coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Record reviewed owner implementation and consumer compatibility (3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 9s
Details

Browse source
This commit is contained in:
codex 2026-10-17 23:14:27 +02:00
parent 1513dad652
commit 6548540fd4
18 changed files with 1866 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

98
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/OWNER-CHANGE.md Normal file
View file

@ -0,0 +1,98 @@
# Actual case gate needs an owner change
The frozen first-case set remains **any one of** `forge-admins`,
`forge-coulomb-owners`, `forge-coulomb-readers` before sign-in completes.
Do not reduce it to one group, permit arbitrary authenticated users, use only team
access as the gate, add an unmanaged umbrella directory group, or interpret a
comma string/regex as a supported any-of expression.
## Exact blocker and existing compatible portion
Forgejo **11.0.3**, not chart appVersion 1.25.4, is the Apps image override.
Its `cmd/admin_auth_oauth.go:89-96` defines a singular StringFlag;
`services/auth/source/oauth2/source.go` stores `RequiredClaimValue string`;
`routers/web/auth/oauth.go:1430-1443` calls
`groups.Contains(oauth2Source.RequiredClaimValue)`. Only the *incoming claim*
is converted to a set (array or comma string, lines 1103-1118). The required
value is never split or compiled as a regex. Three alternatives cannot be
represented. Repeating the singular flag does not establish OR semantics.
Chart 12.5.0 accepts arbitrary OAuth keys and emits them as CLI flags; inventing
`requiredClaimValues` renders successfully but emits the unsupported flag
`--required-claim-values`. Helm success alone is insufficient.
The secret-reference issue requires no secret/schema migration. In the existing
`gitea.oauth` entry set public `key: forgejo`, omit `secret`/`existingSecret`, and
append `deployment.env` variable `GITEA_OAUTH_SECRET_<actual list index>` with
`valueFrom.secretKeyRef` name `forgejo-netkingdom-oidc-client`, key `CLIENT_SECRET`.
Chart `_helpers.tpl:196-213` supplies the quoted runtime variable automatically,
and deployment.yaml adds `deployment.env` to `configure-gitea`. The tested
render uses the actual existing delivery shape. ExistingSecret alone would
request nonexistent keys `key` and `secret`, even when inline `key` is supplied.
The preparer preserves list order, all other OAuth sources/environment entries,
mailer reference, DB/admin configuration and all unrelated settings. It refuses
an existing target or indexed variable collision pending exact reconciliation.
No new key alias, ESO object or custody ACL is needed. This reference seam is
source preparation, not an accepted runtime deployment.
## Recommended next owner proposal: app-specific derived union claim
This is a **new proposal**, not a feature present in KeyCape or an admitted
extension of type 1.3. Read source is pinned at KeyCape
`d803e9282a47b49daf930fb905312fa5104c0ace`.
`src/internal/config/config.go:ClientConfig` has no custom/derived claim fields;
`src/internal/server/oidc/token.go:211` emits the original directory groups;
`src/internal/server/oidc/userinfo.go:87-89` emits those same groups for the groups
scope. `UserinfoHandler` has no per-client configuration today. Tenant-role
cache claims are unrelated and explicitly fail open; do not reuse them.
KeyCape owner can add a narrowly defined, validated per-client derived claim
configuration, propagated through the existing registration conversion and
canonical client model. For the reviewed `forgejo` client, propose claim
`forgejo_access` with the single literal string `allowed` iff the resolved human
user's original groups intersect the exact three-group set. Omit the claim
otherwise. Preserve the original `groups` array byte-for-byte in its existing
serialization and retain `groupClaimName: groups` for role/team mapping. No
new LDAP group or copied membership set should exist.
The actual owner source change must cover `src/internal/config/config.go` and
validation, `src/internal/domain/model.go` and canonical-model conformance,
client construction in `src/cmd/keycape/main.go`, and a shared pure derivation
used from both `src/internal/server/oidc/token.go` and `userinfo.go`. Bind the
rule to the *authenticated registered client*, never a request claim/client
query argument or user-controlled attributes. UserInfo currently only gets
Users/SigningKey/Issuer/Emitter; its wiring must receive trusted client rules
and authenticate a signed client binding. Account for ID-token client audience
versus an access token's optional resource audience; do not infer the client
from an ambiguous resource audience. Refresh/re-read actual current groups in
UserInfo, reject failed/ambiguous identity reads, and ensure a stale positive
ID-token claim cannot bypass a negative current UserInfo claim in Forgejo's
actual provider merge path. That last behavior requires source/fixture proof
before this proposal is considered viable. If it cannot be guaranteed, choose
a separately reviewed Forgejo source/image extension instead.
Apps would then require claim name `forgejo_access`, value `allowed`; keep
`groupClaimName: groups`, local sign-in, disabled auto-registration and local
credential account linking. The tested current chart can render those two
existing singular CLI fields without a chart modification. This changes
1.3's claim-shape contract even though the exact access-set semantics stay the
same. NetKingdom/KeyCape/Apps must review the rule, re-freeze exact source/case,
registration renderer/descriptors and acceptance hashes, and use a separately
identified type revision if required by existing immutability rules. Do not
smuggle extra fields through the existing registration adapter or assert that
1.3 already admits them. The seven kernel steps remain unchanged.
Mandatory source and eventual owner probes: each of the three groups alone;
multiple groups; no group/missing/empty/malformed claim; unrelated and lookalike
groups; each removal and re-add; other client with same user; ambiguous client
binding; unavailable directory; ID-token/UserInfo disagreement; original groups
and existing admin/team references unchanged. Actual positive/nonmember/add/
remove consumer observations remain owner-attended work, with authenticated
current sessions, exact durable before/post/inverse evidence and all-writer
exclusion required independently. Source checks do not supply those facilities.
Alternative if the derived-claim review fails: Apps selects and validates an
actual Forgejo image/source extension adding a separate backward-compatible
multi-value required-claim field, corresponding add/update CLI support and OR
matching in the callback. Do not reinterpret the old literal field. Pin and test
that exact image/source before any chart value emits its new flag. No such
image or implementation is claimed here.

