diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempt1-result.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempt1-result.json new file mode 100644 index 0000000..dd1a22f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempt1-result.json @@ -0,0 +1,7 @@ +{ + "returncode": 1, + "failure": "Composed marked DB context returns xorm.Session; CLI asserted xorm.Engine and rejected valid LOG_SQL=false operation before mutation.", + "real_credentials": false, + "source_binary_build": "consumer-build-attempt1.json", + "details": "Original CLI script and isolated workspace retained; no production database or credentials used." +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json new file mode 100644 index 0000000..d5ee38e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json @@ -0,0 +1,155 @@ +{ + "returncode": 1, + "seconds": 23.13, + "argv": [ + "bwrap", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--unshare-net", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/cache/download", + "/cached", + "--ro-bind", + "/etc/ssl/certs", + "/etc/ssl/certs", + "--ro-bind", + "/etc/resolv.conf", + "/etc/resolv.conf", + "--chdir", + "/work/source", + "--clearenv", + "--dir", + "/run", + "--ro-bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/forgejo-oidc", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/writable-input", + "--setenv", + "PATH", + "/work/go/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOPATH", + "/work/gopath", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOVCS", + "*:off", + "--setenv", + "GOMODCACHE", + "/work/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "1", + "--setenv", + "GIT_CONFIG_NOSYSTEM", + "1", + "--setenv", + "GIT_CONFIG_GLOBAL", + "/work/home/test.gitconfig", + "--setenv", + "GIT_TERMINAL_PROMPT", + "0", + "--", + "go", + "test", + "-p", + "1", + "-json", + "-tags", + "sqlite sqlite_unlock_notify", + "./services/auth/source/oauth2", + "./cmd", + "./models/auth", + "./models/db", + "-run", + "TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQLHooks", + "-count=1" + ], + "workspace": "/tmp/custodian-forgejo-successor-attempt2", + "module_hashes": { + "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a", + "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf" + }, + "composed_source_pins": { + "cmd/admin_auth_oauth.go": "sha256:c01084dd631937e3cd1d08593e7090d44661c6cba2838e217bdadbbc5f3c29d9", + "cmd/admin_auth_oauth_secret_linux.go": "sha256:6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b", + "cmd/admin_auth_oauth_secret_linux_test.go": "sha256:b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2", + "cmd/admin_auth_oauth_secret_other.go": "sha256:54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d", + "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a", + "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf", + "models/auth/source_operation.go": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31", + "models/auth/source_operation_internal_test.go": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb", + "models/auth/source_operation_process_test.go": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd", + "models/auth/source_operation_test.go": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428", + "models/db/context.go": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7", + "models/db/engine.go": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96", + "models/db/sensitive_sql.go": "8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e", + "models/db/sensitive_sql_test.go": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b", + "routers/web/admin/auths.go": "sha256:3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923", + "routers/web/auth/oauth.go": "sha256:58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17", + "services/auth/source/oauth2/access_engine.go": "sha256:8c34f864419f42ef6f2f7cba55afc8f5cd82af350e2186ed49fc8c7f18da886e", + "services/auth/source/oauth2/access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce", + "services/auth/source/oauth2/access_engine_callback_test.go": "e2fcbfcc2f1077996c947c5c6fd5150aaaa11ba0e77e05f07055a355978398be", + "services/auth/source/oauth2/access_engine_test.go": "sha256:0552719648e821243c5c6f887359a724c1440cd077e435f15a444bd3c99da888", + "services/auth/source/oauth2/providers_openid.go": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf", + "services/auth/source/oauth2/required_claim_values.go": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda", + "services/auth/source/oauth2/required_claim_values_test.go": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0", + "services/auth/source/oauth2/source.go": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642", + "services/auth/source/oauth2/source_callout.go": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c", + "services/forms/auth_form.go": "sha256:026720