From 6548540fd46c7fcd365f399516a5d36e38d1e7fd Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 17 Oct 2026 23:14:27 +0200 Subject: [PATCH] Record reviewed owner implementation and consumer compatibility (3) --- .../apps-chart-projection-r1/OWNER-CHANGE.md | 98 +++ .../apps-chart-projection-r1/README.md | 59 ++ .../apps-chart-projection-r1/SHA256SUMS.json | 35 + .../apps-source.patch | 95 +++ .../helm/forgejo-registry-values.yaml | 14 + .../postimages/helm/forgejo-values.yaml | 141 ++++ .../helm/forgejo-registry-values.yaml | 14 + .../consistency.json | 631 ++++++++++++++++++ .../consistency.stderr.txt | 1 + .../identifier-assignment.json | 44 ++ .../identifier-preview.json | 44 ++ .../projection.json | 449 +++++++++++++ .../projection.stderr.txt | 0 .../publication-commit.json | 29 + .../publication-inputs.json | 27 + .../source-application.json | 44 ++ .../verified-task-bindings.json | 28 + .../workplan.md | 113 ++++ 18 files changed, 1866 insertions(+) create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml create mode 100644 docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.stderr.txt create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json create mode 100644 docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md new file mode 100644 index 0000000..b2812bd --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md @@ -0,0 +1,98 @@ +# Actual case gate needs an owner change + +The frozen first-case set remains **any one of** `forge-admins`, +`forge-coulomb-owners`, `forge-coulomb-readers` before sign-in completes. +Do not reduce it to one group, permit arbitrary authenticated users, use only team +access as the gate, add an unmanaged umbrella directory group, or interpret a +comma string/regex as a supported any-of expression. + +## Exact blocker and existing compatible portion + +Forgejo **11.0.3**, not chart appVersion 1.25.4, is the Apps image override. +Its `cmd/admin_auth_oauth.go:89-96` defines a singular StringFlag; +`services/auth/source/oauth2/source.go` stores `RequiredClaimValue string`; +`routers/web/auth/oauth.go:1430-1443` calls +`groups.Contains(oauth2Source.RequiredClaimValue)`. Only the *incoming claim* +is converted to a set (array or comma string, lines 1103-1118). The required +value is never split or compiled as a regex. Three alternatives cannot be +represented. Repeating the singular flag does not establish OR semantics. +Chart 12.5.0 accepts arbitrary OAuth keys and emits them as CLI flags; inventing +`requiredClaimValues` renders successfully but emits the unsupported flag +`--required-claim-values`. Helm success alone is insufficient. + +The secret-reference issue requires no secret/schema migration. In the existing +`gitea.oauth` entry set public `key: forgejo`, omit `secret`/`existingSecret`, and +append `deployment.env` variable `GITEA_OAUTH_SECRET_` with +`valueFrom.secretKeyRef` name `forgejo-netkingdom-oidc-client`, key `CLIENT_SECRET`. +Chart `_helpers.tpl:196-213` supplies the quoted runtime variable automatically, +and deployment.yaml adds `deployment.env` to `configure-gitea`. The tested +render uses the actual existing delivery shape. ExistingSecret alone would +request nonexistent keys `key` and `secret`, even when inline `key` is supplied. +The preparer preserves list order, all other OAuth sources/environment entries, +mailer reference, DB/admin configuration and all unrelated settings. It refuses +an existing target or indexed variable collision pending exact reconciliation. +No new key alias, ESO object or custody ACL is needed. This reference seam is +source preparation, not an accepted runtime deployment. + +## Recommended next owner proposal: app-specific derived union claim + +This is a **new proposal**, not a feature present in KeyCape or an admitted +extension of type 1.3. Read source is pinned at KeyCape +`d803e9282a47b49daf930fb905312fa5104c0ace`. +`src/internal/config/config.go:ClientConfig` has no custom/derived claim fields; +`src/internal/server/oidc/token.go:211` emits the original directory groups; +`src/internal/server/oidc/userinfo.go:87-89` emits those same groups for the groups +scope. `UserinfoHandler` has no per-client configuration today. Tenant-role +cache claims are unrelated and explicitly fail open; do not reuse them. + +KeyCape owner can add a narrowly defined, validated per-client derived claim +configuration, propagated through the existing registration conversion and +canonical client model. For the reviewed `forgejo` client, propose claim +`forgejo_access` with the single literal string `allowed` iff the resolved human +user's original groups intersect the exact three-group set. Omit the claim +otherwise. Preserve the original `groups` array byte-for-byte in its existing +serialization and retain `groupClaimName: groups` for role/team mapping. No +new LDAP group or copied membership set should exist. + +The actual owner source change must cover `src/internal/config/config.go` and +validation, `src/internal/domain/model.go` and canonical-model conformance, +client construction in `src/cmd/keycape/main.go`, and a shared pure derivation +used from both `src/internal/server/oidc/token.go` and `userinfo.go`. Bind the +rule to the *authenticated registered client*, never a request claim/client +query argument or user-controlled attributes. UserInfo currently only gets +Users/SigningKey/Issuer/Emitter; its wiring must receive trusted client rules +and authenticate a signed client binding. Account for ID-token client audience +versus an access token's optional resource audience; do not infer the client +from an ambiguous resource audience. Refresh/re-read actual current groups in +UserInfo, reject failed/ambiguous identity reads, and ensure a stale positive +ID-token claim cannot bypass a negative current UserInfo claim in Forgejo's +actual provider merge path. That last behavior requires source/fixture proof +before this proposal is considered viable. If it cannot be guaranteed, choose +a separately reviewed Forgejo source/image extension instead. + +Apps would then require claim name `forgejo_access`, value `allowed`; keep +`groupClaimName: groups`, local sign-in, disabled auto-registration and local +credential account linking. The tested current chart can render those two +existing singular CLI fields without a chart modification. This changes +1.3's claim-shape contract even though the exact access-set semantics stay the +same. NetKingdom/KeyCape/Apps must review the rule, re-freeze exact source/case, +registration renderer/descriptors and acceptance hashes, and use a separately +identified