diff --git a/docs/evidence/2026-10-12-netkingdom-security/receive-secret-detection.json b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-detection.json new file mode 100644 index 0000000..42da657 --- /dev/null +++ b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-detection.json @@ -0,0 +1,146 @@ +{ + "assessed_at": "2026-10-12T16:39:28.319476+00:00", + "scope": "Forge-owned source adapter and disposable actual Git receive-pack protocol; no production installation or whole DSM/G07 closure", + "owner_workplan": "FORGE-WP-0006", + "coordinator": "RMGR-WP-0021-T03 / CUST-WP-0080-T03", + "source_manifest": [ + { + "path": "/home/worsch/railiance-forge/Makefile", + "sha256": "03e690bf8c6c6375aa9f099eaa2789ceb42153d9942dbded86dd405fc2e1754e", + "prior_sha256": "6a9cea7fd0b5991da3d5a081245f4e0f7def50a3c4e92037cd68369be55c3356" + }, + { + "path": "/home/worsch/railiance-forge/tools/receive-secret-scan/go.mod", + "sha256": "0dc9f91da4769328bb72c1ea73dfa6ac9dd3db72f3840a2cef3874c8d69dca3f", + "prior_sha256": null + }, + { + "path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go", + "sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6", + "prior_sha256": null + }, + { + "path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main_test.go", + "sha256": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5", + "prior_sha256": null + }, + { + "path": "/home/worsch/railiance-forge/docs/receive-secret-detection.md", + "sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478", + "prior_sha256": null + }, + { + "path": "/home/worsch/railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md", + "sha256": "9747930fafdfc7779bb839d004911e9b4e35f92ccc4e2bdb8c7e2860023f39e5", + "prior_sha256": null + } + ], + "source_install_manifest_sha256": "8f011d82310704f8624f50a7bb452a61376bfdce809e60a03d07aca581b2f376", + "source_install_authorization": "Exact guarded sibling-source installer approved through filesystem permission flow; no server mutation or expanded credential authority.", + "toolchain": { + "version": "go1.26.9", + "source": "https://go.dev/dl/go1.26.9.linux-amd64.tar.gz", + "sha256": "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d", + "verification": "Compared official go.dev release JSON SHA256; no detached signature claim." + }, + "scanner": { + "version": "8.30.1", + "sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", + "admission_ref": "secret-hook-activation-record.json" + }, + "candidate_binary": { + "sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec", + "build": "CGO_ENABLED=0 GOTOOLCHAIN=local GOOS=linux GOARCH=amd64 go1.26.9 build -trimpath -buildvcs=false", + "format": "statically linked Linux amd64 ELF", + "native_deployment_admitted": false, + "note": "Protocol tests compile the same source without trimpath; this release candidate still requires exact-binary native admission." + }, + "tests": { + "leaf_cases": [ + "TestUpdateInputRefusesAmbiguity", + "TestTreeRefusesMalformedAndExternalEntries", + "TestGitEnvironmentDoesNotInheritConfigOrSecrets", + "TestCappedOutput", + "TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion", + "TestNativePushBoundaries/initial-repository-clean-and-secret/false", + "TestNativePushBoundaries/initial-repository-clean-and-secret/true", + "TestNativePushBoundaries/sha256-object-format", + "TestNativePushBoundaries/secret-in-tip", + "TestNativePushBoundaries/secret-added-then-deleted", + "TestNativePushBoundaries/new-branch-and-force-update", + "TestNativePushBoundaries/merge-second-parent-history", + "TestNativePushBoundaries/commit-message", + "TestNativePushBoundaries/annotated-tag-message", + "TestNativePushBoundaries/tag-direct-to-blob", + "TestNativePushBoundaries/multi-ref-all-refused", + "TestNativePushBoundaries/missing-scanner-and-deletion-refused", + "TestNativePushBoundaries/wrong-executable-refused", + "TestNativePushBoundaries/inline-and-config-suppression-refused", + "TestNativePushBoundaries/replacement-objects-cannot-hide-secret", + "TestNativePushBoundaries/grafts-cannot-hide-introduced-history", + "TestNativePushBoundaries/ref-name-token", + "TestNativePushBoundaries/partial-config-include-refused", + "TestNativePushBoundaries/object-count-limit-refused", + "TestNativePushBoundaries/external-gitlink-refused", + "TestNativePushBoundaries/partial-repository-refused", + "TestNativePushBoundaries/aggregate-byte-limit-refused", + "TestNativePushBoundaries/oversized-object-refused", + "TestScannerFileAndTimeoutRefusal/nonexecutable", + "TestScannerFileAndTimeoutRefusal/symlink", + "TestScannerFileAndTimeoutRefusal/expired-context", + "TestScannerFileAndTimeoutRefusal/scanner-process-failure", + "TestScannerFileAndTimeoutRefusal/unknown-old-ref" + ], + "passed_leaf_cases": 33, + "passing_test_nodes": 36, + "skipped": 0, + "failed": 0, + "actual_owner_make_target": "make test-secret-detection passed in 54.403s with explicit pinned scanner and Go1.26.9", + "existing_owner_python_suite": "1 