f23cbdb5e54f8c594109c2dc306b87e323cc649df5fa3194f609cd7737", + "third_party/access-engine-pep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6", + "third_party/access-engine-pep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3", + "third_party/access-engine-pep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "third_party/access-engine-pep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "third_party/access-engine-pep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3", + "third_party/access-engine-pep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f", + "third_party/access-engine-pep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "third_party/access-engine-pep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee", + "third_party/access-engine-pep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa", + "third_party/access-engine-pep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + "network": "disabled", + "pid_namespace": "private", + "real_credentials": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json new file mode 100644 index 0000000..48350f5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json @@ -0,0 +1,156 @@ +{ + "returncode": 0, + "seconds": 29.72, + "argv": [ + "bwrap", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--unshare-net", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/cache/download", + "/cached", + "--ro-bind", + "/etc/ssl/certs", + "/etc/ssl/certs", + "--ro-bind", + "/etc/resolv.conf", + "/etc/resolv.conf", + "--chdir", + "/work/source", + "--clearenv", + "--dir", + "/run", + "--ro-bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/forgejo-oidc", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/writable-input", + "--setenv", + "PATH", + "/work/go/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOPATH", + "/work/gopath", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOVCS", + "*:off", + "--setenv", + "GOMODCACHE", + "/work/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "1", + "--setenv", + "GIT_CONFIG_NOSYSTEM", + "1", + "--setenv", + "GIT_CONFIG_GLOBAL", + "/work/home/test.gitconfig", + "--setenv", + "GIT_TERMINAL_PROMPT", + "0", + "--", + "go", + "test", + "-p", + "1", + "-json", + "-tags", + "sqlite sqlite_unlock_notify", + "./services/auth/source/oauth2", + "./cmd", + "./models/auth", + "./models/db", + "-run", + "TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQL", + "-count=1" + ], + "workspace": "/tmp/custodian-forgejo-successor-attempt2", + "module_hashes": { + "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a", + "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf" + }, + "composed_source_pins": { + "cmd/admin_auth_oauth.go": "sha256:d718d817c46f6393488a9c5a894b7535640cd0ec1a1ae3f72f8411a2bbec3b38", + "cmd/admin_auth_oauth_secret_linux.go": "sha256:6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b", + "cmd/admin_auth_oauth_secret_linux_test.go": "sha256:b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2", + "cmd/admin_auth_oauth_secret_other.go": "sha256:54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d", + "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a", + "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf", + "models/auth/source_operation.go": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31", + "models/auth/source_operation_internal_test.go": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb", + "models/auth/source_operation_process_test.go": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd", + "models/auth/source_operation_test.go": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428", + "models/db/context.go": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7", + "models/db/engine.go": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96", + "models/db/sensitive_sql.go": "06a298d0d6e628e6920384d4ddeef449e40c090841ebaa3f6d175725a45ae584", + "models/db/sensitive_sql_logging_test.go": "d924b35d30686473caf29601cf51cc363ba68158cb4ef0981c9e2fc7b03c04b7", + "models/db/sensitive_sql_test.go": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b", + "routers/web/admin/auths.go": "sha256:3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923", + "routers/web/auth/oauth.go": "sha256:58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17", + "services/auth/source/oauth2/access_engine.go": "sha256:851dc8712c883ec2f3135406cdce58d7adf733c0f79501e2594e41646faf28a2", + "services/auth/source/oauth2/access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce", + "services/auth/source/oauth2/access_engine_callback_test.go": "e2fcbfcc2f1077996c947c5c6fd5150aaaa11ba0e77e05f07055a355978398be", + "services/auth/source/oauth2/access_engine_test.go": "sha256:0552719648e821243c5c6f887359a724c1440cd077e435f15a444bd3c99da888", + "services/auth/source/oauth2/providers_openid.go": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf", + "services