type revision if required by existing immutability rules. Do not +smuggle extra fields through the existing registration adapter or assert that +1.3 already admits them. The seven kernel steps remain unchanged. + +Mandatory source and eventual owner probes: each of the three groups alone; +multiple groups; no group/missing/empty/malformed claim; unrelated and lookalike +groups; each removal and re-add; other client with same user; ambiguous client +binding; unavailable directory; ID-token/UserInfo disagreement; original groups +and existing admin/team references unchanged. Actual positive/nonmember/add/ +remove consumer observations remain owner-attended work, with authenticated +current sessions, exact durable before/post/inverse evidence and all-writer +exclusion required independently. Source checks do not supply those facilities. + +Alternative if the derived-claim review fails: Apps selects and validates an +actual Forgejo image/source extension adding a separate backward-compatible +multi-value required-claim field, corresponding add/update CLI support and OR +matching in the callback. Do not reinterpret the old literal field. Pin and test +that exact image/source before any chart value emits its new flag. No such +image or implementation is claimed here. diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md new file mode 100644 index 0000000..e9f1268 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md @@ -0,0 +1,59 @@ +# Apps chart projection r1: concrete references, unsupported exact group gate + +This isolated packet is based on Apps `944b30ad63ab054cc24617e374e177d34cd572da` +and NetKingdom `befb0bc68cd25b625804fce559476eefd702521d` proposed 1.3. It does +not establish accepted case/source authority, owner acknowledgment or integration. +Canonical Apps/NetKingdom/KeyCape source, workplan status and seven kernel steps +were not changed. No commit, credentials, production/native/cluster call or +paid/model operation was used. The only external reads were public upstream +chart/source downloads. No HOME configs were inspected. + +The actual chart 12.5.0 archive matches the digest in its official public index. +Its default appVersion is 1.25.4, but actual Apps values override the image to +Forgejo **11.0.3**. Real offline Helm template rendering proves the existing +CLIENT_SECRET delivery can be consumed unchanged through an indexed +`deployment.env` secretKeyRef and a public OAuth client key. It also proves +`existingSecret` would request incompatible `key`/`secret` keys and an invented +list field survives Helm while becoming an unsupported CLI flag. + +The full first-case preparer intentionally refuses: Forgejo 11.0.3 supports +one exact required-claim value, whereas this case requires any of three groups. +No joined value, regex, group subset or weakened gate is emitted. See +[OWNER-CHANGE.md](OWNER-CHANGE.md) for exact pinned source evidence and the +concrete owner proposal, including the separately required review/re-freeze. +KeyCape currently has no configurable union claim implementation. + +`apps-source.patch` is an exact isolated Apps proposal with only the safe +preparatory `ENABLE_AUTO_REGISTRATION: false`, `ACCOUNT_LINKING: login` public +values delta and a pure offline projection module. It adds no actual OAuth +source to the real case. Local sign-in and all other values/references are +preserved. The module has no I/O or dispatcher and refuses activation. Its +single-group rendering path is a synthetic compatibility control, never an +alternative first case or an operational backend. The existing prior +`forgejo_configuration_prepare.py` generic backend is neither replaced nor +represented as chart-compatible activation. + +Nine offline tests cover source pins/decoded source, complete unrelated value +preservation, other OAuth sources and secret refs, indexed collisions, unknown +fields versus actual CLI, existingSecret mismatch, exact first-case refusal and +unconditional dispatch refusal. The actual Helm chart archive and pinned public +source are retained for repeatable offline review; the private helper is neither +run nor simulated with a secret. No full upgrade manifest is claimed because +DB/admin private values are intentionally absent. Source evidence and a literal +comparison table are not a running Forgejo callback/login proof. + +Run the retained review suite from any directory with Python/PyYAML and the +existing Helm binary (the suite creates an empty HOME and isolated Helm paths): + +```sh +python3 tests/test_forgejo_chart_projection.py +``` + +The suite is packet-scoped review evidence. The Apps patch contains the module +and policy delta; tests/fixtures remain in this packet, not an assertion that +owner integration has occurred. `validation.json` retains the failed initial +fixture selector run as well as final verification; no failure is counted as a +successful native trial. Durable operation/inverse sessions, authenticated +configuration journal, release-wide writer exclusion and consumer login/group +probes remain separately open. `activate()` remains unavailable irrespective of +caller-supplied approval/session/journal flags. diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json new file mode 100644 index 0000000..dfef6c3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json @@ -0,0 +1,35 @@ +{ + "OWNER-CHANGE.md": "sha256:f58e6e3aafec79436c4735387e6a6d4e8302107e9ca7a27bec37b2d65cbd1d50", + "README.md": "sha256:3df15baabe3a0d41397568a6b181a204d6aadd3d63ab7f2b3495589dd8768924", + "apps-source.patch": "sha256:85be01b5d370e7996e8a2b18c4d7b576a24b0ca6d1c03454157091c581f20a01", + "postimages/helm/forgejo-registry-values.yaml": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450", + "postimages/helm/forgejo-values.yaml": "sha256:9467ef8d28de53496cf6f7b71c3b9669cd9ce91ef0667342b6aba457d05d424c", + "preimages/helm/forgejo-registry-values.yaml": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450", + "preimages/helm/forgejo-values.yaml": "sha256:cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f", + "source-inventory.json": "sha256:77aabbe413aae6ac31c342304afa200d09ff3c74e3fc9f18d2af6919a816ab94", + "source-pins/consumer-delivery.yaml": "sha256:56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2", + "source-pins/forgejo-case-1.3.yaml": "sha256:546aad5cf26842c484fc6ba99940d56697b85531afea11872556761008923c94", + "source-pins/key-cape/AGENTS.md": "sha256:77c8e1ac762e7c101cd09a3aa184993309ed057821bd53fb0d318979a45c9315", + "source-pins/key-cape/INTENT.md": "sha256:b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10