From 873c595bbb9e57685eebf9b88eb093bae1bb226f Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Tue, 13 Oct 2026 18:53:08 +0200
Subject: [PATCH] security: locate legacy submodule objects without weakening
 coverage

---
 .../forge-gitlink-local-copies.json                | 13 +++++++++++++
 .../forge-missing-gitlink-object-search.json       | 14 ++++++++++++++
 ...etkingdom-security-blueprint-and-gap-closure.md | 10 ++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json
 create mode 100644 docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json

diff --git a/docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json b/docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json
new file mode 100644
index 00000000..b31f8b28
--- /dev/null
+++ b/docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json
@@ -0,0 +1,13 @@
+{
+  "scope": "Commit-object existence only; no object content read, upload, restoration or scan.",
+  "checks": [
+    {
+      "submodule": "wiki",
+      "pinned_commit_present_in_workstation_copy": false
+    },
+    {
+      "submodule": "_issue-tracking/issue-facade",
+      "pinned_commit_present_in_workstation_copy": false
+    }
+  ]
+}
diff --git a/docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json b/docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json
new file mode 100644
index 00000000..38a22707
--- /dev/null
+++ b/docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json
@@ -0,0 +1,14 @@
+{
+  "scope": "Read-only commit-object existence search over the 167 directories in the post-expansion inventory; no remote fetch or content read. Does not cover deleted/unmanaged repositories or workstation copies.",
+  "target_pinned_commits": [
+    "70d7ec0cdcbdff1a41cc420e2c939f855fe7787b",
+    "8818df03d3d7be241c144fd839d90c4d7c0ba20a"
+  ],
+  "directories_checked": 167,
+  "matches": [
+    {
+      "repository_id": 13,
+      "target_index": 0
+    }
+  ]
+}
diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
index 492c413e..8257f0aa 100644
--- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
+++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
@@ -341,6 +341,16 @@ This closes the reproduced listener exposure only. Host jobs still share the
 privileged runner boundary; workflow authority, required detection checks and
 job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.
 
+2026-10-13 submodule reconciliation: the four declared URLs use the retired
+forge NodePort. Two pins are reachable under their current canonical repository
+names. The wiki and issue-facade names are absent; a read-only object search
+across all 167 admitted-inventory directories found the issue-facade pin in
+repository ID 13, but no copy of the wiki pin. Neither pin is present in the two
+expected workstation submodule locations. This identifies further mapping and
+recovery work; no repository content was fetched, changed or uploaded, and no
+scanner exception was introduced. Receipts: `forge-gitlink-reconciliation.json`,
+`forge-missing-gitlink-object-search.json`, `forge-gitlink-local-copies.json`.
+
 ## Verify native closure against every requirement
 
 ```task