/auth/source/oauth2/required_claim_values.go": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda", + "services/auth/source/oauth2/required_claim_values_test.go": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0", + "services/auth/source/oauth2/source.go": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642", + "services/auth/source/oauth2/source_callout.go": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c", + "services/forms/auth_form.go": "sha256:026720f23cbdb5e54f8c594109c2dc306b87e323cc649df5fa3194f609cd7737", + "third_party/access-engine-pep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6", + "third_party/access-engine-pep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3", + "third_party/access-engine-pep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "third_party/access-engine-pep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "third_party/access-engine-pep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3", + "third_party/access-engine-pep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f", + "third_party/access-engine-pep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "third_party/access-engine-pep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee", + "third_party/access-engine-pep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa", + "third_party/access-engine-pep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + "network": "disabled", + "pid_namespace": "private", + "real_credentials": false +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.json new file mode 100644 index 0000000..2b15f74 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.json @@ -0,0 +1,76 @@ +{ + "returncode": 0, + "seconds": 1.02, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-all-i56scyc5", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./pkg/decisionpep", + "-count=1" + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-layer-check.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-layer-check.json new file mode 100644 index 0000000..b3072d2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-layer-check.json @@ -0,0 +1,80 @@ +{ + "returncode": 0, + "seconds": 14.63, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-race-oa_wz3sd", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--ro-bind", + "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine", + "/home/worsch/secrets-engine", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "1", + "--setenv", + "PYTHONPATH", + "/work/public-fixtures/python", + "--", + "go", + "run", + "./tools/check_layer_conformance.go" + ], + "stdout": "Validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nScope: this repository only \u2014 source/INTENT.md frontmatter (the \u00a711 declaration), optional derived layer.yaml/layer.yml declarations, the files INTENT names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\nPASS \u2014 Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.\n", + "stderr": "" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json new file mode 100644 index 0000000..b7cceb3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json @@ -0,0 +1,176 @@ +{ + "target": "producer-race", + "source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3", + "returncode": 0, + "seconds": 130.97, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-race-oa_wz3sd", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--ro-bind", + "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine", + "/home/worsch/secrets-engine", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "1", + "--setenv", + "PYTHONPATH", + "/work/public-fixtures/python", + "--", + "go", + "test", + "-race", + "-p", + "4", + "-json", + "./...", + "-count=1" + ], + "workspace": "/tmp/custodian-resume-producer-race-oa_wz3sd", + "network": "disabled", + "pid_namespace": "private", + "real_credentials": false, + "canonical_owner_modified": false, + "candidate_files": { + "adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6", + "adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3", + "adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3", + "adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f", + "adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "adapters/go/decisionpep/pkg/decisionpep/client_test.go": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62", + "adapters/go/decisionpep/producer-source.json": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb", + "adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29", + "cmd/access-engine/forgejo_application_profile_test.go": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe", + "cmd/access-engine/main.go": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d", + "examples/forgejo-application-access/policy.md": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac", + "examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