", + "source-pins/key-cape/src/cmd/keycape/main.go": "sha256:ff1ee4f5d2eb86a1e4184374d5244e24704d9d5fd780e173062af07112344afd", + "source-pins/key-cape/src/internal/config/config.go": "sha256:afd465acd9b6879493b888acc6fc54b9a71e032892701a81f1072986d2c30ac7", + "source-pins/key-cape/src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029", + "source-pins/key-cape/src/internal/server/oidc/token.go": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3", + "source-pins/key-cape/src/internal/server/oidc/userinfo.go": "sha256:bbd5fa9ebd0726371c90d6938536c1ce5fcfacbbe853a80833e3587fc2115a0b", + "source-pins/type-1.3.yaml": "sha256:ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f", + "test-output.txt": "sha256:64171812c2935ab8616e17c69b6fcfcbfb2ffc411edb1b7a8ff786a936eb63f0", + "tests/test_forgejo_chart_projection.py": "sha256:3aae2236ffcefbeed9225a9bf35650f1128379004ab6e34d548a596192824156", + "tools/forgejo_chart_projection.py": "sha256:b4900a9dbb98847ab81a723eddde1fbf0ea39c2fabc7d7006a1debd811b8a553", + "upstream/chart-12.5.0/Chart.yaml": "sha256:60e8522a68c67c0b18bdb9fb66b27a19ad09f8a051ee3757ade5de1d3f299224", + "upstream/chart-12.5.0/templates/_helpers.tpl": "sha256:792273fd24f4e8cf5328391fc3f5f1e406e24fe78ac4925c88d61426daccc6fb", + "upstream/chart-12.5.0/templates/gitea/deployment.yaml": "sha256:1abdd4e7915f392aca91073003887bf75baf1f0e5b66928a2f4c4a140dbeba0e", + "upstream/chart-12.5.0/templates/gitea/init.yaml": "sha256:518c78409b35d4612c413d9ff66c21ced32f8fbeb4b704950ff5ab1b919220bc", + "upstream/chart-12.5.0/values.yaml": "sha256:acdcea4c5739152b7fd825202b3920cfa22040d4b82d8e20588163ba3821abf3", + "upstream/chart-index-entry.json": "sha256:bb5ea7f46836ded497662ef380c2cd146e34b76cea72085051dfe08f218bcbe5", + "upstream/forgejo-v11.0.3/cmd/admin_auth_oauth.go": "sha256:d5faee30ffbb9a560256c92a0e05e652b79e95e016448cbac7dbb6ad0fdad937", + "upstream/forgejo-v11.0.3/custom/conf/app.example.ini": "sha256:5b44ccab271352bcf8cf9329e4bf9b167a78a73c9bcb0a7dfa5214a4a2dfd08b", + "upstream/forgejo-v11.0.3/routers/web/auth/oauth.go": "sha256:6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b", + "upstream/forgejo-v11.0.3/services/auth/source/oauth2/source.go": "sha256:a6ee5146c07d8efb1837ef91f1ab5f3139f69a1ff66f814d5e9c6053bf9b0d8b", + "upstream/gitea-12.5.0.tgz": "sha256:2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "validation.json": "sha256:bca9146212d10c9f3cc68593623032a0e13c0dcb1e43b6117a81129a0e4308cd" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch new file mode 100644 index 0000000..aa3f531 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch @@ -0,0 +1,95 @@ +--- a/helm/forgejo-values.yaml ++++ b/helm/forgejo-values.yaml +@@ -122,6 +122,9 @@ + DISABLE_SSH: false + service: + DISABLE_REGISTRATION: true ++ oauth2_client: ++ ENABLE_AUTO_REGISTRATION: false ++ ACCOUNT_LINKING: login + security: + INSTALL_LOCK: true + session: +--- /dev/null ++++ b/tools/forgejo_chart_projection.py +@@ -0,0 +1,80 @@ ++"""Public source preparation only. No I/O, native tools, credentials or dispatch. ++ ++The actual three-group case is refused on Forgejo 11.0.3. A single-group test ++control proves the real chart secret-reference seam, never case admission. ++""" ++from copy import deepcopy ++import hashlib ++import re ++import yaml ++ ++APPS = '944b30ad63ab054cc24617e374e177d34cd572da' ++BASE_SHA256 = 'cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f' ++CASE_GROUPS = ('forge-admins', 'forge-coulomb-owners', 'forge-coulomb-readers') ++ ++class Refused(ValueError): ++ pass ++ ++ ++def policy_only(base): ++ """Incomplete preparatory policy delta; does not add an OAuth source.""" ++ result = deepcopy(base) ++ config = result['gitea']['config'] ++ if config.get('service', {}).get('DISABLE_REGISTRATION') is not True: ++ raise Refused('existing registration policy differs') ++ # No supported local-form switch in 11.0.3: retain existing settings. ++ oauth = config.setdefault('oauth2_client', {}) ++ oauth.update(ENABLE_AUTO_REGISTRATION=False, ACCOUNT_LINKING='login') ++ return result ++ ++ ++def chart_projection(base, groups): ++ """Chart-compatible PUBLIC values for one literal gate, or fail closed. ++ ++ groups must be the authoritative reviewed case set, never a selected subset. ++ This function authenticates neither case/source acceptance nor permission. ++ It is not suitable for rendering arbitrary live/private Helm values. ++ """ ++ if not isinstance(groups, tuple) or not groups or len(set(groups)) != len(groups): ++ raise Refused('explicit unique group tuple required') ++ if any(not isinstance(g, str) or not re.fullmatch(r'[a-z][a-z0-9-]{1,62}', g) for g in groups): ++ raise Refused('group literal invalid') ++ if len(groups) != 1: ++ raise Refused('Forgejo 11.0.3 supports one literal required claim; any-of unavailable') ++ result = policy_only(base) ++ sources = result['gitea'].setdefault('oauth', []) ++ if not isinstance(sources, list) or any(not isinstance(s, dict) for s in sources): ++ raise Refused('OAuth source list required') ++ names = [s.get('name') for s in sources] ++ if len(names) != len(set(names)) or 'netkingdom' in names: ++ raise Refused('existing target requires exact owner reconciliation') ++ idx = len(sources) ++ env = result.setdefault('deployment', {}).setdefault('env', []) ++ if not isinstance(env, list): ++ raise Refused('deployment env list required') ++ var = f'GITEA_OAUTH_SECRET_{idx}' ++ if any(e.get('name') == var for e in env): ++ raise Refused('indexed secret environment collision') ++ sources.append({ ++ 'name': 'netkingdom', 'provider': 'openidConnect', 'key': 'forgejo', ++ 'autoDiscoverUrl': 'https://kc.coulomb.social/.well-known/openid-configuration', ++ 'scopes': 'openid,profile,email,groups', 'groupClaimName': 'groups', ++ 'requiredClaimName': 'groups', 'requiredClaimValue': groups[0], ++ }) ++ env.append({'name': var, 'valueFrom': {'secretKeyRef': { ++ 'name': 'forgejo-netkingdom-oidc-client', 'key': 'CLIENT_SECRET'}}}) ++ return result ++ ++ ++def prepare_first_case(base_bytes, base): ++ """Pin the public baseline and keep exact case any-of semantics.""" ++ if hashlib.sha256(base_bytes).hexdigest() != BASE_SHA256: ++ raise Refused('frozen Apps public values bytes differ') ++ if base != yaml.safe_load(base_bytes): ++ raise Refused('decoded public baseline differs from frozen bytes') ++ # This entry never returns while the actual case has an unsupported gate. ++ return chart_projection(base, CASE_GROUPS) ++ ++ ++def activate(*args, **kwargs): ++ raise Refused('source preparation has no operational backend or