From a4fc006333e0f088066ea459d9c62b9c4d214184 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 19 Oct 2026 10:46:39 +0200 Subject: [PATCH] Finish WP80 working development flows with attended Forgejo acceptance and hardening handoff --- .../agents/custodian-codex/supervision.json | 31 +- .../README.md | 5 +- .../activation-r2/README.md | 35 + .../activation-r2/add-source-2026-10-19.json | 6 + .../activation-r2/approval-record.json | 37 + .../attended-window-2026-10-19.json | 12 + .../auth-inventory-before-2026-10-19.json | 1 + .../checker-reproduction-2026-10-19.json | 9 + .../activation-r2/consistency-2026-10-19.json | 130 +++ .../created-source-2026-10-19.json | 8 + .../deployment-verification-2026-10-19.json | 24 + .../deployments-before-2026-10-19.json | 54 + .../first-postcheck-observation.json | 1 + .../activation-r2/founder-decision.json | 18 + .../activation-r2/fresh-deployments.json | 40 + .../activation-r2/fresh-node-capacity.json | 8 + .../fresh-registration-inspection.json | 28 + .../activation-r2/git-read-2026-10-19.json | 14 + .../human-signin-2026-10-19.json | 12 + .../issuer-after-2026-10-19.json | 9 + .../native-verification-2026-10-19.json | 51 + .../original-restart-annotations.json | 14 + .../activation-r2/owner-reviews/key-cape.json | 87 ++ .../owner-reviews/net-kingdom.json | 26 + .../owner-reviews/railiance-apps.json | 47 + .../publish-net-kingdom/consistency.json | 342 ++++++ .../publish-net-kingdom/projection.json | 987 ++++++++++++++++++ .../publication-commit.json | 13 + .../publication-inputs.json | 11 + .../publish-railiance-apps/consistency.json | 382 +++++++ .../publish-railiance-apps/projection.json | 172 +++ .../publication-commit.json | 13 + .../publication-inputs.json | 11 + .../registration-apply-2026-10-19.json | 1 + .../registration-dry-run-2026-10-19.json | 1 + .../registration-final-2026-10-19.json | 1 + .../review-progress-2026-10-19.json | 14 + .../signin-settings-before-2026-10-19.json | 7 + .../source-pin-recheck-2026-10-19.json | 79 ++ ...-pin-recheck-after-rebuild-2026-10-19.json | 79 ++ .../task-readback-2026-10-19.json | 370 +++++++ .../founder-api-check-2026-10-19.json | 29 + .../measurements.json | 30 +- .../wp80-closeout/acceptance-audit.json | 244 +++++ docs/netkingdom-development.md | 31 +- ...gdom-security-blueprint-and-gap-closure.md | 69 +- 46 files changed, 3528 insertions(+), 65 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/add-source-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/approval-record.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/attended-window-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/auth-inventory-before-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/checker-reproduction-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/consistency-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/created-source-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployment-verification-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployments-before-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/first-postcheck-observation.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/founder-decision.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-deployments.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-node-capacity.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-registration-inspection.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/git-read-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/issuer-after-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/original-restart-annotations.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/key-cape.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/net-kingdom.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/railiance-apps.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-inputs.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/consistency.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/projection.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-commit.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-inputs.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-apply-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-dry-run-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-final-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/review-progress-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/signin-settings-before-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-after-rebuild-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/task-readback-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json create mode 100644 docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index 933c718e..ccbe2fc8 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -1097,18 +1097,18 @@ "cost_estimate_eur": 0, "risk_estimate_eur": 300, "risk_estimate": "Founder-reviewed planning estimate: up to three hours recovery at EUR100/hour; temporary build-mode identity-profile exposure is unpriced and requires explicit human acceptance rather than being declared covered by that number. No customer production approval.", - "disposition": "pending", - "outcome": "not_executed", - "approval_ref": null, - "approved_revision": null, - "approved_digest": null, - "executed_revision": null, - "executed_digest": null, + "disposition": "accepted_revised", + "outcome": "succeeded", + "approval_ref": "ad88edeb-7c7c-486f-a695-1a7abae5b20c", + "approved_revision": 2, + "approved_digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "executed_revision": 2, + "executed_digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", "refinement_or_rescue": true, - "verified_outcome": null, + "verified_outcome": "Exact approved r2 activation, source publication, unchanged image/template verification, local sign-in preservation, actual founder linking/NetKingdom sign-in/existing-account continuity and supported workstation Git/API acceptance passed. Human sign-in under one minute. R1/r2 revision history and first premature readiness observation retained; no native effect retried and no rollback. This revised proposal is not an unchanged-original success.", "decision_request_ref": "ad88edeb-7c7c-486f-a695-1a7abae5b20c", - "owner_reviews_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md#exact-activation-scope", - "reason": "Prepared and verified source/local/native dry-run evidence; actual founder go and authorization of independent reviewers remain pending. No promotion or live execution.", + "owner_reviews_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews", + "reason": "Existing resolved founder approval and three independent approved reviews reconciled; original r1 preserved. Attended execution prerequisites remain; no execution or success claimed.", "current_proposed_revision": 2, "current_proposed_digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", "revisions": [ @@ -1121,10 +1121,17 @@ { "revision": 2, "digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", - "disposition": "pending", + "disposition": "accepted_revised", "reason": "The unchanged scanner classified two public source SHA-256 hashes as generic API keys when filenames were used as JSON keys. Represent identical source pins as typed path/sha256 records. No profile, command, target, source hash, verification or rollback changed." } - ] + ], + "approval_record_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/approval-record.json", + "execution_started_at": "2026-10-19T08:38:34.302317+00:00", + "execution_window_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/attended-window-2026-10-19.json", + "native_verification_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json", + "execution_observation_note": "First postcheck ran before Forgejo readiness completed and failed its readiness assertion; retained failure. Re-observation after rollout success passed. No repeated effect, rollback or recovery.", + "execution_finished_at": "2026-10-19T08:44:58.532576+00:00", + "human_verification_ref": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json" } ], "trials": [ diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md index 80ad9842..7624ebbc 100644 --- a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md @@ -4,10 +4,7 @@ Proposal `CUST80-FORGEJO-PUBLIC-BUILD-20261018`, revision 2. SHA-256 of [proposal.json](proposal.json): `fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3`. -**Proposed; no live change has been executed.** The founder's good-case-first -direction permits preparing this option; a separate explicit go and independent -NetKingdom, Apps and KeyCape reviews are required before activation. Previous -scanner approval and the confidential-client case acceptance do not authorize it. +**Approved and activated in the founder-attended window on 19 October.** See [approval and native evidence](activation-r2/README.md). The original proposal below records the reviewed scope; actual human account-linking/sign-in acceptance also passed. No full security conformance is claimed. ## Working flow and the deliberate build-mode choice diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md new file mode 100644 index 00000000..42ceffe4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md @@ -0,0 +1,35 @@ +# Revision 2: founder approval and independent owner reviews + +The founder explicitly replied, **"I approve, tell me what I need to do."** +Decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c` records that human disposition +for `CUST80-FORGEJO-PUBLIC-BUILD-20261018`, revision 2, SHA-256 +`fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3`. +The authorization includes the three independent owner reviewer agents and is +conditional on their approved reviews and fresh unchanged execution preconditions. + +All required owner reviews approved this exact digest: + +| Owner review | Existing work item | Basis | +| --- | --- | --- | +| [NetKingdom](owner-reviews/net-kingdom.json) | NK-WP-0048-T06 | Maintained registration/reconciliation, exact inputs and byte-preserving add/remove | +| [Apps](owner-reviews/railiance-apps.json) | RAPPS-WP-0016-T02 | Helm declarations, unchanged upstream client, local login/account continuity and scanner preservation | +| [KeyCape](owner-reviews/key-cape.json) | KEY-WP-0038-T02 | Issuer/checker compatibility, required MFA/public PKCE profile and exact rollback | + +These are owner judgements written by the three independent agents in their +respective owner scopes. Custodian records them; it does not substitute its own +review for an owner. Each review includes its own evidence and limits. + +`founder-decision.json` retains the actual reply and resolved decision reference. +`approval-record.json` binds that decision to the exact reviewed proposal and +review hashes. The supervision record preserves original r1 and the revised r2 +approval as one trial, with no execution/success claim. + +**Attended native activation passed on 19 October.** Both owner declarations are published, the exact public client and Forgejo source ID 1 are registered, and each deployment completed its one approved restart. Both are Ready; pod templates match the originals except for the restart annotation. [Native verification](native-verification-2026-10-19.json) proves the live option and HTTPS/S256 redirect. The sealed proposal remains unchanged as the approved historical input. + +The founder's [contained API login/check](../../../../netkingdom-development.md#forgejo-git-and-api) +passed identity/repository reads; the founder reported Warden outcome 0 and confirmed attendance. The founder completed linking and NetKingdom sign-in/continuity, reporting success in under one minute. See [human receipt](human-signin-2026-10-19.json). +Approval/reviews alone do not prove actual use; the separate native, human and API receipts now provide that evidence. + +The authorized scope and rollback remain exactly those in the parent proposal. +Repository visibility changes and the full confidential/current-identity +security target remain with their existing owner/hardening workplans. diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/add-source-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/add-source-2026-10-19.json new file mode 100644 index 00000000..281efa70 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/add-source-2026-10-19.json @@ -0,0 +1,6 @@ +{ + "executed_at": "2026-10-19T08:39:29.533986+00:00", + "step": "add_forgejo_source", + "exit_code": 0, + "raw_output_suppressed": true +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/approval-record.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/approval-record.json new file mode 100644 index 00000000..c7abe927 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/approval-record.json @@ -0,0 +1,37 @@ +{ + "recorded_at": "2026-10-19T07:17:32.687424+00:00", + "proposal_id": "CUST80-FORGEJO-PUBLIC-BUILD-20261018", + "approved_revision": 2, + "approved_digest": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "decision_id": "ad88edeb-7c7c-486f-a695-1a7abae5b20c", + "decided_by": "Bernd Worsch", + "decided_at": "2026-10-18T20:47:09.668421Z", + "founder_receipt": { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/founder-decision.json", + "sha256": "342c3f80d0c6620679eab542a3cfe975e253f1b8581f05d0e17dfd7fa7b02d6a" + }, + "owner_reviews": [ + { + "owner": "net-kingdom", + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/net-kingdom.json", + "sha256": "ee6d890d9b2ab48c5606355891df335b4f569eb28abdaa829fb298a73c4ef5f1" + }, + { + "owner": "railiance-apps", + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/railiance-apps.json", + "sha256": "ab3c181f47ca2083cb2e1b5d6b2d4f42d5c90e9210daacfef8a2e453aab4acd7" + }, + { + "owner": "key-cape", + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/key-cape.json", + "sha256": "be20b440a84654e8ca5903f1f790372b98328c1ca6487b3eec8835de21ce9063" + } + ], + "native_actions_executed": false, + "remaining_conditions": [ + "Founder attendance and API login check result", + "Owner source publication", + "Immediate matching native preconditions" + ], + "note": "Reconciles existing approval evidence only; no new authority or successful execution." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/attended-window-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/attended-window-2026-10-19.json new file mode 100644 index 00000000..8d180216 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/attended-window-2026-10-19.json @@ -0,0 +1,12 @@ +{ + "recorded_at": "2026-10-19T08:35:59.403823+00:00", + "founder_quote": "Warden outcome code: 0, i will be present", + "native_actions_executed": false, + "authorization": "Existing r2 founder decision; attendance confirmation adds no new scope", + "knowledge_orientation": { + "version": "0.2.6", + "digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02", + "status": "withheld", + "fallback": "Read current NetKingdom SECURITY-COMPANION.md and owner AGENTS; reviewed exact declared build-profile gaps in approved packet." + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/auth-inventory-before-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/auth-inventory-before-2026-10-19.json new file mode 100644 index 00000000..be1d4cd6 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/auth-inventory-before-2026-10-19.json @@ -0,0 +1 @@ +{"exit_code": 0, "recognized_header": true, "source_count": 0} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/checker-reproduction-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/checker-reproduction-2026-10-19.json new file mode 100644 index 00000000..63a342c2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/checker-reproduction-2026-10-19.json @@ -0,0 +1,9 @@ +{ + "verified": true, + "artifact": "/tmp/custodian-forgejo-public-checker-r1/keycape", + "sha256": "be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", + "source_revision": "3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987", + "byte_identical_to_existing_owner_review": true, + "seconds": 28.69, + "real_runtime_configuration_access": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/consistency-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/consistency-2026-10-19.json new file mode 100644 index 00000000..b27027f7 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/consistency-2026-10-19.json @@ -0,0 +1,130 @@ +{ + "repo_slug": "the-custodian", + "repo_path": "/home/worsch/the-custodian", + "source_revision": null, + "source_revision_reason": "dirty_workplans", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry", + "file_path": "workplans/ADHOC-2026-08-25-retired.