59
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/README.md Normal file
View file

@ -0,0 +1,59 @@
# Apps chart projection r1: concrete references, unsupported exact group gate
This isolated packet is based on Apps `944b30ad63ab054cc24617e374e177d34cd572da`
and NetKingdom `befb0bc68cd25b625804fce559476eefd702521d` proposed 1.3. It does
not establish accepted case/source authority, owner acknowledgment or integration.
Canonical Apps/NetKingdom/KeyCape source, workplan status and seven kernel steps
were not changed. No commit, credentials, production/native/cluster call or
paid/model operation was used. The only external reads were public upstream
chart/source downloads. No HOME configs were inspected.
The actual chart 12.5.0 archive matches the digest in its official public index.
Its default appVersion is 1.25.4, but actual Apps values override the image to
Forgejo **11.0.3**. Real offline Helm template rendering proves the existing
CLIENT_SECRET delivery can be consumed unchanged through an indexed
`deployment.env` secretKeyRef and a public OAuth client key. It also proves
`existingSecret` would request incompatible `key`/`secret` keys and an invented
list field survives Helm while becoming an unsupported CLI flag.
The full first-case preparer intentionally refuses: Forgejo 11.0.3 supports
one exact required-claim value, whereas this case requires any of three groups.
No joined value, regex, group subset or weakened gate is emitted. See
[OWNER-CHANGE.md](OWNER-CHANGE.md) for exact pinned source evidence and the
concrete owner proposal, including the separately required review/re-freeze.
KeyCape currently has no configurable union claim implementation.
`apps-source.patch` is an exact isolated Apps proposal with only the safe
preparatory `ENABLE_AUTO_REGISTRATION: false`, `ACCOUNT_LINKING: login` public
values delta and a pure offline projection module. It adds no actual OAuth
source to the real case. Local sign-in and all other values/references are
preserved. The module has no I/O or dispatcher and refuses activation. Its
single-group rendering path is a synthetic compatibility control, never an
alternative first case or an operational backend. The existing prior
`forgejo_configuration_prepare.py` generic backend is neither replaced nor
represented as chart-compatible activation.
Nine offline tests cover source pins/decoded source, complete unrelated value
preservation, other OAuth sources and secret refs, indexed collisions, unknown
fields versus actual CLI, existingSecret mismatch, exact first-case refusal and
unconditional dispatch refusal. The actual Helm chart archive and pinned public
source are retained for repeatable offline review; the private helper is neither
run nor simulated with a secret. No full upgrade manifest is claimed because
DB/admin private values are intentionally absent. Source evidence and a literal
comparison table are not a running Forgejo callback/login proof.
Run the retained review suite from any directory with Python/PyYAML and the
existing Helm binary (the suite creates an empty HOME and isolated Helm paths):
```sh
python3 tests/test_forgejo_chart_projection.py
```
The suite is packet-scoped review evidence. The Apps patch contains the module
and policy delta; tests/fixtures remain in this packet, not an assertion that
owner integration has occurred. `validation.json` retains the failed initial
fixture selector run as well as final verification; no failure is counted as a
successful native trial. Durable operation/inverse sessions, authenticated
configuration journal, release-wide writer exclusion and consumer login/group
probes remain separately open. `activate()` remains unavailable irrespective of
caller-supplied approval/session/journal flags.

35
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/SHA256SUMS.json Normal file
View file

@ -0,0 +1,35 @@
{
"OWNER-CHANGE.md": "sha256:f58e6e3aafec79436c4735387e6a6d4e8302107e9ca7a27bec37b2d65cbd1d50",
"README.md": "sha256:3df15baabe3a0d41397568a6b181a204d6aadd3d63ab7f2b3495589dd8768924",
"apps-source.patch": "sha256:85be01b5d370e7996e8a2b18c4d7b576a24b0ca6d1c03454157091c581f20a01",
"postimages/helm/forgejo-registry-values.yaml": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450",
"postimages/helm/forgejo-values.yaml": "sha256:9467ef8d28de53496cf6f7b71c3b9669cd9ce91ef0667342b6aba457d05d424c",
"preimages/helm/forgejo-registry-values.yaml": "sha256:a38f551734843c6367448f267c7376b1aeee010927a49690fdd7c1471e0ae450",
"preimages/helm/forgejo-values.yaml": "sha256:cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f",
"source-inventory.json": "sha256:77aabbe413aae6ac31c342304afa200d09ff3c74e3fc9f18d2af6919a816ab94",
"source-pins/consumer-delivery.yaml": "sha256:56478a83d799c08dc1e5159983b1e843a46b16dfeee7e84c31401d1f92430df2",
"source-pins/forgejo-case-1.3.yaml": "sha256:546aad5cf26842c484fc6ba99940d56697b85531afea11872556761008923c94",
"source-pins/key-cape/AGENTS.md": "sha256:77c8e1ac762e7c101cd09a3aa184993309ed057821bd53fb0d318979a45c9315",
"source-pins/key-cape/INTENT.md": "sha256:b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10",
"source-pins/key-cape/src/cmd/keycape/main.go": "sha256:ff1ee4f5d2eb86a1e4184374d5244e24704d9d5fd780e173062af07112344afd",
"source-pins/key-cape/src/internal/config/config.go": "sha256:afd465acd9b6879493b888acc6fc54b9a71e032892701a81f1072986d2c30ac7",
"source-pins/key-cape/src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
"source-pins/key-cape/src/internal/server/oidc/token.go": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
"source-pins/key-cape/src/internal/server/oidc/userinfo.go": "sha256:bbd5fa9ebd0726371c90d6938536c1ce5fcfacbbe853a80833e3587fc2115a0b",
"source-pins/type-1.3.yaml": "sha256:ef02ddae3167bdd1558193a5f6db0379fb8cc84207531706d5ef35caabc3684f",
"test-output.txt": "sha256:64171812c2935ab8616e17c69b6fcfcbfb2ffc411edb1b7a8ff786a936eb63f0",
"tests/test_forgejo_chart_projection.py": "sha256:3aae2236ffcefbeed9225a9bf35650f1128379004ab6e34d548a596192824156",
"tools/forgejo_chart_projection.py": "sha256:b4900a9dbb98847ab81a723eddde1fbf0ea39c2fabc7d7006a1debd811b8a553",
"upstream/chart-12.5.0/Chart.yaml": "sha256:60e8522a68c67c0b18bdb9fb66b27a19ad09f8a051ee3757ade5de1d3f299224",
"upstream/chart-12.5.0/templates/_helpers.tpl": "sha256:792273fd24f4e8cf5328391fc3f5f1e406e24fe78ac4925c88d61426daccc6fb",
"upstream/chart-12.5.0/templates/gitea/deployment.yaml": "sha256:1abdd4e7915f392aca91073003887bf75baf1f0e5b66928a2f4c4a140dbeba0e",
"upstream/chart-12.5.0/templates/gitea/init.yaml": "sha256:518c78409b35d4612c413d9ff66c21ced32f8fbeb4b704950ff5ab1b919220bc",
"upstream/chart-12.5.0/values.yaml": "sha256:acdcea4c5739152b7fd825202b3920cfa22040d4b82d8e20588163ba3821abf3",
"upstream/chart-index-entry.json": "sha256:bb5ea7f46836ded497662ef380c2cd146e34b76cea72085051dfe08f218bcbe5",
"upstream/forgejo-v11.0.3/cmd/admin_auth_oauth.go": "sha256:d5faee30ffbb9a560256c92a0e05e652b79e95e016448cbac7dbb6ad0fdad937",
"upstream/forgejo-v11.0.3/custom/conf/app.example.ini": "sha256:5b44ccab271352bcf8cf9329e4bf9b167a78a73c9bcb0a7dfa5214a4a2dfd08b",
"upstream/forgejo-v11.0.3/routers/web/auth/oauth.go": "sha256:6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b",
"upstream/forgejo-v11.0.3/services/auth/source/oauth2/source.go": "sha256:a6ee5146c07d8efb1837ef91f1ab5f3139f69a1ff66f814d5e9c6053bf9b0d8b",
"upstream/gitea-12.5.0.tgz": "sha256:2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823",
"validation.json": "sha256:bca9146212d10c9f3cc68593623032a0e13c0dcb1e43b6117a81129a0e4308cd"
}