admission') diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml new file mode 100644 index 0000000..c4d27c1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml @@ -0,0 +1,14 @@ +# Public endpoint and package registry settings for Forgejo on railiance01. +service: + http: + type: ClusterIP + +gitea: + config: + packages: + ENABLED: true + LIMIT_SIZE_CONTAINER: -1 + repository: + DISABLED_REPO_UNITS: "" + server: + ROOT_URL: "https://forgejo.coulomb.social/" \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml new file mode 100644 index 0000000..69afc9d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml @@ -0,0 +1,141 @@ +# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image). +# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials. +# Recreate avoids leveldb queue lock fights on the shared RWO PVC during upgrades. +strategy: + type: Recreate + +service: + http: + type: ClusterIP + +image: + registry: code.forgejo.org + repository: forgejo/forgejo + tag: "11.0.3" + rootless: true + +persistence: + enabled: true + size: 10Gi + +postgresql: + enabled: false + +postgresql-ha: + enabled: false + +redis-cluster: + enabled: false + +valkey-cluster: + enabled: false + +# File subPath keeps Git from copying ConfigMap projection symlinks. +extraVolumes: +- name: secret-scan-template + configMap: + name: forgejo-secret-template-b1d7cf8cd13f + defaultMode: 365 +extraContainerVolumeMounts: +- &id001 + name: secret-scan-template + mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan + subPath: hook + readOnly: true +extraInitVolumeMounts: +- *id001 + +# Verify admitted scanner custody after Kubernetes fsGroup volume processing. +# Only the existing security subtree is mounted; no credentials are needed. +preExtraInitContainers: +- name: verify-secret-scanner + image: code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba + imagePullPolicy: IfNotPresent + command: + - sh + - -c + - "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security\ + \ && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\n\ + test -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\n\ + test -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n\ + test \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\n\ + test \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \"\ + \ \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\"\ + \ in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ + \ && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\ + \ = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \"\ + \ -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\ + \ in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n\ + \ test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n\ + \ chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\ + \ = 755\nfi\n" + - sh + - apply + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 64Mi + volumeMounts: + - name: data + mountPath: /data/security + subPath: security + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + +gitea: + admin: + username: forgejo_admin + email: admin@coulomb.social + passwordMode: initialOnlyRequireReset + # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS). + additionalConfigFromEnvs: + - name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR + value: /opt/forge-secret-template + - name: GITEA__mailer__PASSWD + valueFrom: + secretKeyRef: + name: forgejo-mailer + key: MAILER_PASSWD + config: + database: + DB_TYPE: postgres + HOST: forgejo-db-rw.databases.svc.cluster.local:5432 + NAME: forgejo + USER: forgejo + server: + DOMAIN: forgejo.coulomb.social + SSH_DOMAIN: forgejo.coulomb.social + SSH_PORT: 22 + SSH_LISTEN_PORT: 2222 + DISABLE_SSH: false + service: + DISABLE_REGISTRATION: true + oauth2_client: + ENABLE_AUTO_REGISTRATION: false + ACCOUNT_LINKING: login + security: + INSTALL_LOCK: true + session: + COOKIE_SECURE: true + mailer: + ENABLED: true + FROM: forgejo@coulomb.social + # IONOS submission port 587 uses STARTTLS, not implicit TLS (smtps). + PROTOCOL: smtp+starttls + SMTP_ADDR: smtp.ionos.de + SMTP_PORT: 587 + USER: forgejo@coulomb.social + actions: + ENABLED: true \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml new file mode 100644 index 0000000..c4d27c1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml @@ -0,0 +1,14 @@ +# Public endpoint and package registry settings for Forgejo on railiance01. +service: + http: + type: ClusterIP + +gitea: + config: + packages: + ENABLED: true + LIMIT_SIZE_CONTAINER: -1 + repository: + DISABLED_REPO_UNITS: "" + server: + ROOT_URL: "https://forgejo.coulomb.social/" \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json new file mode 100644 index 0000000..dfd3111 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json @@ -0,0 +1,631 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0015-T03' in workplan 'RPF-WP-0015' \u2014 decision 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd is resolved", + "file_path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md#RPF-WP-0015-T03", + "db_id": "", + "file_value": "2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0035-T02' in workplan 'RPF-WP-0035' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T02", + "db_id": "", + "file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0035-T03' in workplan 'RPF-WP-0035' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T03", + "db_id": "", + "file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0035-T07' in workplan 'RPF-WP-0035' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T07", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0035-T08' in workplan 'RPF-WP-0035' \u2014 decision ab85ae8a-12a0-4945-ae64-1d3d86d5b26f is resolved", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T08", + "db_id": "", + "file_value": "ab85ae8a-12a0-4945-ae64-1d3d86d5b26f", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0036-T03' in workplan 'RPF-WP-0036' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0036-platform-service-assurance.md#RPF-WP-0036-T03", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Wait task 'RPF-WP-0038-T04' in workplan 'RPF-WP-0038' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait", + "file_path": "workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md#RPF-WP-0038-T04", + "db_id": "", + "file_value": "wait", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0043-T03' in workplan 'RPF-WP-0043' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md#RPF-WP-0043-T03", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0043-T04' in workplan 