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub", + "file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md", + "db_id": "", + "file_value": "STATE-WP-0092", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved", + "file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05", + "db_id": "", + "file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'CUST-WP-0080-T42': file content differs from DB (file wins)", + "file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T42", + "db_id": "bd135b74-05db-5f51-ac89-d1967fdcf36b", + "file_value": "Implementation owners: existing Apps / NetKingdom / Platform paths. Obtain the actual founder go for the exact prepared ", + "db_value": "Implementation owners: existing Apps / NetKingdom / Platform paths. Obtain the actual founder go for the exact prepared ", + "fixable": true + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "370c2481-6806-41eb-a917-f8874f03184f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform", + "file_path": "workplans/THE-WP-0001-federation-interface.md", + "db_id": "", + "file_value": "THE-WP-0001", + "db_value": "CUST-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 90/90", + "C-22 fixed: task bd135b74\u2026 description updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/created-source-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/created-source-2026-10-19.json new file mode 100644 index 00000000..012be5eb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/created-source-2026-10-19.json @@ -0,0 +1,8 @@ +{ + "source_id": 1, + "name": "netkingdom", + "type": "OAuth2", + "enabled": true, + "source_count": 1, + "proved_created_by_this_execution": true +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployment-verification-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployment-verification-2026-10-19.json new file mode 100644 index 00000000..975914da --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployment-verification-2026-10-19.json @@ -0,0 +1,24 @@ +[ + { + "namespace": "sso", + "name": "keycape", + "uid_unchanged": true, + "generation": 66, + "expected_generation": 66, + "ready_replicas": 1, + "observed_generation": 66, + "template_unchanged_except_restart": true, + "restart_annotation": "2026-10-19T08:38:47Z" + }, + { + "namespace": "forgejo", + "name": "forgejo-gitea", + "uid_unchanged": true, + "generation": 16, + "expected_generation": 16, + "ready_replicas": 1, + "observed_generation": 16, + "template_unchanged_except_restart": true, + "restart_annotation": "2026-10-19T08:39:40Z" + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployments-before-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployments-before-2026-10-19.json new file mode 100644 index 00000000..140f6ea2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/deployments-before-2026-10-19.json @@ -0,0 +1,54 @@ +[ + { + "namespace": "sso", + "name": "keycape", + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 65, + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "ready_replicas": 1, + "images": { + "keycape": "forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010" + }, + "pod_template_sha256": "e7d56eb38923824299934f92f5b5768f93bbf6bd4042a06a1fad0d86f05439a7", + "matching": { + "namespace": true, + "name": true, + "uid": true, + "generation": true, + "replicas": true, + "strategy": true, + "ready_replicas": true, + "images": true, + "pod_template_sha256": true + } + }, + { + "namespace": "forgejo", + "name": "forgejo-gitea", + "uid": "e8eff0aa-64bb-4b44-9a80-a66612986355", + "generation": 15, + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "ready_replicas": 1, + "images": { + "gitea": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless" + }, + "pod_template_sha256": "fedc046d4512be337cf0a66427a8393843ba214007f043ee52e7cd9123ad5421", + "matching": { + "namespace": true, + "name": true, + "uid": true, + "generation": true, + "replicas": true, + "strategy": true, + "ready_replicas": true, + "images": true, + "pod_template_sha256": true + } + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/first-postcheck-observation.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/first-postcheck-observation.json new file mode 100644 index 00000000..83688ff0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/first-postcheck-observation.json @@ -0,0 +1 @@ +{"passed": false, "reason": "First postcheck assertion failed while rollout status was still running; no further effect or retry occurred. Readiness succeeded subsequently; renewed observations retained separately.", "raw_runtime_output_emitted": false} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/founder-decision.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/founder-decision.json new file mode 100644 index 00000000..03ce59ff --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/founder-decision.json @@ -0,0 +1,18 @@ +{ + "decision_id": "ad88edeb-7c7c-486f-a695-1a7abae5b20c", + "decision_status": "resolved", + "decided_by": "Bernd Worsch", + "decided_at": "2026-10-18T20:47:09.668421Z", + "human_message": "I approve, tell me what I need to do.", + "proposal_id": "CUST80-FORGEJO-PUBLIC-BUILD-20261018", + "revision": 2, + "proposal_sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "conditional_on": [ + "net-kingdom-owner approved review", + "railiance-apps-owner approved review", + "key-cape-owner approved review", + "Fresh matching sealed native/source preconditions" + ], + "native_actions_executed": false, + "rationale": "Founder Bernd Worsch explicitly replied in this conversation: \"I approve, tell me what I need to do.\" This resolves the presented CUST80-FORGEJO-PUBLIC-BUILD-20261018 revision 2, proposal SHA-256 fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3, conditional on independent NetKingdom, Apps and KeyCape approved owner reviews, and authorizes those three owner reviewer agents. Scope is the exact prepared temporary public/S256-PKCE/required-MFA build profile: publish the two sealed owner declarations; register the one client through the maintained helper; create the one upstream Forgejo authentication source; restart KeyCape and Forgejo once each, with one additional restart each only if rollback is needed; perform the sealed verification and normal publication. ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED, conditional on reviews and fresh unchanged preconditions. Existing local login remains. No repository visibility changes, broader security closure, confidential-case implementation, standing native grant or agent promotion is approved. Record the actual human decision; this transcription does not supply the required owner reviews or claim execution." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-deployments.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-deployments.json new file mode 100644 index 00000000..3088703e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-deployments.json @@ -0,0 +1,40 @@ +[ + { + "namespace": "sso", + "name": "keycape", + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 65, + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "ready_replicas": 1, + "images": { + "keycape": "forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010" + }, + "pod_template_sha256": "e7d56eb38923824299934f92f5b5768f93bbf6bd4042a06a1fad0d86f05439a7", + "template_hash_format": [ + "compact" + ], + "preconditions_match": true + }, + { + "namespace": "forgejo", + "name": "forgejo-gitea", + "uid": "e8eff0aa-64bb-4b44-9a80-a66612986355", + "generation": 15, + "replicas": 1, + "strategy": { + "type": "Recreate" + }, + "ready_replicas": 1, + "images": { + "gitea": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless" + }, + "pod_template_sha256": "fedc046d4512be337cf0a66427a8393843ba214007f043ee52e7cd9123ad5421", + "template_hash_format": [ + "compact" + ], + "preconditions_match": true + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-node-capacity.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-node-capacity.json new file mode 100644 index 00000000..717598ac --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-node-capacity.json @@ -0,0 +1,8 @@ +{ + "node": "239.62.205.92.host.secureserver.net", + "verified_ip": "92.205.62.239", + "allocatable_cpu": "4", + "cpu_allocated_line": "cpu 3605m (90%) 37500m (937%)", + "overlapping_pods_requested": false, + "rollout_strategy": "Both sealed Recreate, one replica each; no resource/image change" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-registration-inspection.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-registration-inspection.json new file mode 100644 index 00000000..b862feb0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/fresh-registration-inspection.json @@ -0,0 +1,28 @@ +{ + "before": { + "resource_version": "75372162", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "change_needed": true, + "changed": false, + "check_config": { + "live": { + "clients": 13, + "errors": [], + "valid": true + }, + "proposed": { + "clients": 14, + "errors": [], + "valid": true + } + }, + "client_id": "forgejo", + "client_type": "public", + "deployment_env_bound": null, + "mode": "inspect", + "operation": "add", + "schema": "netkingdom.keycape-client.v1", + "target": "sso/keycape-config", + "values_emitted": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/git-read-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/git-read-2026-10-19.json new file mode 100644 index 00000000..cef34a7e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/git-read-2026-10-19.json @@ -0,0 +1,14 @@ +{ + "command": "git ls-remote origin refs/heads/main", + "exit_code": 0, + "revision": "556daf928e082aabceb6ed42033c319beb460fa6", + "seconds": 0.814, + "profile": "Existing authenticated workstation SSH path", + "write_receipts": [ + "publish-railiance-apps/publication-commit.json", + "publish-railiance-apps/projection.json", + "publish-net-kingdom/publication-commit.json", + "publish-net-kingdom/projection.json" + ], + "disposable_git_objects_created": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json new file mode 100644 index 00000000..9110a2df --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json @@ -0,0 +1,12 @@ +{ + "recorded_at": "2026-10-19T08:44:58.532576+00:00", + "provenance": "Actual founder response in this conversation to the three-step linking/sign-in/account-continuity prompt", + "response": "Yes it went fine.", + "measurement_response": "under 1 minute", + "existing_account_linked": true, + "netkingdom_signin_succeeded": true, + "same_username_repositories_organisations_confirmed": true, + "duration_seconds_upper_bound": 60, + "duration_is_human_estimate": true, + "credential_values_requested_or_retained": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/issuer-after-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/issuer-after-2026-10-19.json new file mode 100644 index 00000000..ba9d620e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/issuer-after-2026-10-19.json @@ -0,0 +1,9 @@ +{ + "discovery_status": 200, + "issuer": "https://kc.coulomb.social", + "authorization_status": 302, + "redirect_host": "auth.coulomb.social", + "redirect_path": "/api/oidc/authorization", + "unknown_client": false, + "tokens_or_codes_obtained": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json new file mode 100644 index 00000000..96f667ef --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json @@ -0,0 +1,51 @@ +{ + "observed_at": "2026-10-19T08:40:52.793853+00:00", + "deployments": [ + { + "namespace": "sso", + "name": "keycape", + "uid_unchanged": true, + "generation": 66, + "expected_generation": 66, + "ready_replicas": 1, + "observed_generation": 66, + "template_unchanged_except_restart": true, + "restart_annotation": "2026-10-19T08:38:47Z" + }, + { + "namespace": "forgejo", + "name": "forgejo-gitea", + "uid_unchanged": true, + "generation": 16, + "expected_generation": 16, + "ready_replicas": 1, + "observed_generation": 16, + "template_unchanged_except_restart": true, + "restart_annotation": "2026-10-19T08:39:40Z" + } + ], + "web": { + "netkingdom_option_visible": true, + "local_signin_form_preserved": true, + "redirect_http_status": 307, + "issuer_host": "kc.coulomb.social", + "issuer_path": "/authorize", + "client_id": [ + "forgejo" + ], + "callback": [ + "https://forgejo.coulomb.social/user/oauth2/netkingdom/callback" + ], + "scopes": [ + "openid profile email groups" + ], + "pkce_method": [ + "S256" + ], + "pkce_challenge_present": true, + "state_present": true + }, + "native_activation_passed": true, + "actual_human_signin_verified": false, + "rollback_executed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/original-restart-annotations.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/original-restart-annotations.json new file mode 100644 index 00000000..9d2b553c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/original-restart-annotations.json @@ -0,0 +1,14 @@ +[ + { + "namespace": "sso", + "name": "keycape", + "original_restart_annotation": "2026-10-14T22:24:04Z", + "annotations_present": true + }, + { + "namespace": "forgejo", + "name": "forgejo-gitea", + "original_restart_annotation": "2026-07-07T16:35:30+02:00", + "annotations_present": true + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/key-cape.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/key-cape.json new file mode 100644 index 00000000..f22ed7ac --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/key-cape.json @@ -0,0 +1,87 @@ +{ + "reviewer": "key-cape-owner (agent key-cape, codex)", + "decision": "approved", + "comment": "KeyCape INTENT.md Tooling declaration, Purpose/Primary Utility, Strategic Boundaries and Security through constraint support this bounded registration of a profile-constrained authentication client: exact HTTPS callback, authorization_code, mandatory S256 PKCE and mfaRequired=true. KeyCape supplies authentication/identity claims; it does not decide Forgejo authorization. Reviewed CUST80-FORGEJO-PUBLIC-BUILD-20261018 revision 2, proposal SHA256 fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3, under existing KEY-WP-0038-T02 (field rules and registration composition). Approved only the explicit temporary public/no-secret build profile and its sealed activation, verification and created-only rollback. The original confidential-client/custody and complete SecurityCaseType target, per-operation current-identity/group/revocation/isolation acceptance, and actual human/agent trials remain open in their existing plans. No KeyCape blocker found within that scope.", + "work_item": "KEY-WP-0038-T02", + "proposal_id": "CUST80-FORGEJO-PUBLIC-BUILD-20261018", + "proposal_revision": 2, + "proposal_sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "owner_checkout": "/home/worsch/key-cape", + "owner_revision": "e2c5a947829568baf837543a6708fd0c3f6a863b", + "owner_source_tree": "214f3108f6b6752c5d7c4533d4b595f2ab4d37ea", + "reviewed_source_pins": [ + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-registration-adapter.py", + "sha256": "a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047" + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-client.py", + "sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591" + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/portal-client-rollout.py", + "sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f" + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/openbao-client-config.py", + "sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1" + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/register-user-engine-portal.py", + "sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76" + }, + { + "path": "/tmp/custodian-forgejo-public-checker-r1/keycape", + "sha256": "be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5" + }, + { + "path": "/home/worsch/.cache/helm/repository/gitea-12.5.0.tgz", + "sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823" + } + ], + "reviewed_packet_input_sha256": { + "client-public-build.yaml": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b", + "forgejo-values.postimage.yaml": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06", + "net-kingdom-client.postimage.yaml": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1", + "execution-steps.json": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6", + "deployment-preconditions.json": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e" + }, + "reviewed_consumer_publication": { + "base_revision": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f", + "path": "helm/forgejo-values.yaml", + "base_sha256": "64ee8cbac800d9c5743ccdba47eb019064d23afdbc2d92c2568c7eafb107c18f", + "postimage": "forgejo-values.postimage.yaml" + }, + "issuer_compatibility": [ + "authorize.go exactly matches registered callback and allowed scopes; accepts only response_type=code and code_challenge_method=S256, rejecting absent challenge/plain PKCE.", + "domain.DecideAssurance treats explicit mfaRequired=true as AAL2; an AAL1 session cannot satisfy it. Existing usable AAL2 sessions may satisfy MFA without a fresh factor entry; this review does not claim a fresh factor for every sign-in.", + "token.go supports public authorization-code exchange without a client secret, binds client/redirect/scopes/PKCE, and atomically consumes the code; UserInfo returns identity claims scoped to the grant.", + "docs/operations.md identifies sealed deployed image cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010 as source 8c6c071. Independently confirmed its src tree f0010b9cab17dbc3a787628a29657d98b900320f equals checker source 3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987. Current undeployed online-token-status additions are not activated by this proposal." + ], + "maintained_reuse_and_checker": [ + "Exact five-file maintained NetKingdom helper/import closure and reproduced checker bytes match the proposal. Direct keycape-client.py use is the stated temporary path; it does not invoke or prove the protected adapter/kernel lifecycle.", + "Helper check_config launches the checker with env={}, supplies config on stdin, asserts Deployment environment names and policy-store presence, and validates live/proposed registries. check-config dispatches before private-key loading, adapters or listener startup and substitutes placeholder client-secret lookup.", + "Helper add/remove is exact-match and byte-preserving, pins cluster/upstream issuer, CAS-tests registry UID/resourceVersion, verifies whole-data readback, and contains parser/Kubernetes errors. Removal refuses a differing existing client.", + "The direct CLI launches a path after external hash revalidation, rather than the adapter sealed-memfd snapshot. Immutable executable custody and runtime credential isolation remain explicitly deferred; no such guarantee is inferred from the checker digest." + ], + "preparation_evidence_assessment": [ + "Retained inspect/dry-run receipts report changed=false, registry UID 2e94519d-1550-41c7-9701-2efe47fe1fd3/resourceVersion 75372162, valid live 13-client and proposed 14-client registries, and preservation of unrelated data. Helper dry-run adds --dry-run=server to the same CAS patch; it is preparation evidence, not an executed registration.", + "Retained source-protocol fixture uses actual issuer handlers plus Goth v1.80.0 and synthetic authorization/MFA session seed. Wrong PKCE and code replay are refused. It proves source compatibility, not deployed MFA/login/account linking. The fixture go.mod intentionally adds Goth/oauth2 test dependencies; producer source files are not modified by this review.", + "No live or Secret reads were performed for this owner review. All native observations in the packet must be refreshed by the authorized coordinator before effects." + ], + "independent_local_checks": { + "proposal_and_pin_verification": "proposal digest, all seven source pins and all five sealed packet-input hashes matched immediately before writing this review", + "synthetic_helper_and_checker": "passed: baseline/proposed valid; query callback refused; idempotent add; removal restored byte-identical baseline; unrelated synthetic data retained; exact checker artifact digest matched", + "offline_current_source_command": "env -i PATH=/bin:/usr/bin:/bin GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off GOMODCACHE=/home/worsch/go/pkg/mod GOCACHE=/tmp/key-cape-r2-owner-review-gocache CGO_ENABLED=0 go test -mod=readonly -count=1 ./internal/domain ./internal/config ./cmd/keycape ./internal/server/oidc", + "offline_current_source_result": "all four package suites passed; synthetic local fixtures only", + "owner_checkout_preserved": true + }, + "activation_verification_and_rollback": [ + "Refresh every sealed source/input pin, registry absent-state plus exact UID/resourceVersion, and deployment identities/images/generation/pod templates immediately before mutation; drift or ambiguity stops the action.", + "Preserve one-replica Recreate, existing images/resources and unrelated config. One KeyCape restart, then Ready/discovery/authorization-start with the exact client/callback and required MFA before any consumer phase; readiness is not browser-login evidence.", + "One Forgejo restart follows only successful issuer verification. Preserve local sign-in; verify the exact HTTPS callback/scopes/state/S256 redirect and retain the actual source ID and registry before/after revisions.", + "Before human linking, rollback deletes only the proved-created source and exact public registration via the same checker/CAS helper; allow at most one additional restart of each changed deployment. Links, drift, uncertain creation or failed verification require owner reconciliation rather than blind replay/deletion.", + "Real founder linking/sign-in/account continuity and actual coding-agent Git/API use remain T43/T44. This owner review changes no task completion or authority record." + ], + "blocking_findings": [] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/net-kingdom.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/net-kingdom.json new file mode 100644 index 00000000..6fc788d9 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/net-kingdom.json @@ -0,0 +1,26 @@ +{ + "reviewer": "net-kingdom-owner (agent net-kingdom, codex)", + "decision": "approved", + "comment": "Reviewed CUST80-FORGEJO-PUBLIC-BUILD-20261018 revision 2, proposal SHA-256 fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3, under existing NetKingdom owner work item NK-WP-0048-T06. INTENT.md declares NetKingdom Taxonomy and explicitly identifies its retained bootstrap runtime material; Identity is the Control Plane, Bootstrap First, Minimize Threat Exposure by Design and Meta-Orchestration over Re-Implementation support this exact temporary, inspectable profile through the maintained owner capability. The exact HTTPS callback, public authorization-code client, required MFA, restricted scopes and unchanged existing-account permissions are coherent with that bounded build purpose. The source declaration matches the maintained generator and can be reconciled by explicitly supplying that file to keycape-client.py; no automatic directory reconciliation is claimed. The helper preserves unrelated registry bytes, rejects differing existing registrations, uses cluster/issuer pins and UID/resourceVersion CAS, validates proposed startup configuration and reads back. I approve only NetKingdom's source declaration and the specified registration/removal boundary, activation sequencing and created-only rollback. This is an owner review, not founder approval or native readiness evidence. Fresh matching native/source preconditions and the other required owner reviews remain necessary. The accepted confidential case, full SecurityCaseType lifecycle, per-operation current-identity/group/revocation controls and actual human/agent acceptance remain open; NK-WP-0048-T06 is not completed by this temporary profile.", + "work_item_id": "NK-WP-0048-T06", + "owner_checkout": "/home/worsch/net-kingdom", + "owner_revision": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "proposal_id": "CUST80-FORGEJO-PUBLIC-BUILD-20261018", + "proposal_revision": 2, + "proposal_sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "evidence": { + "source_hash_checks": "All seven proposal source pins match current files, including the five NetKingdom helper/adapter files, reproduced checker and chart archive.", + "packet_hash_checks": "All five packet_input_sha256 entries match; proposal digest matches exactly.", + "declaration_precondition": "sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml is absent at the pinned owner revision and current checkout, as required.", + "maintained_capability": "capabilities/playbooks/net-kingdom.keycape-client-registration.yaml declares the implemented helper and ownership boundary; no new registration service or custom reconciliation implementation is needed.", + "bounded_tests": "With PYTHONDONTWRITEBYTECODE=1, the existing test_keycape_client, test_portal_client_rollout and test_openbao_client_config suites passed: 32 tests. They use synthetic/mocked data and performed no native calls.", + "exact_profile_fixture": "Independently loaded both packet client declarations, proved semantic equality to client_from_params(public, mfa_required=true), synthetic add/idempotent reapply, exact original-byte restoration on removal, and refusal of differing MFA registration; zero native calls.", + "native_evidence_reviewed": "Reviewed prepared registry inspection/server-dry-run receipts and sealed deployment preconditions. Did not independently reread live native state or any Secret; executor must freshly verify sealed UID/resourceVersion, absence, deployment identity/template, readiness, local settings and resource headroom immediately before effects.", + "rollback_boundary": "Only a proved-created matching client/source may be removed; exact current registry revision and checker remain required. Drift, uncertainty or possible human links stop automatic undo. Restore only this trial's source declarations; preserve unrelated work.", + "authority_limit": "The helper records a nonempty case-acceptance reference; it does not itself authenticate founder approval. The resolved human decision and scoped founder-attended execution gate therefore remain external requirements. No machine-case lifecycle admission is inferred.", + "situational_knowledge": "Emergent knowledge 0.2.6, package digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02: start and identity guidance withheld due changed sources, used as orientation only; current NetKingdom INTENT, SECURITY-COMPANION, capability/helper and Custodian environment/delegated-review sources were read directly." + }, + "native_actions_executed": false, + "producer_source_modified": false, + "blockers_within_netkingdom_review_scope": [] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/railiance-apps.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/railiance-apps.json new file mode 100644 index 00000000..3c895042 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/owner-reviews/railiance-apps.json @@ -0,0 +1,47 @@ +{ + "reviewer": "railiance-apps-owner (agent railiance-apps, codex)", + "decision": "approved", + "comment": "Reviewed under existing Apps work item RAPPS-WP-0016-T02, against railiance-apps INTENT.md: Release Contracts over Source Internals, Repeatable Operations, Clear Lower-Layer Handoffs, and Evidence Before Confidence. CUST80-FORGEJO-PUBLIC-BUILD-20261018 revision 2, proposal SHA-256 fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3, fits the S5 application-release boundary: the existing upstream Forgejo CLI and chart consume the existing issuer registration contract without an Apps-owned identity backend, credential custody mechanism, or runtime change. Reviewed Apps base 2fdc198b2bb8e6d4ad50768c22cf99328828eb4f, helm/forgejo-values.yaml SHA-256 64ee8cbac800d9c5743ccdba47eb019064d23afdbc2d92c2568c7eafb107c18f, and exact postimage SHA-256 210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06. Approval covers this sealed temporary public/S256-PKCE profile, its specified publication, bounded activation, verification and rollback; the confidential target, ongoing identity/policy/revocation acceptance and actual human/agent trials remain open. This owner judgement does not record founder approval, authorize another revision, or claim deployed sign-in.", + "owner_work_item": "RAPPS-WP-0016-T02", + "owner_work_item_file": "/home/worsch/railiance-apps/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md", + "reviewed_from_checkout": "/home/worsch/railiance-apps", + "proposal_sha256": "fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3", + "findings": [ + "The current Apps HEAD and values bytes match the proposal pins. The only pre-existing Apps worktree/index change observed is .custodian-brief.md; it was preserved. All seven proposal source pins and all five sealed packet-input hashes independently matched their files.", + "The Apps postimage adds only gitea.oauth with the exact source name, discovery URL, client ID, empty secret and four scopes, plus explicit oauth2_client settings. No image, resource, strategy, ingress, runner, scanner template, scanner guard or scanner mount change is present.", + "Independent chart 12.5.0 rendering with synthetic local credentials produced eight resources. Both add-oauth and update-oauth commands carry explicit --secret empty-string and the exact discovery/scopes. The chart selects the existing named OAuth2 source for update on normal reconciliation, or creates it when absent. No GITEA_OAUTH_SECRET reference is introduced. Source and rendered scanner guards are unchanged. Immediate activation uses the existing native CLI and restart, while the source postimage makes a later normal Helm reconciliation reproduce the profile; this activation does not apply the rendered chart.", + "The original Forgejo 11.0.3 archive independently hashes to 1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c, matching the Apps release input lock. Its unmodified CLI accepts an empty client secret and defaults SkipLocalTwoFA to false. modules/setting/oauth2.go defaults automatic registration to false and account linking to login. The provider uses source scopes when global OIDC scopes are absent, and constructs its callback from ROOT_URL plus the exact source name.", + "Upstream routers/web/auth/oauth.go and services/auth/source/oauth2/source_callout.go generate a session-bound S256 challenge and forward its verifier through Goth. The logged-in security-settings account-link path attaches to the existing account. With no admin/restricted group or team mapping configured, the source does not overwrite those existing account permissions or team membership. No local-login disable or local-2FA skip is requested.", + "An independent disposable runtime replay of the pinned official amd64 Forgejo image passed SQLite migration and the exact add-oauth command using synthetic local configuration. With oauth2_client settings omitted to exercise the native defaults, the login page retained the local form and exposed netkingdom. The 307 redirect used kc.coulomb.social, client forgejo, exact HTTPS callback https://forgejo.coulomb.social/user/oauth2/netkingdom/callback, openid profile email groups, S256, and nonempty state/challenge. The local container was stopped successfully.", + "The bounded native sequence respects the Apps release boundary: issuer readiness precedes source creation, and the single Forgejo restart reloads the persisted source without a Helm upgrade. Recreate/one replica, unchanged images/resources, fresh pod-template and source-inventory preconditions, 180-second readiness limits, no continuing after failure, and one extra restart only for rollback are appropriate to the declared attended build-mode trial.", + "Rollback correctly depends on a proved-created source ID and absence of human linking. Uncertain creation, drift or possible links stop automatic source deletion. The source declaration must be reverted with the exact trial rollback so later reconciliation cannot recreate it. Registry rollback belongs to the issuer owner through the same maintained helper. A generic Helm rollback alone would not undo this CLI-created database source; this proposal supplies the needed explicit native removal.", + "This is actual reuse of the unmodified deployed Forgejo CLI/OIDC client, pinned upstream chart, and maintained issuer registration handoff. The pending custom Forgejo security-extension build is not silently substituted into this activation. The public-client profile deliberately defers the confidential-client secret/ESO delivery target documented by T02; this review does not mark T02 or its confidential acceptance complete." + ], + "independent_local_checks": { + "sealed_hashes_match": true, + "apps_base_revision_and_values_match": true, + "chart_version": "12.5.0", + "chart_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "synthetic_helm_render_passed": true, + "scanner_values_and_rendered_guard_preserved": true, + "runtime_image": "code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b", + "runtime_fixture_directory": "/tmp/apps-forgejo-r2-review-0_fhxj8e", + "runtime_database": "disposable local SQLite", + "runtime_migrate_exit_code": 0, + "runtime_add_oauth_exit_code": 0, + "runtime_redirect_http_status": 307, + "runtime_https_callback_scopes_pkce_state_passed": true, + "runtime_local_signin_form_preserved": true, + "runtime_container_stopped": true, + "local_source_list_exit_code": 0, + "local_source_list_header": "ID\t|Name\t\t|Type\t|Enabled", + "local_source_list_row": "1\t|netkingdom\t|OAuth2\t|true", + "source_list_parser_basis": "Upstream cmd/admin_auth.go emits only ID, Name, Type and Enabled; --vertical-bars enables tabwriter.Debug. Empty inventory is a recognized header with no rows. Capture and suppress stderr/preamble and fail closed on an unrecognized table." + }, + "verification_limits": [ + "No native cluster action, credential request/read, source publication, producer edit, sealed-input edit, commit or push was performed by this reviewer.", + "Live deployment, registry CAS and empty-source inventory are sealed execution preconditions to be freshly revalidated by the executing agent; this review is not a fresh live-state attestation.", + "The local replay verifies source creation, startup and authorization redirect, not real human MFA, completed deployed account linking, PostgreSQL production continuity, or coding-agent Git/API use. T43/T44 retain those trials.", + "The supplied successful wire test uses synthetic human/MFA session setup. It supports protocol interoperability only and cannot replace actual human acceptance or full ongoing identity/group/revocation/isolation acceptance." + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/consistency.