coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

security: record introduced-history scanner proof and native admission gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 6s
Details

Browse source
This commit is contained in:
codex 2026-10-12 18:53:18 +02:00
parent e5ebbdba5b
commit 78081dabf2
7 changed files with 259 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
View file

@ -173,6 +173,18 @@ internal policies and actual push rejection remain unverified. Metadata and
upstream comparison: `forge-secret-detection-baseline.json`. No server mutation,
credential read, repository-content scan or synthetic push was performed.
2026-10-12 G07 independent boundary source: FORGE-WP-0006 now owns the native
forge implementation under RMGR-WP-0021-T03. A standalone Linux adapter scans
introduced reachable Git objects and updated ref names, preserving quarantine
and refusing incomplete/oversized input. Thirty-three leaf cases pass, including
actual disposable pushes for intermediate/deleted secrets, second-parent merges,
messages/tags, initial/SHA-256 repositories, replacement/graft bypasses and
scanner failures. Existing owner Python test passes; the new owner Make target
passes with admitted Gitleaks and Go 1.26.9. Receipt: `receive-secret-detection.json`.
No production hook changed. Exact-binary admission, repository denominator,
SSH/HTTP/frontend/restart/new-repository coverage and response acceptance remain
open in FORGE-WP-0006-T02/T03 and RMGR-WP-0021-T03/T04. G07 stays open.
## Verify native closure against every requirement
```task