'RPF-WP-0043' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md#RPF-WP-0043-T04", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0044-T04' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T04", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0044-T06' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T06", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0044-T07' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T07", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'RPF-WP-0048-T02' in workplan 'RPF-WP-0048' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved", + "file_path": "workplans/RPF-WP-0048-activity-core-gitops-adoption.md#RPF-WP-0048-T02", + "db_id": "", + "file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Wait task 'RPF-WP-0058-T05' in workplan 'RPF-WP-0058' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait", + "file_path": "workplans/RPF-WP-0058-reuse-private-source-reader.md#RPF-WP-0058-T05", + "db_id": "", + "file_value": "wait", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-06", + "message": "Authoritative workplan 43110f82\u2026 is absent from this projection", + "file_path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md", + "db_id": "43110f82-ef9f-5a46-a305-f0e287b7b226", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'RPF-WP-0035-T08' waiting on audit-core has 9 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 570ca050-0316-4e38-9c16-be41057c2330, 2de1c6e7-9602-48e5-868d-0048fbbef150, e7c36b17-d8f7-4d86-af09-02111289d1f5, 5fe769a7-d35b-4e37-a671-673d13cf8948, b3c564a6-93f9-4c07-872b-7feb22cccb73, ec4995b5-e1b2-4c66-9f8d-5ac8d6ceb149, 7c4019f2-348d-475e-9c96-e1ff6d0d27f5, ff43fd2c-7633-4b34-9ae6-2483ba03a271, 0d0da0d2-36a1-4ffc-b7bf-7896fad691f6", + "file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T08", + "db_id": "", + "file_value": "message-from:audit-core", + "db_value": "", + "fixable": false, + "repo_slug": "railiance-platform", + "source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "RPF-WP-0035-T08", + "message_ids": [ + "570ca050-0316-4e38-9c16-be41057c2330", + "2de1c6e7-9602-48e5-868d-0048fbbef150", + "e7c36b17-d8f7-4d86-af09-02111289d1f5", + "5fe769a7-d35b-4e37-a671-673d13cf8948", + "b3c564a6-93f9-4c07-872b-7feb22cccb73", + "ec4995b5-e1b2-4c66-9f8d-5ac8d6ceb149", + "7c4019f2-348d-475e-9c96-e1ff6d0d27f5", + "ff43fd2c-7633-4b34-9ae6-2483ba03a271", + "0d0da0d2-36a1-4ffc-b7bf-7896fad691f6" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-25", + "message": "Owner-return task 'RPF-WP-0056-T03' waiting on railiance-cluster has 9 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 4e9d4e58-71b3-497b-8954-cedc30740529, 13acb774-8fbe-4ca3-b44d-89a4742138bd, c9435491-8545-4d48-a57a-1773f2789092, fb8f25df-57ce-40e5-ae67-0c0b392746e8, 4bb0d7af-b644-44f3-acc8-69c7321e9824, 5301d4fb-0631-4ac5-8471-531e5362b2ba, 2087b9ac-c980-4881-89f1-6b1088132f5b, 78b89fb2-ced6-45f1-9718-0670b8257d45, 110e8dea-ce81-40ff-8161-325ddb89cd67", + "file_path": "workplans/RPF-WP-0056-playwright-consumer-admission.md#RPF-WP-0056-T03", + "db_id": "", + "file_value": "message-from:railiance-cluster", + "db_value": "", + "fixable": false, + "repo_slug": "railiance-platform", + "source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "source_revision_reason": null, + "owner_return": { + "task_record_id": "RPF-WP-0056-T03", + "message_ids": [ + "4e9d4e58-71b3-497b-8954-cedc30740529", + "13acb774-8fbe-4ca3-b44d-89a4742138bd", + "c9435491-8545-4d48-a57a-1773f2789092", + "fb8f25df-57ce-40e5-ae67-0c0b392746e8", + "4bb0d7af-b644-44f3-acc8-69c7321e9824", + "5301d4fb-0631-4ac5-8471-531e5362b2ba", + "2087b9ac-c980-4881-89f1-6b1088132f5b", + "78b89fb2-ced6-45f1-9718-0670b8257d45", + "110e8dea-ce81-40ff-8161-325ddb89cd67" + ] + } + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "14 unread message(s) lack thread_id for supersession tracking: the-custodian:836a8502, the-custodian:72c6a148, audit-core:0d0da0d2, rapp-postgres:6d047a08, railiance-platform:c4a80a60", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 64/65", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-06 fixed: created workstream 43110f82\u2026 for RPF-WP-0060, wrote ID to RPF-WP-0060-browser-case-platform-bindings.md", + " + task RPF-WP-0060-T01 \u2192 afec2053\u2026", + " + task RPF-WP-0060-T02 \u2192 1a764c10\u2026", + " + task RPF-WP-0060-T03 \u2192 b5d73ec6\u2026", + " + task RPF-WP-0060-T04 \u2192 84f8b0a4\u2026", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 37, + "info": 20 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt new file mode 100644 index 0000000..3345563 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt @@ -0,0 +1 @@ +WARN: git commit failed for writeback: Generated-only commits rejected: staged diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json new file mode 100644 index 0000000..af11634 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json @@ -0,0 +1,44 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "railiance-platform", + "namespace": "helixforge", + "assignments": [ + { + "kind": "workplan", + "record_id": "RPF-WP-0060", + "uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T01", + "uuid": "afec2053-1995-506d-a112-cda1de552c1c", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T02", + "uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T03", + "uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T04", + "uuid": "84f8b0a4-8450-5623-8608-dc277978383b", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json new file mode 100644 index 0000000..6c17a66 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json @@ -0,0 +1,44 @@ +{ + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": false, + "repo": "railiance-platform", + "namespace": "helixforge", + "assignments": [ + { + "kind": "workplan", + "record_id": "RPF-WP-0060", + "uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T01", + "uuid": "afec2053-1995-506d-a112-cda1de552c1c", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T02", + "uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T03", + "uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + }, + { + "kind": "task", + "record_id": "RPF-WP-0060-T04", + "uuid": "84f8b0a4-8450-5623-8608-dc277978383b", + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + } + ], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [ + "workplans/RPF-WP-0060-browser-case-platform-bindings.md" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json new file mode 100644 index 0000000..0b4de40 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json @@ -0,0 +1,449 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "railiance-platform", + "commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "requests": 