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/consistency.json new file mode 100644 index 00000000..d0d88b17 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/consistency.json @@ -0,0 +1,342 @@ +{ + "repo_slug": "net-kingdom", + "repo_path": "/home/worsch/net-kingdom", + "source_revision": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-24", + "message": "Repo classification advisory: capability_tag 'security' is not a recommended family tag (allowed, check for synonym)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['NET-WP', 'NK-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0011' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0011-enterprise-federation-saml.md", + "db_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0020' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "USER-WP-0020", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0023-user-engine-portal-platform-integration.md", + "db_id": "", + "file_value": "KEY-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0021' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "USER-WP-0021", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'FLEX-WP-0009' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "FLEX-WP-0009", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'AUDIT-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "AUDIT-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'EMAIL-WP-0004' is not linked to State Hub", + "file_path": "workplans/NK-WP-0024-user-engine-portal-integration-expansion.md", + "db_id": "", + "file_value": "EMAIL-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'USER-WP-0022' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "USER-WP-0022", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0008' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "KEY-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'CSOC-WP-0003' is not linked to State Hub", + "file_path": "workplans/NK-WP-0025-public-self-registration-and-application-jit.md", + "db_id": "", + "file_value": "CSOC-WP-0003", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0027' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0027-reef-placement-reconciliation.md", + "db_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0031' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0031-deterministic-posture-feedback.md", + "db_id": "9d7b04f9-3803-5613-b7a5-8bd606c77f5a", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-37", + "message": "Residual workplan 'nk-wp-0040' has no origin/origin_ref provenance (not invented)", + "file_path": "workplans/NK-WP-0040-execution-attribution-receipt.md", + "db_id": "e2533f3a-aa43-59b3-bff3-8e64b6149487", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-40", + "message": "blocker satisfied, task still wait: 'NK-WP-0048-T15' in workplan 'NK-WP-0048' \u2014 every depends_on target is terminal (NK-WP-0048-T31)", + "file_path": "workplans/NK-WP-0048-security-case-types.md#NK-WP-0048-T15", + "db_id": "", + "file_value": "NK-WP-0048-T31", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAIL-PL-WP-0002' is not linked to State Hub", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'nk-wp-0035@retired-20260908' (id=064c5e8b\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "064c5e8b-7852-4d7f-a5fa-e26e406ab8e0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-14@retired-20260827' (id=a5097121\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a5097121-1461-59f8-81fa-e6ecef527337", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'adhoc-2026-08-23@retired-20260827' (id=e25ba5fa\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "e25ba5fa-eaae-5039-8d93-a69c6d837fc4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-07-02@retired-20260827' (id=67c1c7ac\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "67c1c7ac-d8b1-41dc-a81a-4e43f1afd068", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'net-kingdom-adhoc-2026-06-14@retired-20260827' (id=c6f3d6bf\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "c6f3d6bf-4916-490d-96ce-092d2776d7e7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:dd169cb3, ops-warden:9f6dc67b", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0020' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md", + "db_id": "", + "file_value": "NET-WP-0020", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0015' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0015-platform-root-custody-and-openbao-identity-bootstrap.md", + "db_id": "", + "file_value": "NET-WP-0015", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0016' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260603-NET-WP-0016-guided-security-bootstrap-experience.md", + "db_id": "", + "file_value": "NET-WP-0016", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0018' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260604-NET-WP-0018-bootstrap-automation-and-rebuild-readiness.md", + "db_id": "", + "file_value": "NET-WP-0018", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0017' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0017-it-security-readiness-for-user-onboarding.md", + "db_id": "", + "file_value": "NET-WP-0017", + "db_value": "NK-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'NET-WP-0019' uses prefix 'NET-WP' but repo canonical prefix is 'NK-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md", + "db_id": "", + "file_value": "NET-WP-0019", + "db_value": "NK-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 64/64", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 27, + "info": 5 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/projection.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/projection.json new file mode 100644 index 00000000..dce05005 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/projection.json @@ -0,0 +1,987 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "net-kingdom", + "commit": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "requests": 2, + "elapsed_ms": 14399.2, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "net-kingdom", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "derived_commit": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "net-kingdom", + "commit": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "status": "applied", + "counts": { + "created": 0, + "updated": 64, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 1, + "external_edges": 85 + }, + "created": [], + "updated": [ + "NET-WP-0015", + "NET-WP-0016", + "NET-WP-0017", + "NET-WP-0018", + "NET-WP-0019", + "NET-WP-0020", + "NK-WP-0001", + "NK-WP-0002", + "NK-WP-0003", + "NK-WP-0004", + "NK-WP-0005", + "NK-WP-0006", + "NK-WP-0007", + "NK-WP-0008", + "NK-WP-0009", + "NK-WP-0010", + "NK-WP-0011", + "NK-WP-0012", + "NK-WP-0013", + "NK-WP-0014", + "NK-WP-0015", + "NK-WP-0016", + "NK-WP-0017", + "NK-WP-0018", + "NK-WP-0019", + "NK-WP-0021", + "NK-WP-0022", + "NK-WP-0023", + "NK-WP-0024", + "NK-WP-0025", + "NK-WP-0026", + "NK-WP-0027", + "NK-WP-0028", + "NK-WP-0029", + "NK-WP-0030", + "NK-WP-0031", + "NK-WP-0032", + "NK-WP-0033", + "NK-WP-0034", + "NK-WP-0035", + "NK-WP-0036", + "NK-WP-0037", + "NK-WP-0038", + "NK-WP-0039", + "NK-WP-0040", + "NK-WP-0041", + "NK-WP-0042", + "NK-WP-0043", + "NK-WP-0044", + "NK-WP-0045", + "NK-WP-0046", + "NK-WP-0047", + "NK-WP-0048", + "NK-WP-0049", + "NK-WP-0050", + "NK-WP-0051", + "NK-WP-ADHOC-2026-06-14", + "NK-WP-ADHOC-2026-07-02", + "NK-WP-ADHOC-2026-08-14", + "NK-WP-ADHOC-2026-08-23", + "NK-WP-ADHOC-2026-10-03", + "NK-WP-ADHOC-2026-10-10", + "NK-WP-ADHOC-2026-10-11", + "NK-WP-ADHOC-2026-10-16" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [ + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0001", + "reason": "missing" + } + ], + "external_edges": [ + { + "workplan": "NK-WP-0008", + "from": "NK-WP-0008", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "RPF-WP-0056-T03", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a82762eb-bb6d-5600-89ca-a81ada2eba9f" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T03", + "target": "NK-WP-0050-T02", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e", + "to_workplan_id": null, + "to_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d" + }, + { + "workplan": "NK-WP-0050", + "from": "NK-WP-0050-T02", + "target": "NK-WP-0050-T01", + "relationship_type": "starts_after", + "from_workplan_id": "06ba98d5-609e-5aaa-9bf7-4c4f4460e377", + "from_task_id": "a9dadd07-f136-5dc7-9229-7a9dbb941f0d", + "to_workplan_id": null, + "to_task_id": "64893d94-9717-5812-b8e3-7cabe095fcdc" + }, + { + "workplan": "NK-WP-0017", + "from": "NK-WP-0017", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011", + "target": "NK-WP-0003", + "relationship_type": "blocks", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": null, + "to_workplan_id": "f24cefd4-a09b-4fa1-9b25-94bf783b425e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T03", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T07", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T04", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T06", + "target": "NK-WP-0011-T05", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "9cb7fd93-c16e-5102-83ce-195b3aa87446", + "to_workplan_id": null, + "to_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T05", + "target": "NK-WP-0011-T04", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d", + "to_workplan_id": null, + "to_task_id": "6697a994-7343-5ea8-8b37-bc3b921e5a9b" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T07", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "38998c68-29bf-50d2-8c8d-0c75184d5833" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T09", + "target": "NK-WP-0011-T08", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "d9dc4292-6b66-5797-9ff9-a1a4a556278e", + "to_workplan_id": null, + "to_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T02", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "2fe6f100-3a5d-563e-b033-7d7b846ae487" + }, + { + "workplan": "NK-WP-0011", + "from": "NK-WP-0011-T08", + "target": "NK-WP-0011-T03", + "relationship_type": "starts_after", + "from_workplan_id": "1075448f-d533-5f9e-94b7-c3adfe151a07", + "from_task_id": "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d", + "to_workplan_id": null, + "to_task_id": "32d1411b-10a4-5a8b-8f43-99ac46d83908" + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NET-WP-0016", + "from": "NET-WP-0016", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T33", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T18", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "141dd773-c1fa-56c1-a852-bbe2372e5125", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T35", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T35", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "1bfd1703-589f-5511-bad5-812d860e4a71" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T36", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T33", + "target": "NK-WP-0049-T32", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "56c8d469-7a10-5d50-a30e-95cbf3cd4756", + "to_workplan_id": null, + "to_task_id": "cd78dbb7-a8f2-5754-8788-6eb1b7d97741" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T36", + "target": "NK-WP-0049-T34", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "8b72334b-fc27-5707-a189-bad345eaf3bc", + "to_workplan_id": null, + "to_task_id": "821b3a56-6f36-5812-abc9-5a00e37cb2e7" + }, + { + "workplan": "NK-WP-0049", + "from": "NK-WP-0049-T03", + "target": "NK-WP-0049-T02", + "relationship_type": "starts_after", + "from_workplan_id": "17d315f0-829e-57c7-85cc-3a7914152804", + "from_task_id": "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac", + "to_workplan_id": null, + "to_task_id": "479d6970-6516-50f5-9436-bb5b56d58aad" + }, + { + "workplan": "NK-WP-0025", + "from": "NK-WP-0025", + "target": "NK-WP-0024", + "relationship_type": "blocks", + "from_workplan_id": "2412a251-d6b5-5f05-8082-3eb7697c51dc", + "from_task_id": null, + "to_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0016", + "from": "NK-WP-0016", + "target": "NK-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "from_task_id": null, + "to_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0006", + "from": "NK-WP-0006", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0013", + "from": "NK-WP-0013", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0015", + "from": "NK-WP-0015", + "target": "NK-WP-0014", + "relationship_type": "blocks", + "from_workplan_id": "343e035d-41e1-4fc4-b209-6872e4a5fdc8", + "from_task_id": null, + "to_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "16069174-6698-4855-ad9e-5092c8571f38", + "to_task_id": null + }, + { + "workplan": "NET-WP-0017", + "from": "NET-WP-0017", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0005", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "to_task_id": null + }, + { + "workplan": "NK-WP-0007", + "from": "NK-WP-0007", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "3cbc81ec-7ad5-46cf-a4a0-fc5fe9873695", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NK-WP-0024", + "from": "NK-WP-0024", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "635a73d4-b3cb-5c38-af22-56a6a66beb0e", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NET-WP-0015", + "from": "NET-WP-0015", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "08398d26-cadf-44bc-97ee-67da790040e6", + "to_task_id": null + }, + { + "workplan": "NK-WP-0018", + "from": "NK-WP-0018", + "target": "NK-WP-0016", + "relationship_type": "blocks", + "from_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "from_task_id": null, + "to_workplan_id": "2d592e18-e63d-4856-97a1-f8c3e019e150", + "to_task_id": null + }, + { + "workplan": "NK-WP-0005", + "from": "NK-WP-0005", + "target": "NK-WP-0004", + "relationship_type": "blocks", + "from_workplan_id": "75bc472b-cc0a-48f2-afb6-62b896f7cc19", + "from_task_id": null, + "to_workplan_id": "d9cf7c4b-886b-4cd1-ad7b-99c4e1929c9e", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0019", + "from": "NET-WP-0019", + "target": "NET-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "75d388b6-7ec1-4e1b-8c87-6ff44f953210", + "from_task_id": null, + "to_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0017", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "385de708-fd59-4bab-a4f4-28c1c476b3ea", + "to_task_id": null + }, + { + "workplan": "NET-WP-0018", + "from": "NET-WP-0018", + "target": "NET-WP-0015", + "relationship_type": "blocks", + "from_workplan_id": "800f9f16-bc44-4bbf-a771-58a630a3b698", + "from_task_id": null, + "to_workplan_id": "6b9c25e4-1008-429a-8de6-54361872c0dd", + "to_task_id": null + }, + { + "workplan": "NK-WP-0027", + "from": "NK-WP-0027-T03", + "target": "NK-WP-0027-T02", + "relationship_type": "starts_after", + "from_workplan_id": "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4", + "from_task_id": "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447", + "to_workplan_id": null, + "to_task_id": "5b35b646-a525-55da-852a-6005613d42ea" + }, + { + "workplan": "NK-WP-0012", + "from": "NK-WP-0012", + "target": "NK-WP-0006", + "relationship_type": "blocks", + "from_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "from_task_id": null, + "to_workplan_id": "2eb8a5e0-4e33-4ed3-8996-a2eec3aad862", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0013", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "32a54d8e-8633-42a6-8ec1-104842c581c1", + "to_task_id": null + }, + { + "workplan": "NK-WP-0014", + "from": "NK-WP-0014", + "target": "NK-WP-0012", + "relationship_type": "blocks", + "from_workplan_id": "b9bf56bc-7ef6-43eb-badc-fa0f4896c63c", + "from_task_id": null, + "to_workplan_id": "9b8e4afc-eb71-47d9-8750-799a082b320a", + "to_task_id": null + }, + { + "workplan": "NK-WP-0019", + "from": "NK-WP-0019", + "target": "NK-WP-0018", + "relationship_type": "blocks", + "from_workplan_id": "d2daa8b4-8ecf-4377-b382-492e653735f7", + "from_task_id": null, + "to_workplan_id": "6f75035a-e056-4eab-8fdb-00a18bacdf87", + "to_task_id": null + }, + { + "workplan": "NK-WP-0009", + "from": "NK-WP-0009", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "d4d02dbf-3974-502d-8b87-b776fc63e17e", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + }, + { + "workplan": "NK-WP-0022", + "from": "NK-WP-0022", + "target": "NK-WP-0023", + "relationship_type": "blocks", + "from_workplan_id": "d76ddccc-00c8-548a-b141-2cd660fa38da", + "from_task_id": null, + "to_workplan_id": "fdb3deee-06c3-5d12-91ce-9c50b2ac0618", + "to_task_id": null + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T15", + "target": "NK-WP-0048-T31", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7", + "to_workplan_id": null, + "to_task_id": "ed1ccd87-89a0-5e69-885c-0eaf5ab0bb5a" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T25", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "0de2a7d9-874d-578b-a076-f653fe42e30b" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T29", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "129db41d-4560-5e20-9f3b-c3c91e0a5601" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T24", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "1a3931ee-3b5f-52fc-9295-4073804f4bd2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T28", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6dab281c-ea9a-5a17-a83f-e8e9a4d4484f" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T30", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "6f6073ac-52dd-5b70-8874-6d76d4c072e4" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T26", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "94b3cbf0-c908-5ac6-b0db-67385c3e021c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T16", + "target": "NK-WP-0048-T27", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e", + "to_workplan_id": null, + "to_task_id": "e56365f8-29b5-5c89-a329-8115f9f3b2a7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T07", + "target": "NK-WP-0048-T06", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "c3c9c3ae-4f23-5ba7-9e6f-e63bcf29b9f7", + "to_workplan_id": null, + "to_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T09", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "0ee12dfc-8260-5038-bd39-cc7fb4113be0" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T15", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "1b825705-4848-5edc-832f-b1622cd9bdb7" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T16", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "200bf500-5084-5ae7-be26-3033fe1f296e" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T05", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "3d987d3d-0797-538b-86e4-51185a327ae2" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "MASON-WP-0010-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "56cea6be-c613-586c-80cd-125340b374da" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T12", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "7ce4eee3-cd47-55a9-bfa5-4f1835d4d6fd" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T17", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8c3e4baa-a218-5996-af9e-fe1153a46dac" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T08", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "8e519082-dc8b-5e46-b660-03d03e55dcf6" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T18", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "9c45da71-fb4c-5f20-9065-90f448f37c64" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T13", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "b264c10b-565c-5d29-b788-03cf5fbd2883" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "WARDEN-WP-0044-T03", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T06", + "target": "NK-WP-0048-T14", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "d9b26bcf-a7c6-59a2-92a0-f913d76a203c", + "to_workplan_id": null, + "to_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113" + }, + { + "workplan": "NK-WP-0048", + "from": "NK-WP-0048-T14", + "target": "NK-WP-0048-T20", + "relationship_type": "starts_after", + "from_workplan_id": "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb", + "from_task_id": "fce95440-a25b-5f27-8ef3-a3d182099113", + "to_workplan_id": null, + "to_task_id": "863fcbdb-e246-51ba-87ca-a2f44d01d6f8" + }, + { + "workplan": "NK-WP-0010", + "from": "NK-WP-0010", + "target": "NK-WP-0008", + "relationship_type": "blocks", + "from_workplan_id": "f4faf8b4-ae57-40cf-a881-6fe66ca6ad74", + "from_task_id": null, + "to_workplan_id": "053c6d96-9396-40c9-a2e5-c36531e7810d", + "to_task_id": null + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-commit.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-commit.json new file mode 100644 index 00000000..6cc34c29 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "a7339fa60dc0fcf489811b4a32b785366d91e29c", + "base": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "files": [ + { + "path": "sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml", + "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1" + } + ], + "stdout": "[main a7339fa] Declare approved Forgejo public PKCE development sign-in profile\n 1 file changed, 15 insertions(+)\n create mode 100644 sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 1, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-inputs.json new file mode 100644 index 00000000..7111eec2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-net-kingdom/publication-inputs.json @@ -0,0 +1,11 @@ +{ + "owner": "net-kingdom", + "base_revision": "b3f31d9f26b98a3b92690e0be34a205e49fa3956", + "files": [ + { + "path": "sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml", + "sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1" + } + ], + "message": "Declare approved Forgejo public PKCE development sign-in profile" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/consistency.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/consistency.json new file mode 100644 index 00000000..b4ba8d1c --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/consistency.json @@ -0,0 +1,382 @@ +{ + "repo_slug": "railiance-apps", + "repo_path": "/home/worsch/railiance-apps", + "source_revision": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "source_revision_reason": null, + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo", + "file_path": ".repo-classification.yaml", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor project", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['RAILIANCE-WP', 'RAPPS-WP']", + "file_path": "workplans/", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1: task id 'RAILIANCE-WP-0004-I01' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2: task id 'RAILIANCE-WP-0004-I02' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3: task id 'RAILIANCE-WP-0004-I03' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4: task id 'RAILIANCE-WP-0004-I04' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5: task id 'RAILIANCE-WP-0004-I05' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6: task id 'RAILIANCE-WP-0004-I06' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7: task id 'RAILIANCE-WP-0004-I07' is not accepted by the canon kind registry", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I01' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I02' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I03' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I04' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I05' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I06' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-31", + "message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I07' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Wait task 'RAPPS-WP-0015-T04' in workplan 'RAPPS-WP-0015' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait", + "file_path": "workplans/RAPPS-WP-0015-coulomb-personal-content-release.md#RAPPS-WP-0015-T04", + "db_id": "", + "file_value": "wait", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'KEY-WP-0038' is not linked to State Hub", + "file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md", + "db_id": "", + "file_value": "KEY-WP-0038", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-39", + "message": "Human wait task 'RAPPS-WP-0016-T04' in workplan 'RAPPS-WP-0016' has needs_human: true without decision_id \u2014 unrouted human gate", + "file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md#RAPPS-WP-0016-T04", + "db_id": "", + "file_value": "needs_human: true", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RPF-WP-0058' is not linked to State Hub", + "file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md", + "db_id": "", + "file_value": "RPF-WP-0058", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'REUSE-WP-0025' is not linked to State Hub", + "file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md", + "db_id": "", + "file_value": "REUSE-WP-0025", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0006@retired-20260826' (id=1960b22b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "1960b22b-82ae-4b67-9fff-397bd38bdd65", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0005@retired-20260826' (id=685f1c18\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "685f1c18-33c0-400d-a2b1-e1dae0f27c3e", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0009@retired-20260826' (id=21c3fcdc\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "21c3fcdc-f014-4858-8028-0ac3038212b7", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0011@retired-20260826' (id=98cf42ae\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "98cf42ae-9b64-4736-97e1-bae325ded1f9", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0008@retired-20260826' (id=41b9deea\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "41b9deea-a935-4372-8916-b3981336f597", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0018@retired-20260826' (id=1b9af4e8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "1b9af4e8-7579-5141-837b-c736b85204a0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0007@retired-20260826' (id=7da18dd8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "7da18dd8-76b9-4a70-b9d7-de541afc65c0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Retired DB workstream 'railiance-wp-0010@retired-20260826' (id=a4f301bb\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work", + "file_path": "", + "db_id": "a4f301bb-3f49-450a-8dbd-5cf6a16b8e0f", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-AP-WP-0001' uses prefix 'RAIL-AP-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260605-RAIL-AP-WP-0001-gitea-container-registry.md", + "db_id": "", + "file_value": "RAIL-AP-WP-0001", + "db_value": "RAPPS-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAILIANCE-WP-0002' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-railiance-apps-WP-0002-vergabe-teilnahme-on-railiance01.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0002", + "db_value": "RAPPS-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAILIANCE-WP-0004' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "RAPPS-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 20/20", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 28, + "info": 8 + }, + "result": "warn" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/projection.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/projection.json new file mode 100644 index 00000000..e3549da3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/projection.json @@ -0,0 +1,172 @@ +{ + "ok": true, + "status": "applied", + "repo_slug": "railiance-apps", + "commit": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "requests": 2, + "elapsed_ms": 6854.2, + "git": { + "upstream": "origin/main", + "behind": 0, + "ahead": 0 + }, + "identifiers": { + "schema": "repo-manager.identifier-assignment.v1", + "ok": true, + "executed": true, + "repo": "railiance-apps", + "namespace": "helixforge", + "assignments": [], + "historical_invalid_identifiers": [ + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I01", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I02", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I03", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I04", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I05", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I06", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6" + }, + { + "kind": "task", + "id": "RAILIANCE-WP-0004-I07", + "source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7" + } + ], + "historical_identity_collisions": [], + "files_changed": [] + }, + "receipt": { + "schema": "state-hub.repository-projection-reconcile.v1", + "instance_role": "primary", + "instance_label": "railiance01", + "expected_commit": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "derived_commit": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "outcome": { + "schema": "state-hub.projection-reset.v1", + "repo_slug": "railiance-apps", + "commit": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "status": "applied", + "counts": { + "created": 0, + "updated": 20, + "retired": 0, + "refused": 0, + "released": 0, + "created_tasks": 0, + "updated_tasks": 0, + "cancelled_tasks": 0, + "created_edges": 0, + "removed_edges": 0, + "unresolved_edges": 0, + "external_edges": 5 + }, + "created": [], + "updated": [ + "RAIL-AP-WP-0001", + "RAILIANCE-WP-0002", + "RAILIANCE-WP-0004", + "RAPPS-WP-0001", + "RAPPS-WP-0002", + "RAPPS-WP-0003", + "RAPPS-WP-0004", + "RAPPS-WP-0005", + "RAPPS-WP-0006", + "RAPPS-WP-0007", + "RAPPS-WP-0008", + "RAPPS-WP-0009", + "RAPPS-WP-0010", + "RAPPS-WP-0011", + "RAPPS-WP-0012", + "RAPPS-WP-0013", + "RAPPS-WP-0014", + "RAPPS-WP-0015", + "RAPPS-WP-0016", + "RAPPS-WP-0017" + ], + "retired": [], + "released": [], + "created_tasks": [], + "updated_tasks": [], + "cancelled_tasks": [], + "created_edges": [], + "removed_edges": [], + "unresolved_edges": [], + "external_edges": [ + { + "workplan": "RAPPS-WP-0016", + "from": "RAPPS-WP-0016-T02", + "target": "RAPPS-WP-0016-T01", + "relationship_type": "starts_after", + "from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b", + "from_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd", + "to_workplan_id": null, + "to_task_id": "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7" + }, + { + "workplan": "RAPPS-WP-0016", + "from": "RAPPS-WP-0016-T02", + "target": "KEY-WP-0038-T02", + "relationship_type": "starts_after", + "from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b", + "from_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd", + "to_workplan_id": null, + "to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30" + }, + { + "workplan": "RAPPS-WP-0016", + "from": "RAPPS-WP-0016-T04", + "target": "RAPPS-WP-0016-T03", + "relationship_type": "starts_after", + "from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b", + "from_task_id": "32c54737-c40f-5fde-9b91-163f8dcb0068", + "to_workplan_id": null, + "to_task_id": "81f072aa-c316-511e-a2cd-21dd1b1d0a00" + }, + { + "workplan": "RAPPS-WP-0016", + "from": "RAPPS-WP-0016-T05", + "target": "RAPPS-WP-0016-T02", + "relationship_type": "starts_after", + "from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b", + "from_task_id": "728786c9-f1f9-5983-a6a4-dea21faf67f5", + "to_workplan_id": null, + "to_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd" + }, + { + "workplan": "RAPPS-WP-0016", + "from": "RAPPS-WP-0016-T03", + "target": "RAPPS-WP-0016-T02", + "relationship_type": "starts_after", + "from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b", + "from_task_id": "81f072aa-c316-511e-a2cd-21dd1b1d0a00", + "to_workplan_id": null, + "to_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd" + } + ], + "refused": [], + "notes": [] + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-commit.