e", + "examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e", + "internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d", + "internal/decision/json_profile.go": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f", + "pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "pkg/decisionpep/client_test.go": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62", + "pkg/decisionpep/export_test.go": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843", + "testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29", + "tools/export_decisionpep_adapter.py": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1" + }, + "public_fixture_pins": { + "python/yaml/__init__.py": "b19dfcc333d6a75dfd73073901164507252f271b41d3b5f7d85510033a0547a7", + "python/yaml/_yaml.cpython-312-x86_64-linux-gnu.so": "957a099a4521c1f7669306fb6f79ca63fa4b9a0b4c463f7cac833a65a5c5c0cb", + "python/yaml/composer.py": "fcaa37d16afa783594794a5ab94193dcb720f503c19ce3d59539c8311189f453", + "python/yaml/constructor.py": "90d8247da78b524c10618fd0e857f54f3d97570fe91b5c5513d024ef3faf88b0", + "python/yaml/cyaml.py": "e99ac01bd7c062f7557b614aff0d21997a06ed962ca185306a91bc0a20bbd87d", + "python/yaml/dumper.py": "3cb72d66563064ba7b5e679477046ebf89d8399d940670c8532f3e94a7cb17ea", + "python/yaml/emitter.py": "8e086d694ede170837d5b1b407b45979aff6f40762f422a65eafd08e04290a44", + "python/yaml/error.py": "021f73fada072546c4f63f8cf18a7181244ce4280b09cc15cc980b2d1176171a", + "python/yaml/events.py": "e74fd392c810884e2ea7e94aa3f57e9c1cbeb402319083d0c58e6a0e1282787c", + "python/yaml/loader.py": "5156becc8aa6905482218abf3e04869b835226db4763645fff3438fdbd5f1cdd", + "python/yaml/nodes.py": "80f28d8fca4a09d87677882bde021820d9cf39a3b11a12405226211919cf13ce", + "python/yaml/parser.py": "8a55a9e6fbe0a07146cef3990c8b45a068c3e83e369e1959ad9ca30306b4a09a", + "python/yaml/reader.py": "d1d9b38ab3a20c6e17a38d519ee412ecaf6b918df18c78956ac7c330d4ea08dc", + "python/yaml/representer.py": "22e58ff9c016f6c1ca1274b4802a926bcf78935060e1c813c5a0f021c6d143e6", + "python/yaml/resolver.py": "f4bf9561f9b89961f1503d558385fbae30d12bfed565de9bf76c33abb63620a6", + "python/yaml/scanner.py": "60433788b652690c17710460da5d91e0c753d3318fd85f5e1e42862a71f25906", + "python/yaml/serializer.py": "0a1b85826854d35863e31808f0668abfabdf33606e8f06bd8bb7761401e3edc0", + "python/yaml/tokens.py": "sha256:953408cd2570f0c83dc2fe39f7e4e388e41eeb05738aa69196a5f6ffcf6ba79e", + "secrets-engine/src/secrets_engine/__init__.py": "6536fc21988755467f71a91e79c90bf984f1ee16e696566a03cc4c1240920573", + "secrets-engine/src/secrets_engine/__main__.py": "1684b0f3f895e6450e1718ad07b0c4f461fd3608f55317887e901e85e64dea9e", + "secrets-engine/src/secrets_engine/application_time.py": "39b014bb3a42dcef82b0a5d6ed1dec27725a4a51c79d443c02996a0aebb0ff4d", + "secrets-engine/src/secrets_engine/apply.py": "df3567c914f16b450bc8654fbc76272d9c87453d56238e6a5b89c2b1360bdeba", + "secrets-engine/src/secrets_engine/approval_auth.py": "sha256:6f3b033e7928e1c527bc19f5a1e01bf243540769a8646bd8cd47268da25637b5", + "secrets-engine/src/secrets_engine/approval_claim.py": "15d20b15917ecc9d996de6d587ca2ba87e760920eb51ad64384e12f76e7e6693", + "secrets-engine/src/secrets_engine/approval_consume.py": "4e3de16ed77bca3023993065556edd635d35073668f1a3b0d079284969111d37", + "secrets-engine/src/secrets_engine/audit.py": "0a5560f462a9cd0f4fc2293ce1092915ea037d8f1102b2caf3f52011780adccd", + "secrets-engine/src/secrets_engine/authorization.py": "d58e5fd01ca2470a5d11a6b4f7e9d262a0c1565637e07b35466faa30e4991d14", + "secrets-engine/src/secrets_engine/catalog.py": "9af3a10cca7f45a201ef0567fb885d086390bc6fd2091e982ef0cd6191619514", + "secrets-engine/src/secrets_engine/cli.py": "b7f74330732fd991f080adb6d1c4ef576c81884809103812612652cafe3ee4d0", + "secrets-engine/src/secrets_engine/config.py": "228f548822620d538ad0c025eb68d88091be542819ed571be06c9e69c5e912c6", + "secrets-engine/src/secrets_engine/decision_check.py": "36d1b628963705192ab0a35e8f1e38627a9496d97826ccd8fd98c645c69e8db0", + "secrets-engine/src/secrets_engine/decision_signature.py": "74a9caa43f93aae5c9e945c0a872c0e58c83aea00e9b970a4dbda673af2df805", + "secrets-engine/src/secrets_engine/decisions.py": "7121ac833d6a9bcfd4f82de44e6c7e35fd509f3d854c0b02740a2a13f1b709fb", + "secrets-engine/src/secrets_engine/engine_auth.py": "sha256:e0479cf6d8c13233cf99dc39491143478c021597941ae8b6ba0e37957a42f330", + "secrets-engine/src/secrets_engine/errors.py": "4cd0bfdc009556b35d4359a37d797a6bacf644ca4969d46e33f60435b4bafac8", + "secrets-engine/src/secrets_engine/evidence.py": "555c7cf9915514364c69a920716846beb417b68efdc046d369192f3fa0fae59c", + "secrets-engine/src/secrets_engine/evidence_class.py": "548cec24196e819ba2551c60d4f2455de6845edefd9a61b5d7d1a8f6ecb2c379", + "secrets-engine/src/secrets_engine/exec_delivery.py": "3947c217ebba37f817501492eaee37777301d46177f74152d10a66ef65ac0b56", + "secrets-engine/src/secrets_engine/exec_owner.py": "245f3c1715fed487e941aeea66e2ba6966c10696363fda0f5d50493d2741ac12", + "secrets-engine/src/secrets_engine/execution_contract.py": "ca62bfb1716c0e882eac6512320b127405511affdc1ebd46f9496ce030c0ed01", + "secrets-engine/src/secrets_engine/handoff.py": "279cec94c14f8ea1b107cc7fd552836ff3263c3ed0054862a5fd2fa3696de023", + "secrets-engine/src/secrets_engine/lane_state.py": "28f1cc8f1830057bd4094aec645769a43d22379ea28e14a01f767078466237cb", + "secrets-engine/src/secrets_engine/lifecycle.py": "c17644356524cd83e96f58a1022638e71fa373cd338c1bf38980ed6cd45a757c", + "secrets-engine/src/secrets_engine/openbao.py": "c1d17ca30367fd2c856927e8ce4021599a992c6c22509f82a6d8d4588ea46199", + "secrets-engine/src/secrets_engine/pep_stance.py": "c4cacb4ac0c5043cf6fc062b43a6cfac06f15b662a4ed4941db10265985fb1b5", + "secrets-engine/src/secrets_engine/plan.py": "d67aaf5a6d22b4d86bab20c7f02f9cf9bf89c87888c945bddb46fb85325c84c6", + "secrets-engine/src/secrets_engine/provision.py": "f2ab4fbe0c6bcfc93fe423f74368cedb311bb6f8384674b2ef14b4015bd89a17", + "secrets-engine/src/secrets_engine/publication_policy.py": "360aca599ddc16df4efac2af45b2e341018732de665162b4fbc74b7c6c9b2b87", + "secrets-engine/src/secrets_engine/redact.py": "503ade16cefd9620c6474b6be327e75ad2487f2a76f1d42b112a6fa8c510a314", + "secrets-engine/src/secrets_engine/roles.py": "69923fe9f3a6df6503bd9e0b25cfdf34f80ce7477462cfafdb3d59a030703ffe", + "secrets-engine/src/secrets_engine/rotate.py": "9b6bed6b8ae736e525bab96d99bd0ad39a807ef10f948292a82ab1a6d86c7c80", + "secrets-engine/src/secrets_engine/routing.py": "9d5050d7494a207394ce8251d8aac574ca0c08e3252639b5f05b373d6e35a076", + "secrets-engine/src/secrets_engine/safe_paths.py": "90e31769f66f34910b562d64bebcaa3e8cea23e79678eff4d625efcefc0d4f73", + "secrets-engine/src/secrets_engine/secret_use.py": "sha256:07dc7eaa44d8e0372167e84fc9ab543614c962c36f180957579f835493012ff2", + "secrets-engine/src/secrets_engine/service_auth.py": "sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0", + "secrets-engine/src/secrets_engine/task_execution_handoff.py": "f673443dc5f3a796a09db5ad51bcdf59d83d718cc00912489dbb8d43df95aefe", + "secrets-engine/src/secrets_engine/verify.py": "a122f598e7a63756906ce8e5c75ebb1331b248ffbe445130848272afc6b8cf28", + "secrets-engine/src/secrets_engine/wrap.py": "a37c491a93c8803015d2f1fca6ea502b8da28a9279900404d8f9ebf06a0c0a70", + "intake-submitters.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356", + "secrets_source_revision": "git:691dc742362eeec45d5bd32d2b468f31a959748e" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.json new file mode 100644 index 0000000..5f696ad --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.json @@ -0,0 +1,99 @@ +{ + "returncode": 0, + "seconds": 1.07, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-all-i56scyc5", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./cmd/access-engine", + "-run", + "^TestForgejoActualPolicySignedLosslessAndLegacy$", + "-count=1" + ], + "source_pins": { + "internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d", + "internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc", + "cmd/access-engine/forgejo_application_profile_test.go": "4a26549b174ee4b32ca674c93d02c5adda827d6ed1cd896e3c3070fbf44fd85c", + "cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445", + "adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3", + "adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa", + "adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6", + "adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29", + "adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3", + "adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f", + "adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee", + "adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "examples/forgejo-application-access/policy.md": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac", + "examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e", + "examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e" + }, + "network": "disabled", + "pid_namespace": "private" +} diff --git a/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.json b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.json new file mode 100644 index 0000000..c39e1c3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.json @@ -0,0 +1,99 @@ +{ + "returncode": 1, + "seconds": 