2, + "elapsed_ms": 5661.8, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "railiance-platform", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "derived_commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "railiance-platform", + "commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "status": "applied", + "counts": { + "created": 0, + "updated": 65, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 4, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 12, + "external_edges": 24 + }, + "created": [], + "updated": [ + "RAIL-PL-WP-0001", + "RAIL-PL-WP-0002", + "RPF-WP-0001", + "RPF-WP-0002", + "RPF-WP-0003", + "RPF-WP-0004", + "RPF-WP-0005", + "RPF-WP-0006", + "RPF-WP-0007", + "RPF-WP-0008", + "RPF-WP-0009", + "RPF-WP-0010", + "RPF-WP-0011", + "RPF-WP-0012", + "RPF-WP-0013", + "RPF-WP-0014", + "RPF-WP-0015", + "RPF-WP-0016", + "RPF-WP-0017", + "RPF-WP-0018", + "RPF-WP-0019", + "RPF-WP-0020", + "RPF-WP-0021", + "RPF-WP-0022", + "RPF-WP-0023", + "RPF-WP-0024", + "RPF-WP-0025", + "RPF-WP-0026", + "RPF-WP-0027", + "RPF-WP-0028", + "RPF-WP-0029", + "RPF-WP-0030", + "RPF-WP-0031", + "RPF-WP-0032", + "RPF-WP-0033", + "RPF-WP-0034", + "RPF-WP-0035", + "RPF-WP-0036", + "RPF-WP-0037", + "RPF-WP-0038", + "RPF-WP-0039", + "RPF-WP-0040", + "RPF-WP-0041", + "RPF-WP-0042", + "RPF-WP-0043", + "RPF-WP-0044", + "RPF-WP-0045", + "RPF-WP-0046", + "RPF-WP-0047", + "RPF-WP-0048", + "RPF-WP-0049", + "RPF-WP-0050", + "RPF-WP-0051", + "RPF-WP-0052", + "RPF-WP-0053", + "RPF-WP-0054", + "RPF-WP-0055", + "RPF-WP-0056", + "RPF-WP-0057", + "RPF-WP-0058", + "RPF-WP-0059", + "RPF-WP-0060", + "RPF-WP-ADHOC-2026-08-23", + "RPF-WP-ADHOC-2026-10-10", + "RPF-WP-ADHOC-2026-10-11" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [ + "RPF-WP-0060-T01", + "RPF-WP-0060-T02", + "RPF-WP-0060-T03", + "RPF-WP-0060-T04" + ], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [ + { + "workplan": "RAIL-PL-WP-0002", + "from": "RAIL-PL-WP-0002", + "target": "RAIL-PL-WP-0001", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0002", + "from": "RPF-WP-0002", + "target": "RAILIANCE-WP-0005", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0002", + "from": "RPF-WP-0002", + "target": "RAILIANCE-WP-0006", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0002", + "from": "RPF-WP-0002", + "target": "RAILIANCE-WP-0007", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0003", + "from": "RPF-WP-0003", + "target": "RAILIANCE-WP-0007", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0003", + "from": "RPF-WP-0003", + "target": "RAILIANCE-WP-0008", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0004", + "from": "RPF-WP-0004", + "target": "RAILIANCE-WP-0007", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0004", + "from": "RPF-WP-0004", + "target": "RAILIANCE-WP-0008", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0005", + "from": "RPF-WP-0005", + "target": "RAILIANCE-WP-0007", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0005", + "from": "RPF-WP-0005", + "target": "RAILIANCE-WP-0008", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0024", + "from": "RPF-WP-0024", + "target": "RAILIANCE-WP-0005", + "reason": "missing" + }, + { + "workplan": "RPF-WP-0024", + "from": "RPF-WP-0024", + "target": "RAILIANCE-WP-0006", + "reason": "missing" + } + ], + "external_edges": [ + { + "workplan": "RPF-WP-0057", + "from": "RPF-WP-0057-T04", + "target": "RPF-WP-0057-T03", + "relationship_type": "starts_after", + "from_workplan_id": "04f7c4aa-0a24-5d61-994d-2487ca6bfb91", + "from_task_id": "94cdfd1c-c639-5c5e-9bd6-7db823ab0265", + "to_workplan_id": null, + "to_task_id": "afa14a91-1ebf-5a45-a28b-380f9a933336" + }, + { + "workplan": "RPF-WP-0003", + "from": "RPF-WP-0003", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "5fb6b6a7-3a40-5658-9804-21c0928c6dd9", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0024", + "from": "RPF-WP-0024", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "6c2e61cf-7aa9-58ee-bb22-3514b9692eb5", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T07", + "target": "SECRETS-WP-0006-T06", + "relationship_type": "starts_after", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b", + "to_workplan_id": null, + "to_task_id": "1431edae-5791-5892-8c4b-829419b537d2" + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T12", + "target": "RPF-WP-0035-T11", + "relationship_type": "starts_after", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "914bf383-c13f-5247-9af0-91d7e3a4784a", + "to_workplan_id": null, + "to_task_id": "7952c8cd-c066-5b72-a025-78d24341c1ab" + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T02", + "target": "KEY-WP-0039-T02", + "relationship_type": "starts_after", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "e0c82ea9-05a5-537e-8fbf-67534263572e", + "to_workplan_id": null, + "to_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3" + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T02", + "target": "MASON-WP-0009-T05", + "relationship_type": "starts_after", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "e0c82ea9-05a5-537e-8fbf-67534263572e", + "to_workplan_id": null, + "to_task_id": "1b1a0566-add7-59c1-94b0-6bb81d2d1537" + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T03", + "target": "MASON-WP-0005-T05", + "relationship_type": "starts_after", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "f47e5bc5-6f3c-54bb-aa35-260ad03892ba", + "to_workplan_id": null, + "to_task_id": "4c205be7-4f1f-5dd1-aafa-fc112fdd640e" + }, + { + "workplan": "RPF-WP-0035", + "from": "RPF-WP-0035-T03", + "target": "FT-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039", + "from_task_id": "f47e5bc5-6f3c-54bb-aa35-260ad03892ba", + "to_workplan_id": "f2373858-c932-5a4d-81b6-db9a3595135a", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T06", + "target": "RPF-WP-0044-T04", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80", + "to_workplan_id": null, + "to_task_id": "0e619658-0453-51ed-b9a0-bed28b5544fd" + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T06", + "target": "RPF-WP-0044-T05", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80", + "to_workplan_id": null, + "to_task_id": "d418068a-6fb0-5416-aac5-d23c93924d9c" + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T07", + "target": "RPF-WP-0044-T04", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d", + "to_workplan_id": null, + "to_task_id": "0e619658-0453-51ed-b9a0-bed28b5544fd" + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T07", + "target": "RPF-WP-0044-T06", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