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-commit.json new file mode 100644 index 00000000..e0d37bdb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-commit.json @@ -0,0 +1,13 @@ +{ + "exit_code": 0, + "commit": "4d6a8dde21e3f800156c0aaa2bfe859c57908486", + "base": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f", + "files": [ + { + "path": "helm/forgejo-values.yaml", + "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06" + } + ], + "stdout": "[main 4d6a8dd] Declare approved Forgejo public PKCE development sign-in profile\n 1 file changed, 11 insertions(+)\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-inputs.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-inputs.json new file mode 100644 index 00000000..5d240ccb --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/publish-railiance-apps/publication-inputs.json @@ -0,0 +1,11 @@ +{ + "owner": "railiance-apps", + "base_revision": "2fdc198b2bb8e6d4ad50768c22cf99328828eb4f", + "files": [ + { + "path": "helm/forgejo-values.yaml", + "sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06" + } + ], + "message": "Declare approved Forgejo public PKCE development sign-in profile" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-apply-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-apply-2026-10-19.json new file mode 100644 index 00000000..5df03d83 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-apply-2026-10-19.json @@ -0,0 +1 @@ +{"after": {"resource_version": "77451827", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "before": {"resource_version": "75372162", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "case_acceptance": "ad88edeb-7c7c-486f-a695-1a7abae5b20c", "change_needed": true, "changed": true, "check_config": {"live": {"clients": 13, "errors": [], "valid": true}, "proposed": {"clients": 14, "errors": [], "valid": true}}, "client_id": "forgejo", "client_type": "public", "deployment_env_bound": null, "mode": "apply", "operation": "add", "other_secret_data_unchanged": true, "restart_required": true, "schema": "netkingdom.keycape-client.v1", "target": "sso/keycape-config", "unrelated_config_bytes_preserved": true, "values_emitted": false} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-dry-run-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-dry-run-2026-10-19.json new file mode 100644 index 00000000..58384823 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-dry-run-2026-10-19.json @@ -0,0 +1 @@ +{"before": {"resource_version": "75372162", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": true, "changed": false, "check_config": {"live": {"clients": 13, "errors": [], "valid": true}, "proposed": {"clients": 14, "errors": [], "valid": true}}, "client_id": "forgejo", "client_type": "public", "deployment_env_bound": null, "mode": "dry-run", "operation": "add", "other_secret_data_unchanged": true, "schema": "netkingdom.keycape-client.v1", "target": "sso/keycape-config", "unrelated_config_bytes_preserved": true, "values_emitted": false} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-final-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-final-2026-10-19.json new file mode 100644 index 00000000..8adea6ca --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/registration-final-2026-10-19.json @@ -0,0 +1 @@ +{"before": {"resource_version": "77451827", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": false, "changed": false, "check_config": {"live": {"clients": 14, "errors": [], "valid": true}, "proposed": {"clients": 14, "errors": [], "valid": true}}, "client_id": "forgejo", "client_type": "public", "deployment_env_bound": null, "mode": "inspect", "operation": "add", "schema": "netkingdom.keycape-client.v1", "target": "sso/keycape-config", "values_emitted": false} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/review-progress-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/review-progress-2026-10-19.json new file mode 100644 index 00000000..30802055 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/review-progress-2026-10-19.json @@ -0,0 +1,14 @@ +{ + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "id": "fc803f8c-0d99-425b-b6a7-3521355c4d09", + "topic_id": null, + "task_id": "bd135b74-05db-5f51-ac89-d1967fdcf36b", + "decision_id": null, + "event_type": "note", + "summary": "CUST-WP-0080 review: verified existing resolved r2 approval and three exact-digest owner reviews; created missing activation-r2/approval-record.json and reconciled supervision without execution/success claim. Rebuilt missing temporary KeyCape checker byte-identically; all 12 source/packet pins pass. Corrected stale T42 approval status in Hub/runbook. Founder confirms API login check has not run; attended activation, real sign-in/API trials, measurements and final audit remain open. No native change performed. Existing security handoff remains CUST-WP-0082.", + "detail": null, + "author": "codex", + "session_id": null, + "created_at": "2026-10-19T07:19:02.400168Z", + "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/signin-settings-before-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/signin-settings-before-2026-10-19.json new file mode 100644 index 00000000..2bc1cd84 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/signin-settings-before-2026-10-19.json @@ -0,0 +1,7 @@ +{ + "safe_settings": { + "ROOT_URL": "https://forgejo.coulomb.social/", + "DISABLE_REGISTRATION": "true" + }, + "matches": true +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-2026-10-19.json new file mode 100644 index 00000000..faa6ecc1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-2026-10-19.json @@ -0,0 +1,79 @@ +{ + "checked_at": "2026-10-19T07:17:32.687424+00:00", + "checks": [ + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-registration-adapter.py", + "expected_sha256": "a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "actual_sha256": "a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-client.py", + "expected_sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "actual_sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/portal-client-rollout.py", + "expected_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "actual_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/openbao-client-config.py", + "expected_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "actual_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/register-user-engine-portal.py", + "expected_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "actual_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "matches": true + }, + { + "path": "/tmp/custodian-forgejo-public-checker-r1/keycape", + "expected_sha256": "be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", + "actual_sha256": null, + "matches": false + }, + { + "path": "/home/worsch/.cache/helm/repository/gitea-12.5.0.tgz", + "expected_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "actual_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml", + "expected_sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b", + "actual_sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml", + "expected_sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06", + "actual_sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml", + "expected_sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1", + "actual_sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json", + "expected_sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6", + "actual_sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json", + "expected_sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e", + "actual_sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e", + "matches": true + } + ], + "all_match": false, + "native_preconditions_checked": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-after-rebuild-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-after-rebuild-2026-10-19.json new file mode 100644 index 00000000..88173f8e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/source-pin-recheck-after-rebuild-2026-10-19.json @@ -0,0 +1,79 @@ +{ + "checked_at": "2026-10-19T07:18:43.248638+00:00", + "checks": [ + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-registration-adapter.py", + "expected_sha256": "a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "actual_sha256": "a53beea4dbbe373ce7a5b84d55e79be8407ab9688037c7ee057afcc7be576047", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/keycape-client.py", + "expected_sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "actual_sha256": "4b63161cf3365d34dd684a3116e2c935baaf7f6aa4b30983f6883546db3d6591", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/portal-client-rollout.py", + "expected_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "actual_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/openbao-client-config.py", + "expected_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "actual_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "matches": true + }, + { + "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/register-user-engine-portal.py", + "expected_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "actual_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "matches": true + }, + { + "path": "/tmp/custodian-forgejo-public-checker-r1/keycape", + "expected_sha256": "be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", + "actual_sha256": "be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5", + "matches": true + }, + { + "path": "/home/worsch/.cache/helm/repository/gitea-12.5.0.tgz", + "expected_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "actual_sha256": "2d6f35f3d1ff0cfcab0f22142d20a1d6405fa974a79d7a18000904d233131823", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/client-public-build.yaml", + "expected_sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b", + "actual_sha256": "942d642a40bf76f11d09336fa6e90f861b5fccffa7ba6143bdcbfa8a1498bb6b", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/forgejo-values.postimage.yaml", + "expected_sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06", + "actual_sha256": "210e6e450ad9fbe7e25ad7ec8ae5d4e9bf9bbc9e7f65d52ac670a66a9dd79d06", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/net-kingdom-client.postimage.yaml", + "expected_sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1", + "actual_sha256": "3210f662cf65d54e912969ad03767053baf5c867402fc5f24b7017fb3b82d8e1", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/execution-steps.json", + "expected_sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6", + "actual_sha256": "98cb80a42e22315a7e846418f5157091c2e246ed3eb86e26dc46a3d5bec69ee6", + "matches": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/deployment-preconditions.json", + "expected_sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e", + "actual_sha256": "940594b48dfc024ed3eb83f86f051ee539b2ad90a18aa088cfa73483618e529e", + "matches": true + } + ], + "all_match": true, + "native_preconditions_checked": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/task-readback-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/task-readback-2026-10-19.json new file mode 100644 index 00000000..eca8b738 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/task-readback-2026-10-19.json @@ -0,0 +1,370 @@ +{ + "observed_at": "2026-10-19T07:19:14.787673+00:00", + "plans": [ + { + "file": "CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "task_count": 45, + "all_bindings_and_statuses_match": true, + "checks": [ + { + "task_id": "CUST-WP-0080-T01", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T02", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T03", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T04", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T05", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T06", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T07", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T08", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T09", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T10", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T11", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T12", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T13", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T14", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T15", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T16", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T17", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T18", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T19", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T20", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T21", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T22", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T23", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T24", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T25", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T26", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T27", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T28", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T29", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T30", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T31", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T32", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T33", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T34", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T35", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T36", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T37", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T38", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T39", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T40", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T41", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T42", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T43", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T44", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0080-T45", + "uuid_matches": true, + "status_matches": true + } + ] + }, + { + "file": "CUST-WP-0082-netkingdom-security-hardening.md", + "task_count": 25, + "all_bindings_and_statuses_match": true, + "checks": [ + { + "task_id": "CUST-WP-0082-T01", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T02", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T03", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T04", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T05", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T06", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T07", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T08", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T09", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T10", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T11", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T12", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T13", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T14", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T15", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T16", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T17", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T18", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T19", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T20", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T21", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T22", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T23", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T24", + "uuid_matches": true, + "status_matches": true + }, + { + "task_id": "CUST-WP-0082-T25", + "uuid_matches": true, + "status_matches": true + } + ] + } + ], + "completion_proven": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json new file mode 100644 index 00000000..38974ffa --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json @@ -0,0 +1,29 @@ +{ + "recorded_at": "2026-10-19T07:44:52.625801+00:00", + "provenance": "Founder pasted the JSON report in this conversation after the prepared interactive API check. This receipt transcribes that report; it is not a fresh agent execution.", + "report": { + "native_changes": false, + "client": "installed Tea 0.9.2", + "profile": "existing routed workstation development credential; no independent agent identity claim", + "original_tea_configuration_used": false, + "credential_values_emitted": false, + "configuration_isolation_verified": true, + "login_exit_code": 0, + "login_seconds": 0.192, + "api_user": "tegwick", + "whoami_exit_code": 0, + "whoami_seconds": 0.154, + "returned_identity_matches": true, + "repository_read_exit_code": 0, + "repository_read_seconds": 0.15, + "expected_repository_returned": true, + "passed": true, + "temporary_configuration_removed": true + }, + "outer_warden_outcome": 0, + "openbao_session_revocation_confirmed": true, + "remaining": "Approved attended activation and actual human Forgejo sign-in trial.", + "founder_attendance_confirmed": true, + "confirmation_quote": "Warden outcome code: 0, i will be present", + "revocation_evidence": "Founder-reported outer outcome 0 plus inspected current ops-warden proxy_attended_login_exec: returns 0 only after successful child, confirmed revocation and private storage cleanup. Source inspection also confirms CLI propagates distinct nonzero failure codes. No independent server audit claim." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json index 5f2c9eb5..efec3cab 100644 --- a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json @@ -23,7 +23,7 @@ "manual_connection_setup_required": true, "local_browser_install_required": false, "baseline_comparison": "No comparable prior end-to-end baseline measured; no percentage improvement claimed.", - "forgejo_measurement": "pending T37", + "forgejo_measurement": "See top-level forgejo_signin and forgejo_api bounded samples", "reuse": "Existing rapp-playwright client and Kubernetes port-forward, zero new clients or deployments." }, "git": { @@ -49,13 +49,25 @@ "documented_client_commands_after_connection": 2, "human_receipt": "Founder actually ran the trial using the already established connection; no cold onboarding time measured", "git": "Existing authenticated workstation path; no new login during the read sample", - "forgejo_sign_in": "Not activated; human interaction count and duration unmeasured", - "forgejo_api": "Owner transport denied before API command; successful duration unmeasured" + "forgejo_sign_in": "Three documented steps completed by founder; total reported under 1 minute. Exact UI clicks/factor prompts uncounted.", + "forgejo_api": "Founder ran prepared contained login/check; API operation timings recorded. MFA interaction count and total interactive duration unmeasured." }, - "remaining": [ - "Actual human NetKingdom sign-in/account continuity", - "Complete agent Git and authenticated API acceptance", - "Actual Forgejo setup/manual-touch and duration samples" - ], - "baseline": "No comparable cold-onboarding or end-to-end baseline; no percent improvement claimed" + "remaining": [], + "baseline": "No comparable cold-onboarding or end-to-end baseline; no percent improvement claimed", + "forgejo_api": { + "evidence": "founder-api-check-2026-10-19.json", + "provenance": "founder-reported probe output", + "login_seconds": 0.192, + "whoami_seconds": 0.154, + "repository_read_seconds": 0.15, + "total_interactive_login_duration_seconds": null, + "session_revocation_confirmed": true + }, + "forgejo_signin": { + "evidence": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json", + "reported_duration_seconds_upper_bound": 60, + "estimate_not_stopwatch": true, + "supported_instruction_steps": 3, + "manual_touches": "Local sign-in, security-settings link selection plus KeyCape/MFA as prompted, sign-out, NetKingdom sign-in and existing-account/repository/organisation check. Exact clicks/factor count not measured." + } } diff --git a/docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json b/docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json new file mode 100644 index 00000000..338a89df --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json @@ -0,0 +1,244 @@ +{ + "audited_at": "2026-10-19T08:45:40.059539+00:00", + "scope": "Founder decision 9663d4ca: WP80 working development flows and explicit full hardening handoff; not security conformance", + "checks": [ + { + "requirement": "Full unchanged security handoff remains live", + "result": "passed", + "ledger_requirements": 116, + "original_task_uuid_bindings": 40, + "hardening_tasks_in_file_and_hub": 25, + "transferred_not_completed": 19, + "ledger_sha256": "ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184" + }, + { + "requirement": "human actual supported Playwright trial", + "result": "passed", + "receipt": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json", + "run_id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51", + "steps": 14, + "download_hashes_verified": 4, + "profile": "supervised build connection" + }, + { + "requirement": "agent actual supported Playwright trial", + "result": "passed", + "receipt": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json", + "run_id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097", + "steps": 14, + "download_hashes_verified": 4, + "profile": "supervised build connection" + }, + { + "requirement": "Native Forgejo sign-in activation preserving local login and unchanged templates", + "result": "passed", + "evidence": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json" + }, + { + "requirement": "Actual human linking/sign-in and existing account continuity", + "result": "passed", + "provenance": "Founder explicit confirmation of supplied complete trial", + "duration_seconds_upper_bound": 60 + }, + { + "requirement": "Supported Git read/write and authenticated API read plus cleanup", + "result": "passed", + "profile": "Existing workstation SSH/Tea with human MFA bootstrap, not independent registered-agent identity", + "git_write_evidence": "Both owner declarations committed/published/projected; no disposable Git objects", + "api_provenance": "Founder actual probe report and outer Warden code 0" + }, + { + "requirement": "Bounded measurements", + "result": "passed", + "evidence": "docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json", + "limitations": "Human sign-in duration estimated; exact click/MFA prompt count and cold baseline unmeasured" + }, + { + "requirement": "Workplan artifact references resolve", + "result": "passed", + "links": [ + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "docs/netkingdom-target-security-architecture.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/workplan-before.txt", + "exists": true + }, + { + "path": "docs/netkingdom-security-blueprint.md", + "exists": true + }, + { + "path": "docs/netkingdom-security-gaps.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1/validation-summary.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1/README.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/README.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/source-wave12-coordinator-review.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/coordinator-source-review.json", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-activation-r1/README.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "docs/netkingdom-development.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "workplans/CUST-WP-0082-netkingdom-security-hardening.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md", + "exists": true + }, + { + "path": "docs/netkingdom-development.md", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json", + "exists": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md", + "exists": true + } + ] + } + ], + "functional_and_handoff_checks_passed": true, + "remaining": [ + "Final source publication and exact WP80 Hub readback" + ], + "goal_complete": false +} diff --git a/docs/netkingdom-development.md b/docs/netkingdom-development.md index abc9cc55..a3de38ea 100644 --- a/docs/netkingdom-development.md +++ b/docs/netkingdom-development.md @@ -1,14 +1,14 @@ # Working development entrypoints -Verified 18 October 2026 for CUST-WP-0080. Use the existing owner implementations +Verified 19 October 2026 for CUST-WP-0080. Use the existing owner implementations below; the table distinguishes working paths from remaining acceptance. | Flow | Verified result | Still required | | --- | --- | --- | | Playwright, human and coding agent | Both real fixture trials passed, with keyboard interaction and desktop/mobile screenshots | Independent per-caller identity is deferred to WP-82 | -| Forgejo Git | Existing workstation SSH read and ordinary source publication work | T44 must accept the complete agent Git/API flow | -| Forgejo authenticated API | Owner-routed check stopped at OpenBao 403 before Tea ran | Supported caller login, then the actual API check | -| Forgejo through NetKingdom | Candidate preparation and local interoperability proofs passed | T42 approval/reviews/activation, then T43 actual human sign-in | +| Forgejo Git | Existing workstation SSH read and ordinary source publication work | Supervised workstation profile; independent agent identity remains WP-82 | +| Forgejo authenticated API | Founder-reported authenticated identity/repository reads passed; Tea configuration removed; outer Warden code 0 | Independent per-operation identity remains WP-82 | +| Forgejo through NetKingdom | Native activation and HTTPS/PKCE redirect passed; local login preserved | Human existing-account linking/sign-in passed; full per-operation hardening remains WP-82 | ## Playwright @@ -76,10 +76,10 @@ existing owner transport after its caller prerequisites are satisfied: warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py ``` -**Current result: not passed.** The owner transport returned OpenBao 403 before +**Initial attempt: failed.** The owner transport returned OpenBao 403 before the probe received a credential or invoked the API. The installed Tea default points at a retired Gitea host; that credential was not used against the current -forge. No authenticated API result has been accepted. +forge. The subsequent founder-run check passed identity and repository reads as `tegwick`; see the [reported result](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json). The founder reported outer Warden code 0; the current implementation returns 0 only after confirmed revocation and cleanup. `warden plan 'oidc login forgejo admin' --json` identifies the existing founder-required KeyCape OIDC/MFA login lane. Its existing role for reading this @@ -89,6 +89,8 @@ owner. The founder can run the following in their own interactive terminal: ```sh wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX) BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > "$1" 2>/dev/null' sh "$wp80_api_receipt_dir/report.json" +wp80_api_login_status=$? +printf 'Warden outcome code: %s\n' "$wp80_api_login_status" python3 -m json.tool "$wp80_api_receipt_dir/report.json" ``` @@ -99,8 +101,7 @@ temporary OpenBao session and removes its helper, while the probe removes its isolated Tea configuration. No API credential or login token is printed or retained in that receipt. -**Prepared, not executed:** this is the supported next attempt after the 403, -not proof that the current role/login works. Retain the outer Warden outcome as +**Founder-run API check passed:** the report confirms API reads and Tea configuration cleanup. Do not repeat the successful check merely to recover its outer outcome. Retain the outer Warden outcome as well as the receipt. A missing/empty report means the API check has not produced evidence. A report with `passed: true` must include successful identity and repository reads; a revocation/cleanup failure remains a separate unresolved @@ -114,10 +115,18 @@ recorded route plans and closed failure markers are in the ## Forgejo NetKingdom sign-in and repository privacy The [prepared rollout](changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md) -is revision 2, pending actual founder disposition and independent owner reviews. +is revision 2. The founder approved it and all three independent owner reviews +approved the exact proposal; see the [recorded approval](changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md). It proposes using the existing KeyCape issuer and upstream Forgejo OIDC/PKCE -support, with local account linking. It has not been activated. The human -sign-in/account-continuity test follows activation. +support, with local account linking. It was activated in the attended window on 19 October. Both services are Ready and the live login option/HTTPS/PKCE redirect passed. The founder subsequently completed the human sign-in/account-continuity test successfully. + +For the actual existing-account trial: + +1. Sign in locally at https://forgejo.coulomb.social/user/login. +2. Open https://forgejo.coulomb.social/user/settings/security and choose **Link account → netkingdom**; complete KeyCape sign-in/MFA. +3. Sign out, choose **netkingdom** on the login page, and verify the same username, repositories, organisations and expected rights. + +Do not create a second account. The founder completed these steps and confirmed existing-account continuity on 19 October, reporting under one minute total. Making repositories private is owned by ORGREF-WP-0002 in `prj-forgejo-org-refactor`. WP-80 establishes working development access first. diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 22ed283a..80543d33 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -4,11 +4,11 @@ type: workplan title: "NetKingdom working development flows and explicit hardening handoff" domain: infotech repo: the-custodian -status: active +status: finished owner: codex topic_slug: custodian created: "2026-10-12" -updated: "2026-10-18" +updated: "2026-10-19" flavor: implementation depends_on: [] state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" @@ -17,16 +17,16 @@ state_hub_workstream_id: "dfadb19b-445e-59c6-bcd6-48e87b912c52" # WP-80 delivery overview -Updated 18 October 2026 under the founder's explicit good-case-first direction, +Completed 19 October 2026 under the founder's explicit good-case-first direction, decision `9663d4ca-3793-4ad7-9dc1-954001d43596`. | Delivery milestone | Status | Observable result / remaining work | | --- | --- | --- | | 1. Playwright for a human and coding agent | **Delivered in the supervised build profile** | Both actual supported-command trials passed on railiance01, each with 14 steps, keyboard interaction and desktop/mobile screenshots. T25/T26. | -| 2. Everyday Forgejo development | **Next; not yet accepted** | Current 11.0.3 release identified; API and Git respond, but NetKingdom sign-in is absent. T41 prepared and tested the candidate; T42 awaits the founder and independent owner reviews before activation; T43/T44 verify human sign-in and agent Git/API use. T23 collects acceptance. | -| 3. Repeatable entry points and close-out | **In progress** | Browser discovery is published and visible in the hosted registry (T45). The short runbook and bounded measurements are available; actual Forgejo sign-in/API acceptance and final audit remain. T33/T37/T38/T04. | +| 2. Everyday Forgejo development | **Delivered in the supervised build profile** | Current 11.0.3 release now exposes NetKingdom sign-in; Git and the founder-run authenticated API check passed. Actual human linking/sign-in and existing-account continuity passed; founder duration estimate under one minute. The founder and all three independent owner reviews approved exact revision 2. T42 records publication/fresh checks/activation; T43/T44 verify human sign-in and