passed", + "logs": [ + "receive-secret-tests.txt", + "receive-secret-owner-tests.txt" + ] + }, + "retained_failed_attempts": [ + { + "log_sha256": "c3edba915bbdc35c2558d0c076fc9b08c823c5a197720d2259046f1ade54d076", + "outcome": "Test binary build failed because invalid parent /tmp/.git prevented Go VCS stamping; disposable build made explicit with -buildvcs=false." + }, + { + "log_sha256": "d6cf7c3643ca6a0babeab0b478368a908d66e26a7d87fa3cbe8f48ad7c873800", + "outcome": "Unsupported --no-use-bitmap-index caused unverified refusals. Removed unsupported option and required each negative push test to assert blocked versus unverified; unrelated failures are not successful detection proof." + } + ], + "refinement": "Preflight all object sizes and aggregate bytes before scanner payload work; aggregate-limit test requires zero scanned objects.", + "remaining": [ + "Admit production repository denominator, including archives/mirrors/wikis/new repositories.", + "Review exact tool/adapter custody, resource limits, dispatch composition, abort owner and rollback.", + "Verify exact artifact in deployed image and installed SSH/HTTP/frontend merge/edit/import paths.", + "Verify hook regeneration/restarts/new-repository lifecycle.", + "Independently verify CI writers/required checks and private detection-to-response.", + "Historical reachable objects, unreachable extra pack objects, LFS, artifacts, runtime/log detection remain separate coverage." + ], + "no_live_forge_mutation": true, + "no_live_credential_handling": true, + "owner_source_commit": "6d5c9e2", + "owner_identifier_commit": "d805b00", + "coordinator_handoff_commit": "847786e", + "owner_workplan_id": "69458fdc-d727-5391-b88b-d03da0afe24e", + "owner_task_readback": [ + { + "id": "cd81bc07-e3b9-55f4-bafd-e78d271497ee", + "status": "done" + }, + { + "id": "210e7935-944a-5720-b356-18b48a68aa5e", + "status": "todo" + }, + { + "id": "e65f9093-f615-5af9-a2c0-21e17ff35dcf", + "status": "todo" + } + ], + "post_sync_workplan_sha256": "8ef5c82456fa6b6cae95f7b7c7c8731a2affa57626d3242000693fea995c5440", + "sync_note": "Required forge consistency sync indexed new workplan/tasks. Generated-only working-memory auto-commit was refused by existing guard; source task identifiers committed separately. Generated brief/index changes remain local." +} diff --git a/docs/evidence/2026-10-12-netkingdom-security/receive-secret-owner-tests.txt b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-owner-tests.txt new file mode 100644 index 0000000..f48ea91 --- /dev/null +++ b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-owner-tests.txt @@ -0,0 +1,2 @@ +cd tools/receive-secret-scan && go test -count=1 ./... +ok railiance-forge/receive-secret-scan 54.403s diff --git a/docs/evidence/2026-10-12-netkingdom-security/receive-secret-tests.txt b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-tests.txt new file mode 100644 index 0000000..4d4e969 --- /dev/null +++ b/docs/evidence/2026-10-12-netkingdom-security/receive-secret-tests.txt @@ -0,0 +1,74 @@ +=== RUN TestUpdateInputRefusesAmbiguity +--- PASS: TestUpdateInputRefusesAmbiguity (0.00s) +=== RUN TestTreeRefusesMalformedAndExternalEntries +--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s) +=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets +--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s) +=== RUN TestCappedOutput +--- PASS: TestCappedOutput (0.00s) +=== RUN TestNativePushBoundaries +=== RUN TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/false +=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/true +=== RUN TestNativePushBoundaries/sha256-object-format +=== RUN TestNativePushBoundaries/secret-in-tip +=== RUN TestNativePushBoundaries/secret-added-then-deleted +=== RUN TestNativePushBoundaries/new-branch-and-force-update +=== RUN TestNativePushBoundaries/merge-second-parent-history +=== RUN TestNativePushBoundaries/commit-message +=== RUN TestNativePushBoundaries/annotated-tag-message +=== RUN TestNativePushBoundaries/tag-direct-to-blob +=== RUN TestNativePushBoundaries/multi-ref-all-refused +=== RUN TestNativePushBoundaries/missing-scanner-and-deletion-refused +=== RUN TestNativePushBoundaries/wrong-executable-refused +=== RUN TestNativePushBoundaries/inline-and-config-suppression-refused +=== RUN TestNativePushBoundaries/replacement-objects-cannot-hide-secret +=== RUN TestNativePushBoundaries/grafts-cannot-hide-introduced-history +=== RUN TestNativePushBoundaries/ref-name-token +=== RUN TestNativePushBoundaries/partial-config-include-refused +=== RUN TestNativePushBoundaries/object-count-limit-refused +=== RUN TestNativePushBoundaries/external-gitlink-refused +=== RUN TestNativePushBoundaries/partial-repository-refused +=== RUN TestNativePushBoundaries/aggregate-byte-limit-refused +=== RUN TestNativePushBoundaries/oversized-object-refused +--- PASS: TestNativePushBoundaries (112.32s) + --- PASS: TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion (5.41s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret (7.07s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/false (3.53s) + --- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/true (3.54s) + --- PASS: TestNativePushBoundaries/sha256-object-format (7.37s) + --- PASS: TestNativePushBoundaries/secret-in-tip (4.00s) + --- PASS: TestNativePushBoundaries/secret-added-then-deleted (3.75s) + --- PASS: TestNativePushBoundaries/new-branch-and-force-update (8.24s) + --- PASS: TestNativePushBoundaries/merge-second-parent-history (8.75s) + --- PASS: TestNativePushBoundaries/commit-message (2.05s) + --- PASS: TestNativePushBoundaries/annotated-tag-message (2.27s) + --- PASS: TestNativePushBoundaries/tag-direct-to-blob (2.42s) + --- PASS: TestNativePushBoundaries/multi-ref-all-refused (4.55s) + --- PASS: TestNativePushBoundaries/missing-scanner-and-deletion-refused (0.32s) + --- PASS: TestNativePushBoundaries/wrong-executable-refused (0.29s) + --- PASS: TestNativePushBoundaries/inline-and-config-suppression-refused (6.95s) + --- PASS: TestNativePushBoundaries/replacement-objects-cannot-hide-secret (2.25s) + --- PASS: TestNativePushBoundaries/grafts-cannot-hide-introduced-history (14.53s) + --- PASS: TestNativePushBoundaries/ref-name-token (6.01s) + --- PASS: TestNativePushBoundaries/partial-config-include-refused (0.79s) + --- PASS: TestNativePushBoundaries/object-count-limit-refused (6.71s) + --- PASS: TestNativePushBoundaries/external-gitlink-refused (5.30s) + --- PASS: TestNativePushBoundaries/partial-repository-refused (0.49s) + --- PASS: TestNativePushBoundaries/aggregate-byte-limit-refused (11.41s) + --- PASS: TestNativePushBoundaries/oversized-object-refused (0.87s) +=== RUN TestScannerFileAndTimeoutRefusal +=== RUN TestScannerFileAndTimeoutRefusal/nonexecutable +=== RUN TestScannerFileAndTimeoutRefusal/symlink +=== RUN TestScannerFileAndTimeoutRefusal/expired-context +=== RUN TestScannerFileAndTimeoutRefusal/scanner-process-failure +=== RUN TestScannerFileAndTimeoutRefusal/unknown-old-ref +--- PASS: TestScannerFileAndTimeoutRefusal (2.44s) + --- PASS: TestScannerFileAndTimeoutRefusal/nonexecutable (0.19s) + --- PASS: TestScannerFileAndTimeoutRefusal/symlink (0.01s) + --- PASS: TestScannerFileAndTimeoutRefusal/expired-context (0.05s) + --- PASS: TestScannerFileAndTimeoutRefusal/scanner-process-failure (0.84s) + --- PASS: TestScannerFileAndTimeoutRefusal/unknown-old-ref (0.05s) +PASS +ok railiance-forge/receive-secret-scan 114.784s diff --git a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json index 273d56b..8d1df56 100644 --- a/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json +++ b/docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json @@ -841,12 +841,13 @@ "closure_evidence": [], "assessment": { "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", - "observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.", + "observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.", "remaining": "Production repository denominator, other workstation clones, independent automation coverage and historical/runtime findings remain unverified.", - "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", "verification_evidence": [ "secret-detection.json", - "secret-hook-activation.json" + "secret-hook-activation.json", + "receive-secret-detection.json" ], "assessed_at": "2026-10-12" } @@ -865,12 +866,13 @@ "closure_evidence": [], "assessment": { "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", - "observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.", + "observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.", "remaining": "Push/server/CI controls, logs/artifacts/runtime detection and independent boundary coverage remain unverified.", - "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", "verification_evidence": [ "secret-detection.json", - "secret-hook-activation.json" + "secret-hook-activation.json", + "receive-secret-detection.json" ], "assessed_at": "2026-10-12" } @@ -889,12 +891,13 @@ "closure_evidence": [], "assessment": { "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", - "observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.", + "observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.", "remaining": "Independent push prevention has not been demonstrated. A local hook alone remains bypassable; introduced-history and remote acceptance proof are required.", - "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", "verification_evidence": [ "secret-detection.json", - "secret-hook-activation.json" + "secret-hook-activation.json", + "receive-secret-detection.json" ], "assessed_at": "2026-10-12" } diff --git a/docs/netkingdom-security-blueprint.md b/docs/netkingdom-security-blueprint.md index b5412c7..2a46a2f 100644 --- a/docs/netkingdom-security-blueprint.md +++ b/docs/netkingdom-security-blueprint.md @@ -155,7 +155,9 @@ commit rejection with pinned, content-silent staged-blob scanning for 