d", + "to_workplan_id": null, + "to_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80" + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T07", + "target": "RPF-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d", + "to_workplan_id": null, + "to_task_id": "6d5fc801-e361-579b-bcd8-6fe719a82e94" + }, + { + "workplan": "RPF-WP-0044", + "from": "RPF-WP-0044-T07", + "target": "RPF-WP-0044-T05", + "relationship_type": "starts_after", + "from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc", + "from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d", + "to_workplan_id": null, + "to_task_id": "d418068a-6fb0-5416-aac5-d23c93924d9c" + }, + { + "workplan": "RPF-WP-0004", + "from": "RPF-WP-0004", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "afc66064-7ba4-5f11-b61f-d76890244b7e", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0023", + "from": "RPF-WP-0023", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "b07930f7-ff0e-5fda-b7b9-3b56467173b1", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0001", + "from": "RPF-WP-0001", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "bcc11cf9-d008-5e42-8fff-e2b33a1d0ff2", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0002", + "from": "RPF-WP-0002", + "target": "RAIL-PL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "c69cb4e7-15c8-5858-aebd-73a6e46f0f21", + "from_task_id": null, + "to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0036", + "from": "RPF-WP-0036-T04", + "target": "RTEL-WP-0002", + "relationship_type": "blocks", + "from_workplan_id": "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84", + "from_task_id": "5351e0e4-6263-58f0-afb2-7c78c4cd6f68", + "to_workplan_id": "08a5db92-7293-50d3-b589-55287b9850b3", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0036", + "from": "RPF-WP-0036-T03", + "target": "ACTIVITY-WP-0042", + "relationship_type": "blocks", + "from_workplan_id": "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84", + "from_task_id": "d64446fb-870b-5ae9-9628-f1fb9d06c5a4", + "to_workplan_id": "e1bfb5a4-e647-592d-883f-fe8728ad2f5f", + "to_task_id": null + }, + { + "workplan": "RPF-WP-0043", + "from": "RPF-WP-0043-T03", + "target": "RAPP-POLICY-NEXUS-WP-0002-T02", + "relationship_type": "starts_after", + "from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c", + "from_task_id": "2afb1aac-66dd-5e1e-92e1-fc020a59a927", + "to_workplan_id": null, + "to_task_id": "18b26ecc-4fb8-516b-8d97-62ff39a85f24" + }, + { + "workplan": "RPF-WP-0043", + "from": "RPF-WP-0043-T04", + "target": "RPF-WP-0043-T03", + "relationship_type": "starts_after", + "from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c", + "from_task_id": "8638fa73-439d-5dcd-85c7-81aa125170e1", + "to_workplan_id": null, + "to_task_id": "2afb1aac-66dd-5e1e-92e1-fc020a59a927" + }, + { + "workplan": "RPF-WP-0043", + "from": "RPF-WP-0043-T04", + "target": "RPF-WP-0044-T07", + "relationship_type": "starts_after", + "from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c", + "from_task_id": "8638fa73-439d-5dcd-85c7-81aa125170e1", + "to_workplan_id": null, + "to_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.stderr.txt b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.stderr.txt new file mode 100644 index 0000000..e69de29 diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json new file mode 100644 index 0000000..772a470 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json @@ -0,0 +1,29 @@ +{ + "exit_code": 0, + "commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "base": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9", + "files": [ + { + "path": "scripts/keycape_client_secret_generate.py", + "sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28" + }, + { + "path": "credential-grants/catalog.yaml", + "sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886" + }, + { + "path": "tests/test_keycape_client_secret_generate.py", + "sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0" + }, + { + "path": "tests/test_credential_grants.py", + "sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a" + }, + { + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md", + "sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030" + } + ], + "stdout": "[main d35c0f9] Bind mint broker validation to exact reviewed sources and track successor obligations\n 5 files changed, 337 insertions(+), 8 deletions(-)\n create mode 100644 workplans/RPF-WP-0060-browser-case-platform-bindings.md\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 5, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json new file mode 100644 index 0000000..7c21b07 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json @@ -0,0 +1,27 @@ +{ + "owner": "railiance-platform", + "base_revision": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9", + "message": "Bind mint broker validation to exact reviewed sources and track successor obligations", + "files": [ + { + "path": "scripts/keycape_client_secret_generate.py", + "sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28" + }, + { + "path": "credential-grants/catalog.yaml", + "sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886" + }, + { + "path": "tests/test_keycape_client_secret_generate.py", + "sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0" + }, + { + "path": "tests/test_credential_grants.py", + "sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a" + }, + { + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md", + "sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030" + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json new file mode 100644 index 0000000..aca7c46 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json @@ -0,0 +1,44 @@ +{ + "base": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9", + "review_sha256": "sha256:05d5bf9c2b90a8562ce4675866b8b23c0e12d5d069b43b194948d384b0a553f5", + "files": [ + { + "path": "scripts/keycape_client_secret_generate.py", + "sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28" + }, + { + "path": "credential-grants/catalog.yaml", + "sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886" + }, + { + "path": "tests/test_keycape_client_secret_generate.py", + "sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0" + }, + { + "path": "tests/test_credential_grants.py", + "sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a" + }, + { + "path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md", + "sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030" + } + ], + "existing_workplans_preserved": 