security: record introduced-history scanner proof and native admission gates
This commit is contained in:
codex
parent
e5ebbdba5b
commit
78081dabf2
7 changed files with 259 additions and 11 deletions
|
|
@ -0,0 +1,146 @@
|
|||
{
|
||||
"assessed_at": "2026-10-12T16:39:28.319476+00:00",
|
||||
"scope": "Forge-owned source adapter and disposable actual Git receive-pack protocol; no production installation or whole DSM/G07 closure",
|
||||
"owner_workplan": "FORGE-WP-0006",
|
||||
"coordinator": "RMGR-WP-0021-T03 / CUST-WP-0080-T03",
|
||||
"source_manifest": [
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/Makefile",
|
||||
"sha256": "03e690bf8c6c6375aa9f099eaa2789ceb42153d9942dbded86dd405fc2e1754e",
|
||||
"prior_sha256": "6a9cea7fd0b5991da3d5a081245f4e0f7def50a3c4e92037cd68369be55c3356"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/go.mod",
|
||||
"sha256": "0dc9f91da4769328bb72c1ea73dfa6ac9dd3db72f3840a2cef3874c8d69dca3f",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go",
|
||||
"sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main_test.go",
|
||||
"sha256": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/docs/receive-secret-detection.md",
|
||||
"sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md",
|
||||
"sha256": "9747930fafdfc7779bb839d004911e9b4e35f92ccc4e2bdb8c7e2860023f39e5",
|
||||
"prior_sha256": null
|
||||
}
|
||||
],
|
||||
"source_install_manifest_sha256": "8f011d82310704f8624f50a7bb452a61376bfdce809e60a03d07aca581b2f376",
|
||||
"source_install_authorization": "Exact guarded sibling-source installer approved through filesystem permission flow; no server mutation or expanded credential authority.",
|
||||
"toolchain": {
|
||||
"version": "go1.26.9",
|
||||
"source": "https://go.dev/dl/go1.26.9.linux-amd64.tar.gz",
|
||||
"sha256": "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d",
|
||||
"verification": "Compared official go.dev release JSON SHA256; no detached signature claim."
|
||||
},
|
||||
"scanner": {
|
||||
"version": "8.30.1",
|
||||
"sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"admission_ref": "secret-hook-activation-record.json"
|
||||
},
|
||||
"candidate_binary": {
|
||||
"sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
|
||||
"build": "CGO_ENABLED=0 GOTOOLCHAIN=local GOOS=linux GOARCH=amd64 go1.26.9 build -trimpath -buildvcs=false",
|
||||
"format": "statically linked Linux amd64 ELF",
|
||||
"native_deployment_admitted": false,
|
||||
"note": "Protocol tests compile the same source without trimpath; this release candidate still requires exact-binary native admission."
|
||||
},
|
||||
"tests": {
|
||||
"leaf_cases": [
|
||||
"TestUpdateInputRefusesAmbiguity",
|
||||
"TestTreeRefusesMalformedAndExternalEntries",
|
||||
"TestGitEnvironmentDoesNotInheritConfigOrSecrets",
|
||||
"TestCappedOutput",
|
||||
"TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/false",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/true",
|
||||
"TestNativePushBoundaries/sha256-object-format",
|
||||
"TestNativePushBoundaries/secret-in-tip",
|
||||
"TestNativePushBoundaries/secret-added-then-deleted",
|
||||
"TestNativePushBoundaries/new-branch-and-force-update",
|
||||
"TestNativePushBoundaries/merge-second-parent-history",
|
||||
"TestNativePushBoundaries/commit-message",
|
||||
"TestNativePushBoundaries/annotated-tag-message",
|
||||
"TestNativePushBoundaries/tag-direct-to-blob",
|
||||
"TestNativePushBoundaries/multi-ref-all-refused",
|
||||
"TestNativePushBoundaries/missing-scanner-and-deletion-refused",
|
||||
"TestNativePushBoundaries/wrong-executable-refused",
|
||||
"TestNativePushBoundaries/inline-and-config-suppression-refused",
|
||||
"TestNativePushBoundaries/replacement-objects-cannot-hide-secret",
