / telemetry / consumer owners; CUST-WP-0071 where applicable. + +Completion test: Record baseline and comparable after measurements for onboarding time/manual touches, p50/p95 decision/effect latency, scanner throughput/failures, resource/headroom and owner effort with unchanged control coverage. Retain the measured scanner correction as one completed sample; do not generalize it to all workflows. + +## T38 - Reconcile requirement-level exceptions and explicit deferrals + +```task +id: CUST-WP-0080-T38 +status: todo +priority: high +state_hub_task_id: "2350a829-bd8c-5c3b-9f39-07bfa1c3f228" +``` + +Stage: governance evidence. Owner implementation: Custodian / governance / affected owners; close-down checklist and actual founder decisions. + +Completion test: Map each remaining exception/deferral to the exact SEC-DSM requirement, scope, real approval reference, risk, compensating controls, owner and review/revalidation. Preserve missing approvals as open; never invent assent, backfill a scored success or promote all residuals. Required leftovers become live work records before finishing. + +## T39 - Accept declared source and delivery entry-path coverage + +```task +id: CUST-WP-0080-T39 +status: todo +priority: high +depends_on: [CUST-WP-0080-T20, CUST-WP-0080-T28] +state_hub_task_id: "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c" +``` + +Stage: delivery acceptance. Owner implementation: Forge / Repo Manager / enablement; RMGR-WP-0021 and existing Forge owner work. + +Completion test: Reconcile the production-repository denominator and actual SSH/HTTP/UI/new-repository/import/mirror entry paths, required checks and artifact provenance. Keep the external-submodule compatibility exception visible. Assess any necessary FORGE-WP-0008 residual dependency for explicit owner-scoped promotion before implementation; existing hook presence alone cannot close TSA-10. + +## T40 - Accept a private finding through classification and response + +```task +id: CUST-WP-0080-T40 +status: todo +priority: high +depends_on: [CUST-WP-0080-T39] +state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e" +``` + +Stage: response acceptance. Owner implementation: Repo Manager / Forge / incident and credential-custody owners; RMGR-WP-0021-T04. + +Completion test: Run an admitted private synthetic finding through the actual detection, classification, custody/response and resolution path with sanitized independent receipts. Establish owner responsibility for revocation where relevant. Rejecting a push or deleting source material does not itself prove incident resolution; do not send raw findings or credentials through coordination messages. + +## Acceptance coverage and close-down + +| Architecture gate | Custodian evidence checkpoints | +| --- | --- | +| TSA-01 | T07, T21 | +| TSA-02 | T07, T16, T22 | +| TSA-03 | T08, T10, T17, T18, T22 | +| TSA-04 | T09, T10, T14, T15, T16, T17, T18, T19, T23 | +| TSA-05 | T24, T25, T26 | +| TSA-06 | T13, T27, T28 | +| TSA-07 | T29, T30 | +| TSA-08 | T31 | +| TSA-09 | T32 | +| TSA-10 | T11, T20, T28, T39, T40 | +| TSA-11 | T12, T33 | +| TSA-12 | T34 | +| TSA-13 | T07, T08, T09, T35 | +| TSA-14 | T36 | +| TSA-15 | T37 | +| TSA-16 | T04, T38 | + +| Gap | Custodian evidence checkpoints | +| --- | --- | +| G01 | T24 | +| G02 | T08-T10, T14-T19, T23 | +| G03 | T07, T16, T21, T22 | +| G04 | T29, T30 | +| G05 | T13, T27 | +| G06 | T32 | +| G07 | T11, T20, T28, T39, T40 | +| G08 | T29, T31 | +| G09 | T30, T38 | +| G10 | T38 | +| G11 | T31 | +| G12 | T28-T30 | +| G13 | T07, T21 | + +All mapped checkpoints retain their stated scope. A completed source checkpoint +does not close a gate that also requires native or consumer evidence. The original +requirement ledger remains the requirement-level denominator. Uncovered work +stays live; no required gate becomes a residual merely to finish this plan.