95
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/apps-source.patch Normal file
View file

@ -0,0 +1,95 @@
--- a/helm/forgejo-values.yaml
+++ b/helm/forgejo-values.yaml
@@ -122,6 +122,9 @@
DISABLE_SSH: false
service:
DISABLE_REGISTRATION: true
+ oauth2_client:
+ ENABLE_AUTO_REGISTRATION: false
+ ACCOUNT_LINKING: login
security:
INSTALL_LOCK: true
session:
--- /dev/null
+++ b/tools/forgejo_chart_projection.py
@@ -0,0 +1,80 @@
+"""Public source preparation only. No I/O, native tools, credentials or dispatch.
+
+The actual three-group case is refused on Forgejo 11.0.3. A single-group test
+control proves the real chart secret-reference seam, never case admission.
+"""
+from copy import deepcopy
+import hashlib
+import re
+import yaml
+
+APPS = '944b30ad63ab054cc24617e374e177d34cd572da'
+BASE_SHA256 = 'cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f'
+CASE_GROUPS = ('forge-admins', 'forge-coulomb-owners', 'forge-coulomb-readers')
+
+class Refused(ValueError):
+ pass
+
+
+def policy_only(base):
+ """Incomplete preparatory policy delta; does not add an OAuth source."""
+ result = deepcopy(base)
+ config = result['gitea']['config']
+ if config.get('service', {}).get('DISABLE_REGISTRATION') is not True:
+ raise Refused('existing registration policy differs')
+ # No supported local-form switch in 11.0.3: retain existing settings.
+ oauth = config.setdefault('oauth2_client', {})
+ oauth.update(ENABLE_AUTO_REGISTRATION=False, ACCOUNT_LINKING='login')
+ return result
+
+
+def chart_projection(base, groups):
+ """Chart-compatible PUBLIC values for one literal gate, or fail closed.
+
+ groups must be the authoritative reviewed case set, never a selected subset.
+ This function authenticates neither case/source acceptance nor permission.
+ It is not suitable for rendering arbitrary live/private Helm values.
+ """
+ if not isinstance(groups, tuple) or not groups or len(set(groups)) != len(groups):
+ raise Refused('explicit unique group tuple required')
+ if any(not isinstance(g, str) or not re.fullmatch(r'[a-z][a-z0-9-]{1,62}', g) for g in groups):
+ raise Refused('group literal invalid')
+ if len(groups) != 1:
+ raise Refused('Forgejo 11.0.3 supports one literal required claim; any-of unavailable')
+ result = policy_only(base)
+ sources = result['gitea'].setdefault('oauth', [])
+ if not isinstance(sources, list) or any(not isinstance(s, dict) for s in sources):
+ raise Refused('OAuth source list required')
+ names = [s.get('name') for s in sources]
+ if len(names) != len(set(names)) or 'netkingdom' in names:
+ raise Refused('existing target requires exact owner reconciliation')
+ idx = len(sources)
+ env = result.setdefault('deployment', {}).setdefault('env', [])
+ if not isinstance(env, list):
+ raise Refused('deployment env list required')
+ var = f'GITEA_OAUTH_SECRET_{idx}'
+ if any(e.get('name') == var for e in env):
+ raise Refused('indexed secret environment collision')
+ sources.append({
+ 'name': 'netkingdom', 'provider': 'openidConnect', 'key': 'forgejo',
+ 'autoDiscoverUrl': 'https://kc.coulomb.social/.well-known/openid-configuration',
+ 'scopes': 'openid,profile,email,groups', 'groupClaimName': 'groups',
+ 'requiredClaimName': 'groups', 'requiredClaimValue': groups[0],
+ })
+ env.append({'name': var, 'valueFrom': {'secretKeyRef': {
+ 'name': 'forgejo-netkingdom-oidc-client', 'key': 'CLIENT_SECRET'}}})
+ return result
+
+
+def prepare_first_case(base_bytes, base):
+ """Pin the public baseline and keep exact case any-of semantics."""
+ if hashlib.sha256(base_bytes).hexdigest() != BASE_SHA256:
+ raise Refused('frozen Apps public values bytes differ')
+ if base != yaml.safe_load(base_bytes):
+ raise Refused('decoded public baseline differs from frozen bytes')
+ # This entry never returns while the actual case has an unsupported gate.
+ return chart_projection(base, CASE_GROUPS)
+
+
+def activate(*args, **kwargs):
+ raise Refused('source preparation has no operational backend or admission')

14
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-registry-values.yaml Normal file
View file

@ -0,0 +1,14 @@
# Public endpoint and package registry settings for Forgejo on railiance01.
service:
http:
type: ClusterIP
gitea:
config:
packages:
ENABLED: true
LIMIT_SIZE_CONTAINER: -1
repository:
DISABLED_REPO_UNITS: ""
server:
ROOT_URL: "https://forgejo.coulomb.social/"

141
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/postimages/helm/forgejo-values.yaml Normal file
View file