agent Git/API use. T23 collects acceptance. | +| 3. Repeatable entry points and close-out | **Delivered** | Browser discovery, supported owner commands, bounded measurements and human Forgejo sign-in/Git/API acceptance passed. Final audit verifies the full hardening handoff and normal source/Hub publication. T33/T37/T38/T04. | | Earlier delivered engineering | **8 checkpoints** | Seven bounded source reviews T07-T13 plus the native scanner/publication repair T20. These retain their original scope. | -| Security hardening | **Deferred, not fixed** | 19 complete checkpoints and 6 remaining acceptance scopes transferred to live CUST-WP-0082. All 16 full architecture gates remain unaccepted. | +| Security hardening | **Deferred, not fixed** | 19 original checkpoints and 6 remaining acceptance scopes transferred to live CUST-WP-0082. All 16 full architecture gates remain unaccepted. | **What works now:** the existing Playwright service, provider client and loopback port-forward delivered actual agent and human trials. See the @@ -35,13 +35,13 @@ This is a supervised development connection; independently authenticated human and registered-agent transport remains hardening work. No new service, gateway, identity evaluator or browser client was built. -**Next:** T19 identified the current upstream Forgejo release and the concrete -missing NetKingdom sign-in option. T41 prepared the smallest existing-owner -connection for that release. The exact public-PKCE build-profile candidate now awaits -its actual scoped go and independent reviews in T42. T42-T44 then cover activation and actual use. -Build or integrate only a demonstrated functional blocker. Broader current -identity, inverse, writer-exclusion and negative matrices are no longer blanket -prerequisites for the good case. Keep at most two delivery checkpoints active. +**Completed:** actual human and coding-agent Playwright trials; exact approved +Forgejo public-PKCE activation; founder existing-account linking and NetKingdom +sign-in/continuity (under one minute, reported estimate); supported workstation +Git read/write and authenticated Tea API read with cleanup. The +[close-out audit](../docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json) +and final publication/readback receipts retain exact scope and provenance. +Broader security conformance remains explicitly unaccepted in WP-82. **Scope and exit:** finish the two working flows, supported owner entry commands, bounded measurements and final source/Hub consistency check, with every remaining @@ -98,7 +98,7 @@ Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered ```task id: CUST-WP-0080-T03 -status: progress +status: done priority: high state_hub_task_id: "87637402-02f1-57c1-8fbc-4141598af8e3" ``` @@ -109,7 +109,7 @@ Coordination umbrella. Complete demonstrated functional blockers for Playwright ```task id: CUST-WP-0080-T04 -status: todo +status: done depends_on: [CUST-WP-0080-T03] priority: high state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" @@ -117,6 +117,8 @@ state_hub_task_id: "82378b0f-7004-5c2f-9683-b356a1227576" Final WP-80 acceptance: actual human and coding-agent Playwright trials; actual positive Forgejo sign-in and everyday Git/API use; usable owner commands, bounded measurements, source/Hub readback and all deferred requirements linked to CUST-WP-0082. The original full sixteen-gate/116-requirement audit is retained in CUST-WP-0082-T25. No security conformance is inferred. +Completed 19 October: the [acceptance audit](../docs/changes/netkingdom-target-2026-10-19/wp80-closeout/acceptance-audit.json) verifies both actual Playwright receipts and screenshot hashes, native Forgejo activation, actual founder existing-account sign-in, Git/API use and cleanup, supported owner runbook, bounded timings, 40 original task UUID bindings and all 116 unchanged requirements mapped to the live 25-task WP-82 handoff. Final publication/readback is retained in the same closeout directory. No security gate is accepted by this functional closure. + ## Coordinate working Playwright access ```task @@ -132,7 +134,7 @@ Coordination umbrella for T25/T26. Reuse the deployed provider, client and docum ```task id: CUST-WP-0080-T06 -status: progress +status: done priority: high state_hub_task_id: "6aca534c-5c7a-556f-b6b6-406433670c29" ``` @@ -351,7 +353,7 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T23 -status: progress +status: done priority: high depends_on: [CUST-WP-0080-T19] state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90" @@ -462,7 +464,7 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T33 -status: progress +status: done priority: high depends_on: [CUST-WP-0080-T12] state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920" @@ -470,7 +472,7 @@ state_hub_task_id: "4547ac4c-8893-54fe-ae6e-362682bb7920" Completion test: verify canonical Playwright and Forgejo owner commands, links, actual profile/availability and expected outputs, then publish a short delivery runbook linking their source-owned clients and existing reuse-surface capability records. Do not copy clients or create another catalog. Broader all-70 capability/version/package-family reconciliation remains CUST-WP-0082-T22. -Delivered the [working development runbook](../docs/netkingdom-development.md). Existing browser discovery now names the verified managed profile (T45); Git read/publication and current API route evidence are retained. Still open: actual Forgejo sign-in/API acceptance and successful final commands after T42-T44. The routed API attempt stopped at OpenBao 403 before Tea ran; no authenticated API success is claimed. +Delivered the [working development runbook](../docs/netkingdom-development.md). Existing browser discovery now names the verified managed profile (T45); Git read/publication and current API route evidence are retained. Completed by T42-T44: native activation/redirect, actual founder linking/sign-in/continuity and authenticated API reads passed. Initial 403 remains historical failure evidence. Canonical commands and stated profile limits are current. ## T34 - Accept the first unassisted security-flow run @@ -509,14 +511,14 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T37 -status: progress +status: done priority: high state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538" ``` Completion test: record supported-command steps, manual touches and observed run time for the human/agent Playwright flow and everyday Forgejo flow. Retain the measured native scanner/publication repair as one bounded sample. Do not invent an unmeasured baseline or generalize to security latency/resource acceptance; that original full profile remains CUST-WP-0082-T23. -Partial [measurements](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json): actual human/agent Playwright server runs 3.801/3.938 seconds, documented connection/preflight/trial counts, SSH Git read 0.629 seconds, retained 278-object scanner sample 58.18 seconds under unchanged 90-second budget. Human Forgejo onboarding and successful authenticated API timing remain unmeasured pending T42-T44. +Partial [measurements](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/measurements.json): actual human/agent Playwright server runs 3.801/3.938 seconds, documented connection/preflight/trial counts, SSH Git read 0.629 seconds, retained 278-object scanner sample 58.18 seconds under unchanged 90-second budget. Successful API operation timings are now recorded from the founder report (0.192/0.154/0.150 seconds); human Forgejo linking/sign-in took under one minute (founder estimate), and outer Warden outcome 0 confirms the current implementation completed revocation/cleanup. Exact MFA prompt/click counts and a comparable cold-onboarding baseline were not measured; no general speedup is claimed. ## T38 - Record the founder sequencing and exact hardening handoff @@ -569,11 +571,10 @@ Implementation owners: Apps RAPPS-WP-0016-T02; KeyCape KEY-WP-0038-T02; existing ```task id: CUST-WP-0080-T42 -status: wait -needs_human: true +status: done +needs_human: false decision_id: ad88edeb-7c7c-486f-a695-1a7abae5b20c -blocking_reason: "Exact Forgejo public-PKCE revision 2 still needs founder disposition and authorization for independent owner reviews; preparation T41 is complete." -intervention_note: "Review CUST80-FORGEJO-PUBLIC-BUILD-20261018 r2; pending decision ad88edeb-7c7c-486f-a695-1a7abae5b20c; authorize exact temporary public-PKCE rollout and independent NetKingdom/Apps/KeyCape reviews." +intervention_note: "Founder approved exact revision 2; NetKingdom, Apps and KeyCape owner reviews approved it. No further approval requested. Native activation and verification passed on 19 October; actual human linking/sign-in remains T43." priority: high depends_on: [CUST-WP-0080-T41] state_hub_task_id: "bd135b74-05db-5f51-ac89-d1967fdcf36b" @@ -581,11 +582,17 @@ state_hub_task_id: "bd135b74-05db-5f51-ac89-d1967fdcf36b" Implementation owners: existing Apps / NetKingdom / Platform paths. Obtain the actual founder go for the exact prepared native change, plus any required owner reviews; existing scanner approval does not cover it. Execute the admitted revision, verify issuer/source readiness and the NetKingdom option, preserve local break-glass, and retain rollback/readback evidence. Exit: the sign-in option reaches the intended issuer successfully. Broader hardening is not a prerequisite unless a concrete functional blocker requires it. +Actual go recorded from the founder's reply, "I approve, tell me what I need to do." Decision ad88edeb-7c7c-486f-a695-1a7abae5b20c is resolved by Bernd Worsch for exact r2 digest fcea2cd32b8ee2634d2ebeb9ef4b659b6b85f8a4878413ed96e5d06cb09892c3. All three required owner reviews approved that digest under their existing work items. [Approval and reviews](../docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/README.md). At approval time, native execution remained pending. The separate API login check was completed before the restarts; the attended execution result is below. + +Earlier 19 October review: the founder confirmed the API check had not yet run. Existing founder/owner approval is reconciled in the linked activation receipt and supervision record; execution was then unperformed. The missing temporary checker was rebuilt from the pinned source and verified byte-identical; all 12 source/packet hashes now match. The subsequent attended activation below supplied native checks and owner publication; this earlier preparation record does not itself claim execution. + +19 October attended activation completed under the exact approved r2: Apps `4d6a8dde` and NetKingdom `a7339fa6` declarations published through normal owner consistency/projection; exact registry add changed revision 75372162 → 77451827 and preserved unrelated bytes; source ID 1 created; one restart each completed Ready. Native login page preserves local sign-in and exposes netkingdom; redirect matches issuer, HTTPS callback, scopes and S256 PKCE. Deployment templates match originals after restoring only the restart annotation; images/resources/scanner configuration unchanged. [Native verification](../docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/native-verification-2026-10-19.json). First early readiness observation failed and is retained; subsequent completed-rollout readback passed. No rollback or repeated native effect. T43 actual founder linking/sign-in remains open. + ## T43 - Verify the human Forgejo sign-in and existing-account continuity ```task id: CUST-WP-0080-T43 -status: todo +status: done priority: high depends_on: [CUST-WP-0080-T42] state_hub_task_id: "f869f913-2349-5223-8c3e-5c76f4cebe60" @@ -593,11 +600,13 @@ state_hub_task_id: "f869f913-2349-5223-8c3e-5c76f4cebe60" Prepare the shortest supported link/sign-in instructions for the founder's existing account. After the actual human run, verify successful NetKingdom sign-in and access to the same repositories/organisations, with a value-free receipt. Do not substitute the local password form, synthetic factors or another actor. Keep the later revocation/negative matrices in WP-82. +Completed 19 October: the founder confirmed the requested existing-account linking, sign-out and NetKingdom sign-in/continuity trial: "Yes it went fine." Total duration reported "under 1 minute" (human estimate). [Human receipt](../docs/changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/activation-r2/human-signin-2026-10-19.json). Same account/repository/organisation continuity accepted from the actual human trial, not synthetic login. + ## T44 - Verify coding-agent Git and authenticated API use ```task id: CUST-WP-0080-T44 -status: todo +status: done priority: high depends_on: [CUST-WP-0080-T42] state_hub_task_id: "8c9c4dda-5047-5d37-9037-4f7e5eac53d8" @@ -605,9 +614,11 @@ state_hub_task_id: "8c9c4dda-5047-5d37-9037-4f7e5eac53d8" Use an existing supported coding-agent access path and its stated build profile. Verify an ordinary Git read/write and authenticated API read, with exact source/result evidence and cleanup for any disposable object. Discover credential ownership through warden route; distribute no administrator kubeconfig or secret through coordination. The public version endpoint alone is insufficient. Publish the canonical owner commands and actual profile limits for T33/T37; independent current KeyCape checks per operation remain WP-82 work. -Baseline: existing SSH read and ordinary source publication work. The installed Tea default targets retired Gitea and was not reused. The current owner-routed API attempt returned OpenBao 403 before the isolated Tea probe received a credential; no API operation ran. The route plan identifies founder-required KeyCape OIDC/MFA caller login. [Evidence and current commands](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). This retained failure does not close T44. +Baseline: existing SSH read and ordinary source publication work. The installed Tea default targets retired Gitea and was not reused. The initial owner-routed API attempt returned OpenBao 403 before the isolated Tea probe received a credential; no API operation ran. The route plan identifies founder-required KeyCape OIDC/MFA caller login. [Evidence and current commands](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). This retained failure does not close T44. -Prepared the [exact founder-run contained login and API check](../docs/netkingdom-development.md#forgejo-git-and-api) using existing Warden role substitution, the existing owner credential route and installed Tea probe. No extra runner or policy grant. Installed Warden implementation matches the inspected owner source; the command's shell syntax is checked. Actual human login, successful API reads and session-revocation/cleanup evidence remain missing; T44 stays open. +Prepared the [exact founder-run contained login and API check](../docs/netkingdom-development.md#forgejo-git-and-api) using existing Warden role substitution, the existing owner credential route and installed Tea probe. No extra runner or policy grant. Installed Warden implementation matches the inspected owner source; the command's shell syntax is checked. That preparation was followed by the successful founder-attended API check recorded below. + +19 October API result: the founder supplied the prepared probe report: `passed: true`, authenticated identity `tegwick`, successful identity and expected repository reads, isolated Tea configuration removed. [Transcribed receipt](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/founder-api-check-2026-10-19.json). Login/identity/repository operations took 0.192/0.154/0.150 seconds. The founder subsequently reported outer Warden outcome 0 and attendance. Current Warden source propagates distinct nonzero failure codes and returns 0 only after session revocation/private-storage cleanup. T44 is complete in the stated supervised workstation profile: fresh agent SSH Git read plus actual normal Apps/NetKingdom source publication and primary projection receipts in activation-r2 provide Git read/write proof; the installed Tea probe supplies authenticated identity/repository reads after human MFA. No disposable Git object was created; the Tea temporary configuration was removed. This is a human-bootstrapped development path, not independent agent identity. Broader identity controls remain WP-82. ## T45 - Publish the verified browser entrypoint in existing discovery