13.31, + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-resume-producer-all-i56scyc5", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--chdir", + "/work/source", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./cmd/access-engine", + "-run", + "^TestForgejoActualPolicySignedLosslessAndLegacy$", + "-count=1" + ], + "source_pins": { + "internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d", + "internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc", + "cmd/access-engine/forgejo_application_profile_test.go": "4a26549b174ee4b32ca674c93d02c5adda827d6ed1cd896e3c3070fbf44fd85c", + "cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445", + "adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3", + "adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa", + "adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6", + "adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29", + "adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3", + "adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f", + "adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19", + "adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba", + "adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee", + "adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde", + "examples/forgejo-application-access/policy.md": "1ad11259f7ea8aae160f2542d88719cdb247037a2754c339c3a83e807953fa31", + "examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e", + "examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e" + }, + "network": "disabled", + "pid_namespace": "private" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/publication-commit.json b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/publication-commit.json new file mode 100644 index 0000000..c7bf78a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/publication-commit.json @@ -0,0 +1,105 @@ +{ + "exit_code": 0, + "commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3", + "base": "d328a2601095686f74376d87791bff01e2a3a2a3", + "files": [ + { + "path": "Makefile", + "sha256": "7ef0d92d357c18ba3237f1e52727ffa06790195c7ed63f9e774eb186b1a241d9" + }, + { + "path": "adapters/go/decisionpep/LICENSE", + "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6" + }, + { + "path": "adapters/go/decisionpep/go.mod", + "sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3" + }, + { + "path": "adapters/go/decisionpep/internal/sign/sign.go", + "sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde" + }, + { + "path": "adapters/go/decisionpep/pkg/api/canonical.go", + "sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19" + }, + { + "path": "adapters/go/decisionpep/pkg/api/caring.go", + "sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3" + }, + { + "path": "adapters/go/decisionpep/pkg/api/resource_manifest.go", + "sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f" + }, + { + "path": "adapters/go/decisionpep/pkg/decisionpep/client.go", + "sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba" + }, + { + "path": "adapters/go/decisionpep/pkg/decisionpep/client_test.go", + "sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62" + }, + { + "path": "adapters/go/decisionpep/producer-source.json", + "sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb" + }, + { + "path": "adapters/go/decisionpep/testsupport/signfixture/sign.go", + "sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + { + "path": "cmd/access-engine/forgejo_application_profile_test.go", + "sha256": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe" + }, + { + "path": "cmd/access-engine/main.go", + "sha256": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d" + }, + { + "path": "docs/decisionpep-adapter.md", + "sha256": "48ebf9bf71e12ac09553d2ed19eb7c9fdb785a67560dd173f169c616c35e26b2" + }, + { + "path": "examples/forgejo-application-access/policy.md", + "sha256": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac" + }, + { + "path": "examples/forgejo-application-access/registry_snapshot.json", + "sha256": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e" + }, + { + "path": "internal/decision/engine.go", + "sha256": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d" + }, + { + "path": "internal/decision/json_profile.go", + "sha256": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f" + }, + { + "path": "pkg/decisionpep/client.go", + "sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba" + }, + { + "path": "pkg/decisionpep/client_test.go", + "sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62" + }, + { + "path": "pkg/decisionpep/export_test.go", + "sha256": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843" + }, + { + "path": "testsupport/signfixture/sign.go", + "sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + { + "path": "tools/export_decisionpep_adapter.py", + "sha256": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1" + }, + { + "path": "workplans/FLEX-WP-0024-decision-envelope-authenticity.md", + "sha256": "f578b116587bc9d269081129b78d6d4ab6a2bd14105bfa57a464f07597823ab6" + } + ], + "stdout": "[main ca0cb75] Add producer-owned authenticated Go decision client and validated Forgejo profile\n 24 files changed, 2980 insertions(+), 4 deletions(-)\n create mode 100644 adapters/go/decisionpep/LICENSE\n create mode 100644 adapters/go/decisionpep/go.mod\n create mode 100644 adapters/go/decisionpep/internal/sign/sign.go\n