@ -0,0 +1,141 @@
# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image).
# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials.
# Recreate avoids leveldb queue lock fights on the shared RWO PVC during upgrades.
strategy:
type: Recreate
service:
http:
type: ClusterIP
image:
registry: code.forgejo.org
repository: forgejo/forgejo
tag: "11.0.3"
rootless: true
persistence:
enabled: true
size: 10Gi
postgresql:
enabled: false
postgresql-ha:
enabled: false
redis-cluster:
enabled: false
valkey-cluster:
enabled: false
# File subPath keeps Git from copying ConfigMap projection symlinks.
extraVolumes:
- name: secret-scan-template
configMap:
name: forgejo-secret-template-b1d7cf8cd13f
defaultMode: 365
extraContainerVolumeMounts:
- &id001
name: secret-scan-template
mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan
subPath: hook
readOnly: true
extraInitVolumeMounts:
- *id001
# Verify admitted scanner custody after Kubernetes fsGroup volume processing.
# Only the existing security subtree is mounted; no credentials are needed.
preExtraInitContainers:
- name: verify-secret-scanner
image: code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba
imagePullPolicy: IfNotPresent
command:
- sh
- -c
- "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security\
\ && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\n\
test -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\n\
test -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n\
test \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\n\
test \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \"\
\ \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\"\
\ in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\
\ && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\
\ = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \"\
\ -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\
\ in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n\
\ test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n\
\ chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\"\
\ = 755\nfi\n"
- sh
- apply
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 64Mi
volumeMounts:
- name: data
mountPath: /data/security
subPath: security
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
gitea:
admin:
username: forgejo_admin
email: admin@coulomb.social
passwordMode: initialOnlyRequireReset
# Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
additionalConfigFromEnvs:
- name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR
value: /opt/forge-secret-template
- name: GITEA__mailer__PASSWD
valueFrom:
secretKeyRef:
name: forgejo-mailer
key: MAILER_PASSWD
config:
database:
DB_TYPE: postgres
HOST: forgejo-db-rw.databases.svc.cluster.local:5432
NAME: forgejo
USER: forgejo
server:
DOMAIN: forgejo.coulomb.social
SSH_DOMAIN: forgejo.coulomb.social
SSH_PORT: 22
SSH_LISTEN_PORT: 2222
DISABLE_SSH: false
service:
DISABLE_REGISTRATION: true
oauth2_client:
ENABLE_AUTO_REGISTRATION: false
ACCOUNT_LINKING: login
security:
INSTALL_LOCK: true
session:
COOKIE_SECURE: true
mailer:
ENABLED: true
FROM: forgejo@coulomb.social
# IONOS submission port 587 uses STARTTLS, not implicit TLS (smtps).
PROTOCOL: smtp+starttls
SMTP_ADDR: smtp.ionos.de
SMTP_PORT: 587
USER: forgejo@coulomb.social
actions:
ENABLED: true

14
docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/preimages/helm/forgejo-registry-values.yaml Normal file
View file

@ -0,0 +1,14 @@
# Public endpoint and package registry settings for Forgejo on railiance01.
service:
http:
type: ClusterIP
gitea:
config:
packages:
ENABLED: true
LIMIT_SIZE_CONTAINER: -1
repository:
DISABLED_REPO_UNITS: ""
server:
ROOT_URL: "https://forgejo.coulomb.social/"

631
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.json Normal file
View file