|
||||
"TestNativePushBoundaries/grafts-cannot-hide-introduced-history",
|
||||
"TestNativePushBoundaries/ref-name-token",
|
||||
"TestNativePushBoundaries/partial-config-include-refused",
|
||||
"TestNativePushBoundaries/object-count-limit-refused",
|
||||
"TestNativePushBoundaries/external-gitlink-refused",
|
||||
"TestNativePushBoundaries/partial-repository-refused",
|
||||
"TestNativePushBoundaries/aggregate-byte-limit-refused",
|
||||
"TestNativePushBoundaries/oversized-object-refused",
|
||||
"TestScannerFileAndTimeoutRefusal/nonexecutable",
|
||||
"TestScannerFileAndTimeoutRefusal/symlink",
|
||||
"TestScannerFileAndTimeoutRefusal/expired-context",
|
||||
"TestScannerFileAndTimeoutRefusal/scanner-process-failure",
|
||||
"TestScannerFileAndTimeoutRefusal/unknown-old-ref"
|
||||
],
|
||||
"passed_leaf_cases": 33,
|
||||
"passing_test_nodes": 36,
|
||||
"skipped": 0,
|
||||
"failed": 0,
|
||||
"actual_owner_make_target": "make test-secret-detection passed in 54.403s with explicit pinned scanner and Go1.26.9",
|
||||
"existing_owner_python_suite": "1 passed",
|
||||
"logs": [
|
||||
"receive-secret-tests.txt",
|
||||
"receive-secret-owner-tests.txt"
|
||||
]
|
||||
},
|
||||
"retained_failed_attempts": [
|
||||
{
|
||||
"log_sha256": "c3edba915bbdc35c2558d0c076fc9b08c823c5a197720d2259046f1ade54d076",
|
||||
"outcome": "Test binary build failed because invalid parent /tmp/.git prevented Go VCS stamping; disposable build made explicit with -buildvcs=false."
|
||||
},
|
||||
{
|
||||
"log_sha256": "d6cf7c3643ca6a0babeab0b478368a908d66e26a7d87fa3cbe8f48ad7c873800",
|
||||
"outcome": "Unsupported --no-use-bitmap-index caused unverified refusals. Removed unsupported option and required each negative push test to assert blocked versus unverified; unrelated failures are not successful detection proof."
|
||||
}
|
||||
],
|
||||
"refinement": "Preflight all object sizes and aggregate bytes before scanner payload work; aggregate-limit test requires zero scanned objects.",
|
||||
"remaining": [
|
||||
"Admit production repository denominator, including archives/mirrors/wikis/new repositories.",
|
||||
"Review exact tool/adapter custody, resource limits, dispatch composition, abort owner and rollback.",
|
||||
"Verify exact artifact in deployed image and installed SSH/HTTP/frontend merge/edit/import paths.",
|
||||
"Verify hook regeneration/restarts/new-repository lifecycle.",
|
||||
"Independently verify CI writers/required checks and private detection-to-response.",
|
||||
"Historical reachable objects, unreachable extra pack objects, LFS, artifacts, runtime/log detection remain separate coverage."
|
||||
],
|
||||
"no_live_forge_mutation": true,
|
||||
"no_live_credential_handling": true,
|
||||
"owner_source_commit": "6d5c9e2",
|
||||
"owner_identifier_commit": "d805b00",
|
||||
"coordinator_handoff_commit": "847786e",
|
||||
"owner_workplan_id": "69458fdc-d727-5391-b88b-d03da0afe24e",
|
||||
"owner_task_readback": [
|
||||
{
|
||||
"id": "cd81bc07-e3b9-55f4-bafd-e78d271497ee",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "210e7935-944a-5720-b356-18b48a68aa5e",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"id": "e65f9093-f615-5af9-a2c0-21e17ff35dcf",
|
||||
"status": "todo"
|
||||
}
|
||||
],
|
||||
"post_sync_workplan_sha256": "8ef5c82456fa6b6cae95f7b7c7c8731a2affa57626d3242000693fea995c5440",
|
||||
"sync_note": "Required forge consistency sync indexed new workplan/tasks. Generated-only working-memory auto-commit was refused by existing guard; source task identifiers committed separately. Generated brief/index changes remain local."
|
||||
}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
cd tools/receive-secret-scan && go test -count=1 ./...
|
||||
ok railiance-forge/receive-secret-scan 54.403s
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
=== RUN TestUpdateInputRefusesAmbiguity
|
||||
--- PASS: TestUpdateInputRefusesAmbiguity (0.00s)
|
||||
=== RUN TestTreeRefusesMalformedAndExternalEntries
|
||||
--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s)
|
||||
=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets
|
||||
--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s)
|
||||
=== RUN TestCappedOutput
|
||||
--- PASS: TestCappedOutput (0.00s)
|
||||
=== RUN TestNativePushBoundaries
|
||||
=== RUN TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/false
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/true
|
||||
=== RUN TestNativePushBoundaries/sha256-object-format
|
||||
=== RUN TestNativePushBoundaries/secret-in-tip
|
||||
=== RUN TestNativePushBoundaries/secret-added-then-deleted
|
||||
=== RUN TestNativePushBoundaries/new-branch-and-force-update
|
||||
=== RUN TestNativePushBoundaries/merge-second-parent-history
|
||||
=== RUN TestNativePushBoundaries/commit-message
|
||||
=== RUN TestNativePushBoundaries/annotated-tag-message
|
||||
=== RUN TestNativePushBoundaries/tag-direct-to-blob
|
||||
=== RUN TestNativePushBoundaries/multi-ref-all-refused
|
||||
=== RUN TestNativePushBoundaries/missing-scanner-and-deletion-refused
|
||||
=== RUN TestNativePushBoundaries/wrong-executable-refused
|
||||
=== RUN TestNativePushBoundaries/inline-and-config-suppression-refused
|
||||
=== RUN TestNativePushBoundaries/replacement-objects-cannot-hide-secret
|
||||
=== RUN TestNativePushBoundaries/grafts-cannot-hide-introduced-history
|
||||
=== RUN TestNativePushBoundaries/ref-name-token
|
||||
=== RUN TestNativePushBoundaries/partial-config-include-refused
|
||||
=== RUN TestNativePushBoundaries/object-count-limit-refused
|
||||
=== RUN TestNativePushBoundaries/external-gitlink-refused
|
||||
=== RUN TestNativePushBoundaries/partial-repository-refused
|
||||
=== RUN TestNativePushBoundaries/aggregate-byte-limit-refused
|
||||
=== RUN TestNativePushBoundaries/oversized-object-refused
|
||||
--- PASS: TestNativePushBoundaries (112.32s)
|
||||
--- PASS: TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion (5.41s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret (7.07s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/false (3.53s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/true (3.54s)
|
||||
--- PASS: TestNativePushBoundaries/sha256-object-format (7.37s)
|
||||
--- PASS: TestNativePushBoundaries/secret-in-tip (4.00s)
|
||||
--- PASS: TestNativePushBoundaries/secret-added-then-deleted (3.75s)
|
||||
--- PASS: TestNativePushBoundaries/new-branch-and-force-update (8.24s)
|
||||
--- PASS: TestNativePushBoundaries/merge-second-parent-history (8.75s)
|
||||
--- PASS: TestNativePushBoundaries/commit-message (2.05s)
|
||||
--- PASS: TestNativePushBoundaries/annotated-tag-message (2.27s)
|
||||
--- PASS: TestNativePushBoundaries/tag-direct-to-blob (2.42s)
|
||||
--- PASS: TestNativePushBoundaries/multi-ref-all-refused (4.55s)
|
||||
--- PASS: TestNativePushBoundaries/missing-scanner-and-deletion-refused (0.32s)
|
||||
--- PASS: TestNativePushBoundaries/wrong-executable-refused (0.29s)
|
||||
--- PASS: TestNativePushBoundaries/inline-and-config-suppression-refused (6.95s)
|
||||
--- PASS: TestNativePushBoundaries/replacement-objects-cannot-hide-secret (2.25s)
|
||||
--- PASS: TestNativePushBoundaries/grafts-cannot-hide-introduced-history (14.53s)
|
||||
--- PASS: TestNativePushBoundaries/ref-name-token (6.01s)
|
||||
--- PASS: TestNativePushBoundaries/partial-config-include-refused (0.79s)
|
||||
--- PASS: TestNativePushBoundaries/object-count-limit-refused (6.71s)
|
||||
--- PASS: TestNativePushBoundaries/external-gitlink-refused (5.30s)
|
||||
--- PASS: TestNativePushBoundaries/partial-repository-refused (0.49s)
|
||||
--- PASS: TestNativePushBoundaries/aggregate-byte-limit-refused (11.41s)
|
||||
--- PASS: TestNativePushBoundaries/oversized-object-refused (0.87s)
|
||||
=== RUN TestScannerFileAndTimeoutRefusal
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/nonexecutable
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/symlink
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/expired-context
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/scanner-process-failure
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/unknown-old-ref
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal (2.44s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/nonexecutable (0.19s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/symlink (0.01s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/expired-context (0.05s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/scanner-process-failure (0.84s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/unknown-old-ref (0.05s)
|
||||
PASS
|
||||
ok railiance-forge/receive-secret-scan 114.784s
|
||||
|
|
@ -841,12 +841,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Production repository denominator, other workstation clones, independent automation coverage and historical/runtime findings remain unverified.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
@ -865,12 +866,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Push/server/CI controls, logs/artifacts/runtime detection and independent boundary coverage remain unverified.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