create mode 100644 adapters/go/decisionpep/pkg/api/canonical.go\n create mode 100644 adapters/go/decisionpep/pkg/api/caring.go\n create mode 100644 adapters/go/decisionpep/pkg/api/resource_manifest.go\n create mode 100644 adapters/go/decisionpep/pkg/decisionpep/client.go\n create mode 100644 adapters/go/decisionpep/pkg/decisionpep/client_test.go\n create mode 100644 adapters/go/decisionpep/producer-source.json\n create mode 100644 adapters/go/decisionpep/testsupport/signfixture/sign.go\n create mode 100644 cmd/access-engine/forgejo_application_profile_test.go\n create mode 100644 docs/decisionpep-adapter.md\n create mode 100644 examples/forgejo-application-access/policy.md\n create mode 100644 examples/forgejo-application-access/registry_snapshot.json\n create mode 100644 internal/decision/json_profile.go\n create mode 100644 pkg/decisionpep/client.go\n create mode 100644 pkg/decisionpep/client_test.go\n create mode 100644 pkg/decisionpep/export_test.go\n create mode 100644 testsupport/signfixture/sign.go\n create mode 100644 tools/export_decisionpep_adapter.py\n", + "stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 21, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-application.json b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-application.json new file mode 100644 index 0000000..ec6d5cc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-application.json @@ -0,0 +1,8 @@ +{ + "status": "applied", + "files": 24, + "base": "d328a2601095686f74376d87791bff01e2a3a2a3", + "native_changes": false, + "protected_worktree_and_index_preserved": true, + "formal_owner_assent": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-manifest.json b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-manifest.json new file mode 100644 index 0000000..9cff482 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-manifest.json @@ -0,0 +1,163 @@ +{ + "base": "d328a2601095686f74376d87791bff01e2a3a2a3", + "files": [ + { + "path": "Makefile", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/Makefile", + "before_sha256": "aa32fe04336d4613835629d969ec8c49782d61ee0e2a62f09fd67d19796f58b7", + "sha256": "7ef0d92d357c18ba3237f1e52727ffa06790195c7ed63f9e774eb186b1a241d9" + }, + { + "path": "adapters/go/decisionpep/LICENSE", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/LICENSE", + "before_sha256": null, + "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6" + }, + { + "path": "adapters/go/decisionpep/go.mod", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/go.mod", + "before_sha256": null, + "sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3" + }, + { + "path": "adapters/go/decisionpep/internal/sign/sign.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/internal/sign/sign.go", + "before_sha256": null, + "sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde" + }, + { + "path": "adapters/go/decisionpep/pkg/api/canonical.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/canonical.go", + "before_sha256": null, + "sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19" + }, + { + "path": "adapters/go/decisionpep/pkg/api/caring.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/caring.go", + "before_sha256": null, + "sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3" + }, + { + "path": "adapters/go/decisionpep/pkg/api/resource_manifest.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/resource_manifest.go", + "before_sha256": null, + "sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f" + }, + { + "path": "adapters/go/decisionpep/pkg/decisionpep/client.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client.go", + "before_sha256": null, + "sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba" + }, + { + "path": "adapters/go/decisionpep/pkg/decisionpep/client_test.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client_test.go", + "before_sha256": null, + "sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62" + }, + { + "path": "adapters/go/decisionpep/producer-source.json", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/producer-source.json", + "before_sha256": null, + "sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb" + }, + { + "path": "adapters/go/decisionpep/testsupport/signfixture/sign.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/testsupport/signfixture/sign.go", + "before_sha256": null, + "sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + { + "path": "cmd/access-engine/forgejo_application_profile_test.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/cmd/access-engine/forgejo_application_profile_test.go", + "before_sha256": null, + "sha256": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe" + }, + { + "path": "cmd/access-engine/main.