65, + "unrelated_state": { + "WORK-RECORDS.md": { + "worktree": "1fc51bf92554968f844ca03a68458c5f3f43ce20ad220e26fc447f2d39ed732e", + "index": "100644 dc7f3aab6de945558ddb9e48a482a9d92d734c3b 0\tWORK-RECORDS.md" + }, + ".custodian-brief.md": { + "worktree": "db5a3d67113c2a8ce6a30bd30f03e791bacfc38cbb9963c1f8c11e805c02c66f", + "index": "100644 1c9e635012d170c76646bf76d5202f6de163a643 0\t.custodian-brief.md" + } + }, + "native_actions": false, + "tasks": { + "RPF-WP-0060-T01": "progress", + "RPF-WP-0060-T02": "done", + "RPF-WP-0060-T03": "todo", + "RPF-WP-0060-T04": "todo" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json new file mode 100644 index 0000000..bb4a4b8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json @@ -0,0 +1,28 @@ +{ + "workplan_uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226", + "source_primary_bindings": [ + { + "record_id": "RPF-WP-0060-T01", + "uuid": "afec2053-1995-506d-a112-cda1de552c1c", + "status": "progress" + }, + { + "record_id": "RPF-WP-0060-T02", + "uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b", + "status": "done" + }, + { + "record_id": "RPF-WP-0060-T03", + "uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f", + "status": "todo" + }, + { + "record_id": "RPF-WP-0060-T04", + "uuid": "84f8b0a4-8450-5623-8608-dc277978383b", + "status": "todo" + } + ], + "task_count": 4, + "source_head": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88", + "projection": "primary/railiance01" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md new file mode 100644 index 0000000..e622027 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md @@ -0,0 +1,113 @@ +--- +id: RPF-WP-0060 +type: workplan +title: "Implement Platform bindings for the browser SecurityCase successor" +domain: financials +repo: railiance-platform +status: active +owner: codex +topic_slug: netkingdom +created: "2026-10-17" +updated: "2026-10-17" +flavor: implementation +origin: cross-repo +origin_ref: NK-WP-0048-T16 +--- + +Demand: Platform's source review of the proposed browser SecurityCase 1.3 +requires four concrete owner obligations before owner-descriptor acceptance. +The review labels `RPF-1.3-T1` through `T4` were not live work records; this +workplan makes them ordinary owner tasks without changing RPF-WP-0054's +completed first-generation lane or implementing its residual rotation work. + +Review: `the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json`. +The 1.3 type remains proposed. This workplan grants no native access, case +acceptance, owner acknowledgment, catalog activation or policy change. + +## T01 — Bind the broker to reviewed acknowledged type sources + +```task +id: RPF-WP-0060-T01 +status: progress +priority: high +``` + +Implements review obligation RPF-1.3-T1. The broker's explicit source map admits +only its existing 1.1 revision. Exact type and producer bytes, parameter +fingerprint, acknowledgment state and case schema are checked before any Bao +call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation +layout is `railiance-platform` and `net-kingdom` as real sibling directories; +missing, symlinked or drifted selected sources refuse rather than fall back. + +2026-10-17: source hardening and catalog regressions independently reviewed in +`the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/`. +The exact case reference binds caller-supplied bytes; schema validation does +not authenticate case acceptance. Existing Warden admission/native evidence +must establish that independently. This task remains open for the real binding +and explicit 1.3 source/parameter pins after genuine acknowledgment and review. +No speculative successor pin or acknowledgment is added. + +Done when the actual admitted-case binding is verified, the genuinely +acknowledged successor is explicitly selected, and refusal tests cover unknown, +unacknowledged, wrong-case and drifted-source inputs before native effects. + +## T02 — Correct the documented mint caller and issuer binding + +```task +id: RPF-WP-0060-T02 +status: done +priority: high +``` + +Implements review obligation RPF-1.3-T2. `credential-grants/catalog.yaml` now +names human-operator only and the exact existing issuer role +`auth/netkingdom/role/credential-broker-keycape-client-secret-generate`. +Regression checks bind this statement to CCR-2026-0043's role source, +net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant, +credential or live configuration changes. + +## T03 — Implement mint, guarded destruction and authenticated evidence + +```task +id: RPF-WP-0060-T03 +status: todo +priority: high +``` + +Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed +`railiance-platform.custody-mint.v1` projection and authenticated publication. +Capture grant accessor and revocation evidence and revoke the issuer session. +Destruction uses attended platform-admin authority and compares the original +CAS-0 version-1 creation time, current version and absence of other versions +before metadata deletion. No standing family-wide delete grant is introduced. +Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN +for owner reconciliation. Verify with the frozen adapter, then obtain the +required native authority and actual execution receipts. + +## T04 — Implement and admit the delivery lane and capability + +```task +id: RPF-WP-0060-T04 +status: todo +priority: high +``` + +Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store +contract; validate the preexisting Store and only create the case-derived +ExternalSecret in `sso`. Refuse conflicts; report NO_CHANGE only for matching +preexisting configuration; establish current Ready status before success. +Return the closed metadata-only `netkingdom.deliver-secret.v1` receipt and use +UID and resourceVersion preconditions to remove only authenticated case-created +resources. Never read Secret values or create the Store through this lane. + +Bind real human net-kingdom-admins/aal2 admission, per-attempt session and +revocation, durable pre-intent/recovery journal and authenticated owner evidence. +The separate command-mechanics candidate is preparation, not this capability; +its production factory refuses. Review freshness/defaulting/transport failure +cases before integrating it. Obtain ops-warden's catalog routing acceptance for +`platform-secret-delivery` through an authorized handoff before recording owner +acceptance. No routing handoff or native action is implied by this work record. + +The parent stays active until these obligations and their required owner +acceptance are proved. Source tests do not complete native acceptance or +KEY-WP-0039's negative/expiry/cleanup exercise.