coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Prove artifact-digest provenance for remaining scanner findings
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 11s
Details

Browse source
This commit is contained in:
codex 2026-11-02 12:22:04 +01:00
parent df7aa88bca
commit 8a386e69b2
2 changed files with 2305 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2303
docs/changes/2026-11-01-scanner-json-digest/remaining-artifact-digest-provenance.json Normal file
View file

File diff suppressed because it is too large Load diff

2
docs/repository-sync-2026-11-01.md
View file

@ -141,3 +141,5 @@ All 45 SHA1-length matches were checked against local Git object databases witho
The latest remote check observed two new synchronization gaps: Freedom Intelligence was one remote commit behind, and ops-mason had one unpublished custody-description commit. The clean Freedom Intelligence checkout was fast-forwarded to `8134864cb8bb186b87f490042a37ce8b30d1f4ca`. Ops-mason's full changed manifest passed the pinned scanner, and its existing metadata-only commit `4fcd8cd7fdb920069673c27e381b9b24af6449fa` passed the normal receiver and is verified equal to remote main. The ignored external OnCo checkout is behind its upstream main but has zero commits absent from remote refs; its files and checkout revision were preserved. This does not claim its checkout matches the separately declared reviewed baseline pin.
Coulomb Social main is now published at `e2b9355f11ef313a69dce500e9a70b45c9af772c` by another session. That session preserved the original four unpublished commits at local branch `archive/csoc-t02-before-public-uid-correction-20261102` (tip `871e0b11f71019c373750749d71a0643dcdb848e`). The current all-branch containment audit therefore retains four held historical branches, plus RApp flex-auth-secrets-engine main. It must not treat the corrected Social main as publication of that archive. Evidence: `/tmp/fleet-unpublished-branches-current-20261102.json`; the other held branches remain the User Engine pre-envstrip backup, Social's older progress branch and Apps' custody preparation branch.
Content verification of the 253 SHA256-length matches found 137 matching current-file digests, covering 34 distinct values. This includes all regular tracked/unignored Custodian files and manifest-named tracked files in the inventoried owner repositories. Evidence records the matching file paths without copying the matched values in `remaining-artifact-digest-provenance.json`. The other116 matches (52 distinct values) lack a matching current file in that search scope; historical source versions, generated artifacts and credentials are not distinguished by that absence. Neither a positive content match nor a Git identity admits other findings in the containing blob.