@ -889,12 +891,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Independent push prevention has not been demonstrated. A local hook alone remains bypassable; introduced-history and remote acceptance proof are required.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -155,7 +155,9 @@ commit rejection with pinned, content-silent staged-blob scanning for 22 exact
|
|||
workstation checkout paths. Actual hooks passed clean, disposable-key rejection
|
||||
and scanner-failure checks; other hooks/routing and unreviewed checkout behavior
|
||||
were preserved. RMGR-WP-0021-T02 records local activation; independent forge/CI
|
||||
enforcement and response remain open. [Activation receipt](evidence/2026-10-12-netkingdom-security/secret-hook-activation.json). A local hook is bypassable,
|
||||
enforcement and response remain open. [Activation receipt](evidence/2026-10-12-netkingdom-security/secret-hook-activation.json). FORGE-WP-0006 now supplies the independent introduced-history adapter in source;
|
||||
its disposable push tests do not establish server activation or complete repository
|
||||
coverage. A local hook is bypassable,
|
||||
so it cannot substitute for independent introduced-history checks or governed
|
||||
incident response. [Coverage evidence](evidence/2026-10-12-netkingdom-security/secret-detection.json).
|
||||
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ No whole-estate SEC-DSM conformance or maturity level is claimed.
|
|||
| G04 | Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery. | MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03 | Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings |
|
||||
| G05 | Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation |
|
||||
| G06 | Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness. | AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records | Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion |
|
||||
| G07 | The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. Independent forge/CI prevention and response remain unverified. | RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure |
|
||||
| G07 | The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. Independent forge/CI prevention and response remain unverified. | RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI via FORGE-WP-0006, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure |
|
||||
| G08 | Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified. | NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work | Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests |
|
||||
| G09 | Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption. | CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07 | For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred |
|
||||
| G10 | Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields. | CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions | Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance |
|
||||
|
|
@ -111,6 +111,15 @@ directories are a discovery count, not a reviewed production denominator.
|
|||
Actions/branch-protection and actual push refusal are still unverified.
|
||||
[Read-only inventory](evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json).
|
||||
|
||||
G07 introduced-history source: FORGE-WP-0006 adds a standalone forge-owned
|
||||
receive adapter, separate from repository-controlled workflows and the local
|
||||
index scanner. Thirty-three leaf cases pass with actual disposable pushes;
|
||||
clean pushes are accepted and intermediate/merge/message/tag secrets rejected.
|
||||
Resource/tool/traversal failures refuse; aggregate bytes are checked before
|
||||
payload scanning. No production hook is activated by this source work.
|
||||
Exact-binary/runtime admission, full inventory and forge frontend/transport
|
||||
acceptance remain open. [Source and protocol receipt](evidence/2026-10-12-netkingdom-security/receive-secret-detection.json).
|
||||
|
||||
## SEC DSM requirement coverage
|
||||
|
||||
Each numbered requirement in these families is in scope for assessment. The
|
||||
|
|
|
|||
|
|
@ -173,6 +173,18 @@ internal policies and actual push rejection remain unverified. Metadata and
|
|||
upstream comparison: `forge-secret-detection-baseline.json`. No server mutation,
|
||||
credential read, repository-content scan or synthetic push was performed.
|
||||
|
||||
2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native
|
||||
forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans
|
||||
introduced reachable Git objects and updated ref names, preserving quarantine
|
||||
and refusing incomplete/oversized input. Thirty-three leaf cases pass, including
|
||||
actual disposable pushes for intermediate/deleted secrets, second-parent merges,
|
||||
messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and
|
||||
scanner failures. Existing owner Python test passes; the new owner Make target
|
||||
passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`.
|
||||
No production hook changed. Exact-binary admission, repository denominator,
|
||||
SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain
|
||||
open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open.
|
||||
|
||||
## Verify native closure against every requirement
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue