diff --git a/docs/changes/CUST-WP-0080/observe_forge_hooks.py b/docs/changes/CUST-WP-0080/observe_forge_hooks.py
new file mode 100644
index 00000000..4bf966bd
--- /dev/null
+++ b/docs/changes/CUST-WP-0080/observe_forge_hooks.py
@@ -0,0 +1,14 @@
+import json,subprocess,re,datetime
+shell='set -eu\nbase=/data/git/gitea-repositories\nprintf \'repository_directory_count\\t\'\nfind "$base" -mindepth 2 -maxdepth 2 -type d -name \'*.git\' | wc -l\nfor name in access-engine approval-engine audit-core gate-house glas-harness key-cape kings-guard maturity-engine net-kingdom ops-mason ops-warden policy-nexus railiance-forge railiance-platform repo-manager role-engine secrets-engine security-canon tenant-engine the-custodian user-engine zone-engine; do\n repo="$base/coulomb/$name.git"\n if ! test -d "$repo"; then printf \'missing\\t%s\\n\' "$name"; continue; fi\n printf \'repo\\t%s\\n\' "$name"\n git --git-dir="$repo" config --get core.hooksPath || test "$?" = 1\n if test -n "$(find "$repo/hooks" -maxdepth 2 -type l -print -quit)"; then exit 77; fi\nfind "$repo/hooks" -maxdepth 2 -type f ! -name \'*.sample\' -exec sha256sum {} \\;\ndone\n'
+r=subprocess.run(["kubectl","-n","forgejo","exec","forgejo-gitea-7d94988c79-8k76l","-c","gitea","--","sh","-c",shell],capture_output=True,text=True,timeout=60)
+if r.returncode: raise SystemExit("Read-only hook inventory failed; raw diagnostics suppressed.")
+rows=[];current=None;count=None
+for line in r.stdout.splitlines():
+ if line.startswith("repository_directory_count\t"): count=int(line.split("\t")[1])
+ elif line.startswith("repo\t"):
+  current={"repo":line.split("\t")[1],"hook_files":[],"core_hooks_path":"unset"};rows.append(current)
+ elif line.startswith("missing\t"): rows.append({"repo":line.split("\t")[1],"missing":True})
+ elif re.fullmatch(r"[0-9a-f]{64}  /data/git/gitea-repositories/coulomb/[a-z0-9_.-]+/hooks/[a-zA-Z0-9_./-]+",line):
+  digest,path=line.split("  ",1);current["hook_files"].append({"relative_path":path.split("/hooks/",1)[1],"sha256":digest})
+ else: raise SystemExit("Unrecognized metadata suppressed; no inventory claim.")
+print(json.dumps({"observed_at":datetime.datetime.now(datetime.timezone.utc).isoformat(),"host":"railiance01","image":"code.forgejo.org/forgejo/forgejo:11.0.3-rootless","pod":"forgejo-gitea-7d94988c79-8k76l","repository_root":"/data/git/gitea-repositories","repository_directory_count":count,"repositories":rows,"scope":"Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation."},indent=2))
diff --git a/docs/evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json b/docs/evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json
new file mode 100644
index 00000000..8303097a
--- /dev/null
+++ b/docs/evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json
@@ -0,0 +1,901 @@
+{
+  "observed_at": "2026-10-12T15:53:14.407749+00:00",
+  "host": "railiance01",
+  "image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
+  "pod": "forgejo-gitea-7d94988c79-8k76l",
+  "repository_root": "/data/git/gitea-repositories",
+  "repository_directory_count": 165,
+  "repositories": [
+    {
+      "repo": "access-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "approval-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "audit-core",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "gate-house",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "glas-harness",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "key-cape",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "kings-guard",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "maturity-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "net-kingdom",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "ops-mason",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "ops-warden",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "policy-nexus",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "railiance-forge",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "railiance-platform",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "repo-manager",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "role-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "secrets-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "security-canon",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "tenant-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "the-custodian",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "user-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    },
+    {
+      "repo": "zone-engine",
+      "hook_files": [
+        {
+          "relative_path": "proc-receive.d/gitea",
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        {
+          "relative_path": "post-receive.d/gitea",
+          "sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
+        },
+        {
+          "relative_path": "pre-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "proc-receive",
+          "sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
+        },
+        {
+          "relative_path": "update",
+          "sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
+        },
+        {
+          "relative_path": "update.d/gitea",
+          "sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
+        },
+        {
+          "relative_path": "post-receive",
+          "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
+        },
+        {
+          "relative_path": "pre-receive.d/gitea",
+          "sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+        }
+      ],
+      "core_hooks_path": "unset"
+    }
+  ],
+  "scope": "Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation.",
+  "template_comparison": {
+    "source_url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go",
+    "source_sha256": "c7d149a66c2e1170e50b6f6bd9fd1c96cbfab68dfed3e664d503bfb05e4e1348",
+    "matches_by_sha256": {
+      "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef": {
+        "template_index": 2,
+        "shell": "bash",
+        "executable": null,
+        "config_path": null,
+        "quoted": true
+      },
+      "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6": {
+        "template_index": 1,
+        "shell": "bash",
+        "executable": null,
+        "config_path": null,
+        "quoted": true
+      },
+      "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc": {
+        "template_index": 3,
+        "shell": "bash",
+        "executable": "/usr/local/bin/gitea",
+        "config_path": "/data/gitea/conf/app.ini",
+        "quoted": false
+      },
+      "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f": {
+        "template_index": 4,
+        "shell": "bash",
+        "executable": "/usr/local/bin/gitea",
+        "config_path": "/data/gitea/conf/app.ini",
+        "quoted": false
+      },
+      "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5": {
+        "template_index": 5,
+        "shell": "bash",
+        "executable": "/usr/local/bin/gitea",
+        "config_path": "/data/gitea/conf/app.ini",
+        "quoted": false
+      },
+      "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748": {
+        "template_index": 6,
+        "shell": "bash",
+        "executable": "/usr/local/bin/gitea",
+        "config_path": "/data/gitea/conf/app.ini",
+        "quoted": false
+      },
+      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855": {
+        "template": "empty proc-receive.d/gitea"
+      }
+    },
+    "result": "All seven unique hook hashes match upstream generated templates for bash, /usr/local/bin/gitea and /data/gitea/conf/app.ini; 22 hook directories contain only the eight observed standard files, with no symlinks at the inspected depth. No custom scanner hook is installed at this boundary. Forge internal policies and Actions/branch-protection checks were not assessed."
+  },
+  "observer_sha256": "db2bdb37794a427a9b9543ecb9a3b35d5310c77417e6edb6da726ad87992237d",
+  "next_action": "Define admitted production repository inventory and owner-controlled introduced-history prevention, preserving Forgejo hooks. Verify SSH/HTTP/merge paths and CI authority separately; do not enable arbitrary user Git-hook editing or replace the generated dispatchers."
+}
diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md
index 021e8702..97badca3 100644
--- a/docs/netkingdom-security-gaps.md
+++ b/docs/netkingdom-security-gaps.md
@@ -103,6 +103,14 @@ acceptance remain open. [Activation receipt](evidence/2026-10-12-netkingdom-secu
 All four DSM-DETECT requirements now have incomplete assessments rather than
 unverified placeholders. [Receipt and exact hook inventory](evidence/2026-10-12-netkingdom-security/secret-detection.json).
 
+G07 server baseline: the 22 reviewed repositories on railiance01 have only
+upstream-generated receive hooks, verified by matching all observed hashes to
+[Forgejo v11.0.3 templates](https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go).
+No custom scanner hook is installed at that boundary. The 165 repository
+directories are a discovery count, not a reviewed production denominator.
+Actions/branch-protection and actual push refusal are still unverified.
+[Read-only inventory](evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json).
+
 ## SEC DSM requirement coverage
 
 Each numbered requirement in these families is in scope for assessment. The
diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
index bd3715e4..f2b6e049 100644
--- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
+++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
@@ -163,6 +163,16 @@ exact proposal, backups and rollback: `docs/changes/CUST-WP-0080/`. Independent
 forge/CI enforcement, other clones/history and detection-to-response remain open.
 No DSM requirement or whole G07 closure is inferred from this local acceptance.
 
+2026-10-12 G07 forge baseline: read-only observation confirmed railiance01 and
+Forgejo 11.0.3. Its repository storage has 165 repository directories (not yet an
+admitted production denominator). All 22 reviewed repositories exist and their
+receive-hook files exactly match the seven distinct hashes generated by upstream
+v11.0.3 templates, with no extra hook files/symlinks at the inspected depth.
+No custom scanner hook is installed there. Branch-protection/Actions coverage,
+internal policies and actual push rejection remain unverified. Metadata and
+upstream comparison: `forge-secret-detection-baseline.json`. No server mutation,
+credential read, repository-content scan or synthetic push was performed.
+
 ## Verify native closure against every requirement
 
 ```task