22 exact workstation checkout paths. Actual hooks passed clean, disposable-key rejection and scanner-failure checks; other hooks/routing and unreviewed checkout behavior were preserved. RMGR-WP-0021-T02 records local activation; independent forge/CI -enforcement and response remain open. [Activation receipt](evidence/2026-10-12-netkingdom-security/secret-hook-activation.json). A local hook is bypassable, +enforcement and response remain open. [Activation receipt](evidence/2026-10-12-netkingdom-security/secret-hook-activation.json). FORGE-WP-0006 now supplies the independent introduced-history adapter in source; +its disposable push tests do not establish server activation or complete repository +coverage. A local hook is bypassable, so it cannot substitute for independent introduced-history checks or governed incident response. [Coverage evidence](evidence/2026-10-12-netkingdom-security/secret-detection.json). diff --git a/docs/netkingdom-security-gaps.md b/docs/netkingdom-security-gaps.md index 97badca..4cb2eab 100644 --- a/docs/netkingdom-security-gaps.md +++ b/docs/netkingdom-security-gaps.md @@ -15,7 +15,7 @@ No whole-estate SEC-DSM conformance or maturity level is claimed. | G04 | Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery. | MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03 | Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings | | G05 | Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation | | G06 | Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness. | AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records | Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion | -| G07 | The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. Independent forge/CI prevention and response remain unverified. | RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure | +| G07 | The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. Independent forge/CI prevention and response remain unverified. | RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI via FORGE-WP-0006, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership | Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure | | G08 | Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified. | NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work | Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests | | G09 | Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption. | CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07 | For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred | | G10 | Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields. | CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions | Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance | @@ -111,6 +111,15 @@ directories are a discovery count, not a reviewed production denominator. Actions/branch-protection and actual push refusal are still unverified. [Read-only inventory](evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json). +G07 introduced-history source: FORGE-WP-0006 adds a standalone forge-owned +receive adapter, separate from repository-controlled workflows and the local +index scanner. Thirty-three leaf cases pass with actual disposable pushes; +clean pushes are accepted and intermediate/merge/message/tag secrets rejected. +Resource/tool/traversal failures refuse; aggregate bytes are checked before +payload scanning. No production hook is activated by this source work. +Exact-binary/runtime admission, full inventory and forge frontend/transport +acceptance remain open. [Source and protocol receipt](evidence/2026-10-12-netkingdom-security/receive-secret-detection.json). + ## SEC DSM requirement coverage Each numbered requirement in these families is in scope for assessment. The diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index f2b6e04..507dc76 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -173,6 +173,18 @@ internal policies and actual push rejection remain unverified. Metadata and upstream comparison: `forge-secret-detection-baseline.json`. No server mutation, credential read, repository-content scan or synthetic push was performed. +2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native +forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans +introduced reachable Git objects and updated ref names, preserving quarantine +and refusing incomplete/oversized input. Thirty-three leaf cases pass, including +actual disposable pushes for intermediate/deleted secrets, second-parent merges, +messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and +scanner failures. Existing owner Python test passes; the new owner Make target +passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`. +No production hook changed. Exact-binary admission, repository denominator, +SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain +open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open. + ## Verify native closure against every requirement ```task