@ -0,0 +1,631 @@
{
"repo_slug": "railiance-platform",
"repo_path": "/home/worsch/railiance-platform",
"source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"source_revision_reason": null,
"issues": [
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager missing: README.md: README.md is required for flavor tooling",
"file_path": "README.md",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-33",
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
"file_path": "WORK-RECORDS.md",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": true
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0015-T03' in workplan 'RPF-WP-0015' \u2014 decision 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd is resolved",
"file_path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md#RPF-WP-0015-T03",
"db_id": "",
"file_value": "2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0035-T02' in workplan 'RPF-WP-0035' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved",
"file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T02",
"db_id": "",
"file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0035-T03' in workplan 'RPF-WP-0035' \u2014 decision 62aa95e4-3ccc-4867-8806-5e3db005b483 is resolved",
"file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T03",
"db_id": "",
"file_value": "62aa95e4-3ccc-4867-8806-5e3db005b483",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0035-T07' in workplan 'RPF-WP-0035' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
"file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T07",
"db_id": "",
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0035-T08' in workplan 'RPF-WP-0035' \u2014 decision ab85ae8a-12a0-4945-ae64-1d3d86d5b26f is resolved",
"file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T08",
"db_id": "",
"file_value": "ab85ae8a-12a0-4945-ae64-1d3d86d5b26f",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0036-T03' in workplan 'RPF-WP-0036' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0036-platform-service-assurance.md#RPF-WP-0036-T03",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-39",
"message": "Wait task 'RPF-WP-0038-T04' in workplan 'RPF-WP-0038' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait",
"file_path": "workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md#RPF-WP-0038-T04",
"db_id": "",
"file_value": "wait",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0043-T03' in workplan 'RPF-WP-0043' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md#RPF-WP-0043-T03",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0043-T04' in workplan 'RPF-WP-0043' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md#RPF-WP-0043-T04",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0044-T04' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T04",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0044-T06' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T06",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0044-T07' in workplan 'RPF-WP-0044' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md#RPF-WP-0044-T07",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-40",
"message": "blocker satisfied, task still wait: 'RPF-WP-0048-T02' in workplan 'RPF-WP-0048' \u2014 decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is resolved",
"file_path": "workplans/RPF-WP-0048-activity-core-gitops-adoption.md#RPF-WP-0048-T02",
"db_id": "",
"file_value": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-23",
"message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)",
"file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md",
"db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3",
"file_value": "proposed",
"db_value": "proposed",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-39",
"message": "Wait task 'RPF-WP-0058-T05' in workplan 'RPF-WP-0058' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait",
"file_path": "workplans/RPF-WP-0058-reuse-private-source-reader.md#RPF-WP-0058-T05",
"db_id": "",
"file_value": "wait",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-06",
"message": "Authoritative workplan 43110f82\u2026 is absent from this projection",
"file_path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md",
"db_id": "43110f82-ef9f-5a46-a305-f0e287b7b226",
"file_value": "",
"db_value": "",
"fixable": true
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub",
"file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0004",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub",
"file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0005",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub",
"file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0006",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0005",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0006",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0007",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0004",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0007",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0008",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0004",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0007",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0008",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0007",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-20",
"message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub",
"file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md",
"db_id": "",
"file_value": "RAILIANCE-WP-0008",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "e57e487b-8557-439d-8093-0457c73ede93",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "671898ef-2378-4814-b8f6-066148cdad46",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "b059c81d-96f1-451f-896f-a05cd73744a1",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "f364d405-a85d-4b89-b600-1964ab436cad",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026, status=blocked) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "16e8f234-9305-5ff3-af82-4639215a0c54",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "022dda1f-8772-57ad-862e-672924455f11",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "857ca302-bb94-5d41-a649-1aa966368df4",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-25",
"message": "Owner-return task 'RPF-WP-0035-T08' waiting on audit-core has 9 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 570ca050-0316-4e38-9c16-be41057c2330, 2de1c6e7-9602-48e5-868d-0048fbbef150, e7c36b17-d8f7-4d86-af09-02111289d1f5, 5fe769a7-d35b-4e37-a671-673d13cf8948, b3c564a6-93f9-4c07-872b-7feb22cccb73, ec4995b5-e1b2-4c66-9f8d-5ac8d6ceb149, 7c4019f2-348d-475e-9c96-e1ff6d0d27f5, ff43fd2c-7633-4b34-9ae6-2483ba03a271, 0d0da0d2-36a1-4ffc-b7bf-7896fad691f6",
"file_path": "workplans/RPF-WP-0035-credential-lane-implementation.md#RPF-WP-0035-T08",
"db_id": "",
"file_value": "message-from:audit-core",
"db_value": "",
"fixable": false,
"repo_slug": "railiance-platform",
"source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"source_revision_reason": null,
"owner_return": {
"task_record_id": "RPF-WP-0035-T08",
"message_ids": [
"570ca050-0316-4e38-9c16-be41057c2330",
"2de1c6e7-9602-48e5-868d-0048fbbef150",
"e7c36b17-d8f7-4d86-af09-02111289d1f5",
"5fe769a7-d35b-4e37-a671-673d13cf8948",
"b3c564a6-93f9-4c07-872b-7feb22cccb73",
"ec4995b5-e1b2-4c66-9f8d-5ac8d6ceb149",
"7c4019f2-348d-475e-9c96-e1ff6d0d27f5",
"ff43fd2c-7633-4b34-9ae6-2483ba03a271",
"0d0da0d2-36a1-4ffc-b7bf-7896fad691f6"
]
}
},
{
"severity": "WARN",
"check_id": "C-25",
"message": "Owner-return task 'RPF-WP-0056-T03' waiting on railiance-cluster has 9 reply/replies after its last dated note (or unread when undated) \u2014 owner action needed: 4e9d4e58-71b3-497b-8954-cedc30740529, 13acb774-8fbe-4ca3-b44d-89a4742138bd, c9435491-8545-4d48-a57a-1773f2789092, fb8f25df-57ce-40e5-ae67-0c0b392746e8, 4bb0d7af-b644-44f3-acc8-69c7321e9824, 5301d4fb-0631-4ac5-8471-531e5362b2ba, 2087b9ac-c980-4881-89f1-6b1088132f5b, 78b89fb2-ced6-45f1-9718-0670b8257d45, 110e8dea-ce81-40ff-8161-325ddb89cd67",
"file_path": "workplans/RPF-WP-0056-playwright-consumer-admission.md#RPF-WP-0056-T03",
"db_id": "",
"file_value": "message-from:railiance-cluster",
"db_value": "",
"fixable": false,
"repo_slug": "railiance-platform",
"source_revision": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"source_revision_reason": null,
"owner_return": {
"task_record_id": "RPF-WP-0056-T03",
"message_ids": [
"4e9d4e58-71b3-497b-8954-cedc30740529",
"13acb774-8fbe-4ca3-b44d-89a4742138bd",
"c9435491-8545-4d48-a57a-1773f2789092",
"fb8f25df-57ce-40e5-ae67-0c0b392746e8",
"4bb0d7af-b644-44f3-acc8-69c7321e9824",
"5301d4fb-0631-4ac5-8471-531e5362b2ba",
"2087b9ac-c980-4881-89f1-6b1088132f5b",
"78b89fb2-ced6-45f1-9718-0670b8257d45",
"110e8dea-ce81-40ff-8161-325ddb89cd67"
]
}
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "14 unread message(s) lack thread_id for supersession tracking: the-custodian:836a8502, the-custodian:72c6a148, audit-core:0d0da0d2, rapp-postgres:6d047a08, railiance-platform:c4a80a60",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform",
"file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md",
"db_id": "",
"file_value": "RAIL-PL-WP-0002",
"db_value": "RPF-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform",
"file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md",
"db_id": "",
"file_value": "RAIL-PL-WP-0001",
"db_value": "RPF-WP",
"fixable": false
}
],
"fixes_applied": [
"bindings: synced 64/65",
"C-17 cleared: pushed 1 backlogged commit(s)",
"C-33 fixed: regenerated WORK-RECORDS.md",
"C-06 fixed: created workstream 43110f82\u2026 for RPF-WP-0060, wrote ID to RPF-WP-0060-browser-case-platform-bindings.md",
" + task RPF-WP-0060-T01 \u2192 afec2053\u2026",
" + task RPF-WP-0060-T02 \u2192 1a764c10\u2026",
" + task RPF-WP-0060-T03 \u2192 b5d73ec6\u2026",
" + task RPF-WP-0060-T04 \u2192 84f8b0a4\u2026",
"brief: .custodian-brief.md updated",
"push: pushed"
],
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 37,
"info": 20
},
"result": "warn"
}

1
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/consistency.stderr.txt Normal file
View file

@ -0,0 +1 @@
WARN: git commit failed for writeback: Generated-only commits rejected: staged

44
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-assignment.json Normal file
View file

@ -0,0 +1,44 @@
{
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "railiance-platform",
"namespace": "helixforge",
"assignments": [
{
"kind": "workplan",
"record_id": "RPF-WP-0060",
"uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T01",
"uuid": "afec2053-1995-506d-a112-cda1de552c1c",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T02",
"uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T03",
"uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T04",
"uuid": "84f8b0a4-8450-5623-8608-dc277978383b",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
}
],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": [
"workplans/RPF-WP-0060-browser-case-platform-bindings.md"
]
}

44
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/identifier-preview.json Normal file
View file

@ -0,0 +1,44 @@
{
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": false,
"repo": "railiance-platform",
"namespace": "helixforge",
"assignments": [
{
"kind": "workplan",
"record_id": "RPF-WP-0060",
"uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T01",
"uuid": "afec2053-1995-506d-a112-cda1de552c1c",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T02",
"uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T03",
"uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
},
{
"kind": "task",
"record_id": "RPF-WP-0060-T04",
"uuid": "84f8b0a4-8450-5623-8608-dc277978383b",
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md"
}
],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": [
"workplans/RPF-WP-0060-browser-case-platform-bindings.md"
]
}

449
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.json Normal file
View file

@ -0,0 +1,449 @@
{
"ok": true,
"status": "applied",
"repo_slug": "railiance-platform",
"commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"requests": 2,
"elapsed_ms": 5661.8,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "railiance-platform",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"derived_commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "railiance-platform",
"commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"status": "applied",
"counts": {
"created": 0,
"updated": 65,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 4,
"cancelled_tasks": 0,
"created_edges": 0,
"removed_edges": 0,
"unresolved_edges": 12,
"external_edges": 24
},
"created": [],
"updated": [
"RAIL-PL-WP-0001",
"RAIL-PL-WP-0002",
"RPF-WP-0001",
"RPF-WP-0002",
"RPF-WP-0003",
"RPF-WP-0004",
"RPF-WP-0005",
"RPF-WP-0006",
"RPF-WP-0007",
"RPF-WP-0008",
"RPF-WP-0009",
"RPF-WP-0010",
"RPF-WP-0011",
"RPF-WP-0012",
"RPF-WP-0013",
"RPF-WP-0014",
"RPF-WP-0015",
"RPF-WP-0016",
"RPF-WP-0017",
"RPF-WP-0018",
"RPF-WP-0019",
"RPF-WP-0020",
"RPF-WP-0021",
"RPF-WP-0022",
"RPF-WP-0023",
"RPF-WP-0024",
"RPF-WP-0025",
"RPF-WP-0026",
"RPF-WP-0027",
"RPF-WP-0028",
"RPF-WP-0029",
"RPF-WP-0030",
"RPF-WP-0031",
"RPF-WP-0032",
"RPF-WP-0033",
"RPF-WP-0034",
"RPF-WP-0035",
"RPF-WP-0036",
"RPF-WP-0037",
"RPF-WP-0038",
"RPF-WP-0039",
"RPF-WP-0040",
"RPF-WP-0041",
"RPF-WP-0042",
"RPF-WP-0043",
"RPF-WP-0044",
"RPF-WP-0045",
"RPF-WP-0046",
"RPF-WP-0047",
"RPF-WP-0048",
"RPF-WP-0049",
"RPF-WP-0050",
"RPF-WP-0051",
"RPF-WP-0052",
"RPF-WP-0053",
"RPF-WP-0054",
"RPF-WP-0055",
"RPF-WP-0056",
"RPF-WP-0057",
"RPF-WP-0058",
"RPF-WP-0059",
"RPF-WP-0060",
"RPF-WP-ADHOC-2026-08-23",
"RPF-WP-ADHOC-2026-10-10",
"RPF-WP-ADHOC-2026-10-11"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"RPF-WP-0060-T01",
"RPF-WP-0060-T02",
"RPF-WP-0060-T03",
"RPF-WP-0060-T04"
],
"cancelled_tasks": [],
"created_edges": [],
"removed_edges": [],
"unresolved_edges": [
{
"workplan": "RAIL-PL-WP-0002",
"from": "RAIL-PL-WP-0002",
"target": "RAIL-PL-WP-0001",
"reason": "missing"
},
{
"workplan": "RPF-WP-0002",
"from": "RPF-WP-0002",
"target": "RAILIANCE-WP-0005",
"reason": "missing"
},
{
"workplan": "RPF-WP-0002",
"from": "RPF-WP-0002",
"target": "RAILIANCE-WP-0006",
"reason": "missing"
},
{
"workplan": "RPF-WP-0002",
"from": "RPF-WP-0002",
"target": "RAILIANCE-WP-0007",
"reason": "missing"
},
{
"workplan": "RPF-WP-0003",
"from": "RPF-WP-0003",
"target": "RAILIANCE-WP-0007",
"reason": "missing"
},
{
"workplan": "RPF-WP-0003",
"from": "RPF-WP-0003",
"target": "RAILIANCE-WP-0008",
"reason": "missing"
},
{
"workplan": "RPF-WP-0004",
"from": "RPF-WP-0004",
"target": "RAILIANCE-WP-0007",
"reason": "missing"
},
{
"workplan": "RPF-WP-0004",
"from": "RPF-WP-0004",
"target": "RAILIANCE-WP-0008",
"reason": "missing"
},
{
"workplan": "RPF-WP-0005",
"from": "RPF-WP-0005",
"target": "RAILIANCE-WP-0007",
"reason": "missing"
},
{
"workplan": "RPF-WP-0005",
"from": "RPF-WP-0005",
"target": "RAILIANCE-WP-0008",
"reason": "missing"
},
{
"workplan": "RPF-WP-0024",
"from": "RPF-WP-0024",
"target": "RAILIANCE-WP-0005",
"reason": "missing"
},
{
"workplan": "RPF-WP-0024",
"from": "RPF-WP-0024",
"target": "RAILIANCE-WP-0006",
"reason": "missing"
}
],
"external_edges": [
{
"workplan": "RPF-WP-0057",
"from": "RPF-WP-0057-T04",
"target": "RPF-WP-0057-T03",
"relationship_type": "starts_after",
"from_workplan_id": "04f7c4aa-0a24-5d61-994d-2487ca6bfb91",
"from_task_id": "94cdfd1c-c639-5c5e-9bd6-7db823ab0265",
"to_workplan_id": null,
"to_task_id": "afa14a91-1ebf-5a45-a28b-380f9a933336"
},
{
"workplan": "RPF-WP-0003",
"from": "RPF-WP-0003",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "5fb6b6a7-3a40-5658-9804-21c0928c6dd9",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0024",
"from": "RPF-WP-0024",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "6c2e61cf-7aa9-58ee-bb22-3514b9692eb5",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T07",
"target": "SECRETS-WP-0006-T06",
"relationship_type": "starts_after",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b",
"to_workplan_id": null,
"to_task_id": "1431edae-5791-5892-8c4b-829419b537d2"
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T12",
"target": "RPF-WP-0035-T11",
"relationship_type": "starts_after",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "914bf383-c13f-5247-9af0-91d7e3a4784a",
"to_workplan_id": null,
"to_task_id": "7952c8cd-c066-5b72-a025-78d24341c1ab"
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T02",
"target": "KEY-WP-0039-T02",
"relationship_type": "starts_after",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "e0c82ea9-05a5-537e-8fbf-67534263572e",
"to_workplan_id": null,
"to_task_id": "03da4c38-1dac-53b1-8b0b-e697df48e9d3"
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T02",
"target": "MASON-WP-0009-T05",
"relationship_type": "starts_after",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "e0c82ea9-05a5-537e-8fbf-67534263572e",
"to_workplan_id": null,
"to_task_id": "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T03",
"target": "MASON-WP-0005-T05",
"relationship_type": "starts_after",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "f47e5bc5-6f3c-54bb-aa35-260ad03892ba",
"to_workplan_id": null,
"to_task_id": "4c205be7-4f1f-5dd1-aafa-fc112fdd640e"
},
{
"workplan": "RPF-WP-0035",
"from": "RPF-WP-0035-T03",
"target": "FT-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
"from_task_id": "f47e5bc5-6f3c-54bb-aa35-260ad03892ba",
"to_workplan_id": "f2373858-c932-5a4d-81b6-db9a3595135a",
"to_task_id": null
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T06",
"target": "RPF-WP-0044-T04",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80",
"to_workplan_id": null,
"to_task_id": "0e619658-0453-51ed-b9a0-bed28b5544fd"
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T06",
"target": "RPF-WP-0044-T05",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80",
"to_workplan_id": null,
"to_task_id": "d418068a-6fb0-5416-aac5-d23c93924d9c"
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T07",
"target": "RPF-WP-0044-T04",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d",
"to_workplan_id": null,
"to_task_id": "0e619658-0453-51ed-b9a0-bed28b5544fd"
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T07",
"target": "RPF-WP-0044-T06",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d",
"to_workplan_id": null,
"to_task_id": "4ca54868-c31f-5e3d-b7d3-a15b84c15f80"
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T07",
"target": "RPF-WP-0044-T03",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d",
"to_workplan_id": null,
"to_task_id": "6d5fc801-e361-579b-bcd8-6fe719a82e94"
},
{
"workplan": "RPF-WP-0044",
"from": "RPF-WP-0044-T07",
"target": "RPF-WP-0044-T05",
"relationship_type": "starts_after",
"from_workplan_id": "98140775-3b9a-5cf9-9af6-722502d487dc",
"from_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d",
"to_workplan_id": null,
"to_task_id": "d418068a-6fb0-5416-aac5-d23c93924d9c"
},
{
"workplan": "RPF-WP-0004",
"from": "RPF-WP-0004",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "afc66064-7ba4-5f11-b61f-d76890244b7e",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0023",
"from": "RPF-WP-0023",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "b07930f7-ff0e-5fda-b7b9-3b56467173b1",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0001",
"from": "RPF-WP-0001",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "bcc11cf9-d008-5e42-8fff-e2b33a1d0ff2",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0002",
"from": "RPF-WP-0002",
"target": "RAIL-PL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "c69cb4e7-15c8-5858-aebd-73a6e46f0f21",
"from_task_id": null,
"to_workplan_id": "fd1c045a-01d4-43be-980f-acbda6c64e6c",
"to_task_id": null
},
{
"workplan": "RPF-WP-0036",
"from": "RPF-WP-0036-T04",
"target": "RTEL-WP-0002",
"relationship_type": "blocks",
"from_workplan_id": "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84",
"from_task_id": "5351e0e4-6263-58f0-afb2-7c78c4cd6f68",
"to_workplan_id": "08a5db92-7293-50d3-b589-55287b9850b3",
"to_task_id": null
},
{
"workplan": "RPF-WP-0036",
"from": "RPF-WP-0036-T03",
"target": "ACTIVITY-WP-0042",
"relationship_type": "blocks",
"from_workplan_id": "ca639c3d-3a87-5fa4-ad13-6f2e014b0c84",
"from_task_id": "d64446fb-870b-5ae9-9628-f1fb9d06c5a4",
"to_workplan_id": "e1bfb5a4-e647-592d-883f-fe8728ad2f5f",
"to_task_id": null
},
{
"workplan": "RPF-WP-0043",
"from": "RPF-WP-0043-T03",
"target": "RAPP-POLICY-NEXUS-WP-0002-T02",
"relationship_type": "starts_after",
"from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c",
"from_task_id": "2afb1aac-66dd-5e1e-92e1-fc020a59a927",
"to_workplan_id": null,
"to_task_id": "18b26ecc-4fb8-516b-8d97-62ff39a85f24"
},
{
"workplan": "RPF-WP-0043",
"from": "RPF-WP-0043-T04",
"target": "RPF-WP-0043-T03",
"relationship_type": "starts_after",
"from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c",
"from_task_id": "8638fa73-439d-5dcd-85c7-81aa125170e1",
"to_workplan_id": null,
"to_task_id": "2afb1aac-66dd-5e1e-92e1-fc020a59a927"
},
{
"workplan": "RPF-WP-0043",
"from": "RPF-WP-0043-T04",
"target": "RPF-WP-0044-T07",
"relationship_type": "starts_after",
"from_workplan_id": "ec41a4bd-df18-5b07-9b63-ccb80d9f001c",
"from_task_id": "8638fa73-439d-5dcd-85c7-81aa125170e1",
"to_workplan_id": null,
"to_task_id": "844ff115-def2-55ca-ab01-413ba7e6857d"
}
],
"refused": [],
"notes": []
}
}
}

0
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/projection.stderr.txt Normal file
View file

29
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-commit.json Normal file
View file

@ -0,0 +1,29 @@
{
"exit_code": 0,
"commit": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"base": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9",
"files": [
{
"path": "scripts/keycape_client_secret_generate.py",
"sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28"
},
{
"path": "credential-grants/catalog.yaml",
"sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886"
},
{
"path": "tests/test_keycape_client_secret_generate.py",
"sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0"
},
{
"path": "tests/test_credential_grants.py",
"sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a"
},
{
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md",
"sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030"
}
],
"stdout": "[main d35c0f9] Bind mint broker validation to exact reviewed sources and track successor obligations\n 5 files changed, 337 insertions(+), 8 deletions(-)\n create mode 100644 workplans/RPF-WP-0060-browser-case-platform-bindings.md\n",
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 5, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
}

27
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/publication-inputs.json Normal file
View file

@ -0,0 +1,27 @@
{
"owner": "railiance-platform",
"base_revision": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9",
"message": "Bind mint broker validation to exact reviewed sources and track successor obligations",
"files": [
{
"path": "scripts/keycape_client_secret_generate.py",
"sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28"
},
{
"path": "credential-grants/catalog.yaml",
"sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886"
},
{
"path": "tests/test_keycape_client_secret_generate.py",
"sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0"
},
{
"path": "tests/test_credential_grants.py",
"sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a"
},
{
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md",
"sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030"
}
]
}

44
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/source-application.json Normal file
View file

@ -0,0 +1,44 @@
{
"base": "104ed90f42a9a86bf9fda343b49b65a85c9ee4b9",
"review_sha256": "sha256:05d5bf9c2b90a8562ce4675866b8b23c0e12d5d069b43b194948d384b0a553f5",
"files": [
{
"path": "scripts/keycape_client_secret_generate.py",
"sha256": "da80947a2c28df36b37e711d1e6d2f66b4c0434082e7bf187da3d3cb692cec28"
},
{
"path": "credential-grants/catalog.yaml",
"sha256": "7cfe12970a57ab75cb91c7c5024a4dcfc28ffae4b31a1afaf4d0cedabbb22886"
},
{
"path": "tests/test_keycape_client_secret_generate.py",
"sha256": "5906e32c7fe0db09c1f7db48ad61226497e062f38ebfa91e8a03be89272765c0"
},
{
"path": "tests/test_credential_grants.py",
"sha256": "5c0cfcb039c0220e59dac7986d960bb568593a3a9281ff2557bb6c38de31e68a"
},
{
"path": "workplans/RPF-WP-0060-browser-case-platform-bindings.md",
"sha256": "afcec12b2adc21d9f70ce271932975284b69f979f9e60d7569debbbe99f3d030"
}
],
"existing_workplans_preserved": 65,
"unrelated_state": {
"WORK-RECORDS.md": {
"worktree": "1fc51bf92554968f844ca03a68458c5f3f43ce20ad220e26fc447f2d39ed732e",
"index": "100644 dc7f3aab6de945558ddb9e48a482a9d92d734c3b 0\tWORK-RECORDS.md"
},
".custodian-brief.md": {
"worktree": "db5a3d67113c2a8ce6a30bd30f03e791bacfc38cbb9963c1f8c11e805c02c66f",
"index": "100644 1c9e635012d170c76646bf76d5202f6de163a643 0\t.custodian-brief.md"
}
},
"native_actions": false,
"tasks": {
"RPF-WP-0060-T01": "progress",
"RPF-WP-0060-T02": "done",
"RPF-WP-0060-T03": "todo",
"RPF-WP-0060-T04": "todo"
}
}

28
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/verified-task-bindings.json Normal file
View file

@ -0,0 +1,28 @@
{
"workplan_uuid": "43110f82-ef9f-5a46-a305-f0e287b7b226",
"source_primary_bindings": [
{
"record_id": "RPF-WP-0060-T01",
"uuid": "afec2053-1995-506d-a112-cda1de552c1c",
"status": "progress"
},
{
"record_id": "RPF-WP-0060-T02",
"uuid": "1a764c10-3a41-5eff-af96-c9e33a6e2c8b",
"status": "done"
},
{
"record_id": "RPF-WP-0060-T03",
"uuid": "b5d73ec6-c593-50a9-8367-f899edec6f5f",
"status": "todo"
},
{
"record_id": "RPF-WP-0060-T04",
"uuid": "84f8b0a4-8450-5623-8608-dc277978383b",
"status": "todo"
}
],
"task_count": 4,
"source_head": "d35c0f9d4b1c12684cfc334cd876ba0e96a13b88",
"projection": "primary/railiance01"
}

113
docs/changes/netkingdom-target-2026-10-17/platform-current-source-integration-r1/workplan.md Normal file
View file

@ -0,0 +1,113 @@
---
id: RPF-WP-0060
type: workplan
title: "Implement Platform bindings for the browser SecurityCase successor"
domain: financials
repo: railiance-platform
status: active
owner: codex
topic_slug: netkingdom
created: "2026-10-17"
updated: "2026-10-17"
flavor: implementation
origin: cross-repo
origin_ref: NK-WP-0048-T16
---
Demand: Platform's source review of the proposed browser SecurityCase 1.3
requires four concrete owner obligations before owner-descriptor acceptance.
The review labels `RPF-1.3-T1` through `T4` were not live work records; this
workplan makes them ordinary owner tasks without changing RPF-WP-0054's
completed first-generation lane or implementing its residual rotation work.
Review: `the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json`.
The 1.3 type remains proposed. This workplan grants no native access, case
acceptance, owner acknowledgment, catalog activation or policy change.
## T01 — Bind the broker to reviewed acknowledged type sources
```task
id: RPF-WP-0060-T01
status: progress
priority: high
```
Implements review obligation RPF-1.3-T1. The broker's explicit source map admits
only its existing 1.1 revision. Exact type and producer bytes, parameter
fingerprint, acknowledgment state and case schema are checked before any Bao
call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation
layout is `railiance-platform` and `net-kingdom` as real sibling directories;
missing, symlinked or drifted selected sources refuse rather than fall back.
2026-10-17: source hardening and catalog regressions independently reviewed in
`the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/`.
The exact case reference binds caller-supplied bytes; schema validation does
not authenticate case acceptance. Existing Warden admission/native evidence
must establish that independently. This task remains open for the real binding
and explicit 1.3 source/parameter pins after genuine acknowledgment and review.
No speculative successor pin or acknowledgment is added.
Done when the actual admitted-case binding is verified, the genuinely
acknowledged successor is explicitly selected, and refusal tests cover unknown,
unacknowledged, wrong-case and drifted-source inputs before native effects.
## T02 — Correct the documented mint caller and issuer binding
```task
id: RPF-WP-0060-T02
status: done
priority: high
```
Implements review obligation RPF-1.3-T2. `credential-grants/catalog.yaml` now
names human-operator only and the exact existing issuer role
`auth/netkingdom/role/credential-broker-keycape-client-secret-generate`.
Regression checks bind this statement to CCR-2026-0043's role source,
net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant,
credential or live configuration changes.
## T03 — Implement mint, guarded destruction and authenticated evidence
```task
id: RPF-WP-0060-T03
status: todo
priority: high
```
Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed
`railiance-platform.custody-mint.v1` projection and authenticated publication.
Capture grant accessor and revocation evidence and revoke the issuer session.
Destruction uses attended platform-admin authority and compares the original
CAS-0 version-1 creation time, current version and absence of other versions
before metadata deletion. No standing family-wide delete grant is introduced.
Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN
for owner reconciliation. Verify with the frozen adapter, then obtain the
required native authority and actual execution receipts.
## T04 — Implement and admit the delivery lane and capability
```task
id: RPF-WP-0060-T04
status: todo
priority: high
```
Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store
contract; validate the preexisting Store and only create the case-derived
ExternalSecret in `sso`. Refuse conflicts; report NO_CHANGE only for matching
preexisting configuration; establish current Ready status before success.
Return the closed metadata-only `netkingdom.deliver-secret.v1` receipt and use
UID and resourceVersion preconditions to remove only authenticated case-created
resources. Never read Secret values or create the Store through this lane.
Bind real human net-kingdom-admins/aal2 admission, per-attempt session and
revocation, durable pre-intent/recovery journal and authenticated owner evidence.
The separate command-mechanics candidate is preparation, not this capability;
its production factory refuses. Review freshness/defaulting/transport failure
cases before integrating it. Obtain ops-warden's catalog routing acceptance for
`platform-secret-delivery` through an authorized handoff before recording owner
acceptance. No routing handoff or native action is implied by this work record.
The parent stays active until these obligations and their required owner
acceptance are proved. Source tests do not complete native acceptance or
KEY-WP-0039's negative/expiry/cleanup exercise.