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/cmd/access-engine/main.go", + "before_sha256": "da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758", + "sha256": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d" + }, + { + "path": "docs/decisionpep-adapter.md", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/docs/decisionpep-adapter.md", + "before_sha256": null, + "sha256": "48ebf9bf71e12ac09553d2ed19eb7c9fdb785a67560dd173f169c616c35e26b2" + }, + { + "path": "examples/forgejo-application-access/policy.md", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/examples/forgejo-application-access/policy.md", + "before_sha256": null, + "sha256": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac" + }, + { + "path": "examples/forgejo-application-access/registry_snapshot.json", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/examples/forgejo-application-access/registry_snapshot.json", + "before_sha256": null, + "sha256": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e" + }, + { + "path": "internal/decision/engine.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/internal/decision/engine.go", + "before_sha256": "be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd", + "sha256": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d" + }, + { + "path": "internal/decision/json_profile.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/internal/decision/json_profile.go", + "before_sha256": null, + "sha256": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f" + }, + { + "path": "pkg/decisionpep/client.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/client.go", + "before_sha256": null, + "sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba" + }, + { + "path": "pkg/decisionpep/client_test.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/client_test.go", + "before_sha256": null, + "sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62" + }, + { + "path": "pkg/decisionpep/export_test.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/export_test.go", + "before_sha256": null, + "sha256": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843" + }, + { + "path": "testsupport/signfixture/sign.go", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/testsupport/signfixture/sign.go", + "before_sha256": null, + "sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29" + }, + { + "path": "tools/export_decisionpep_adapter.py", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/tools/export_decisionpep_adapter.py", + "before_sha256": null, + "sha256": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1" + }, + { + "path": "workplans/FLEX-WP-0024-decision-envelope-authenticity.md", + "source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/workplan.postimage.md", + "before_sha256": "cc94a493c23c16a3baa718b75ef5d48a596c6386c11534d50fd4839a6f0448f2", + "sha256": "f578b116587bc9d269081129b78d6d4ab6a2bd14105bfa57a464f07597823ab6" + } + ], + "protected": [ + { + "path": ".custodian-brief.md", + "sha256": "009d2b150ad8f519818187298527da687946dc019bc35c72821170e7dd1942f8", + "index": "100644 5e12ebd1d7606f88c606a5cc23b2c24d1afa8a3a 0\t.custodian-brief.md" + }, + { + "path": "WORK-RECORDS.md", + "sha256": "f713204e5c524f22e4a831fa480bf0e2018e206cd48f55fbf9d5472bfca104a5", + "index": "100644 62ffebf8500114c6080a7a15809cb3e344a555d7 0\tWORK-RECORDS.md" + } + ], + "native_changes": false, + "formal_owner_assent": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json new file mode 100644 index 0000000..1f598dc --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json @@ -0,0 +1,2214 @@ +{ + "objective": "Finish what you found missing and finish CUST-WP-0080", + "status": "active", + "observed_at": "2026-10-17T23:36:49.758150+00:00", + "normative_architecture": { + "path": "docs/netkingdom-target-security-architecture.md", + "sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35" + }, + "workplan": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "previous_goal_turn": "progress: committed review, reconstructed failures and restored missing owner task projections", + "requirement_scope": "All sixteen target gates plus G01-G13 and SEC-DSM ledger; source tests never substitute for native acceptance", + "current_work": "Producer SDK/policy and composed Forgejo callback/private input/transaction source implemented and checked. Actual KeyCape structured assurance and current-authentication/provenance interoperability is the next source correction; native/profile work remains open.", + "acceptance_gates": [ + { + "id": "TSA-01", + "required_outcome": "Every inventoried privileged PEP authenticates its decision", + "required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-02", + "required_outcome": "Exact approval produces one bounded protected operation", + "required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-03", + "required_outcome": "Crashes preserve uncertainty and cleanup", + "required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-04", + "required_outcome": "First reusable browser case is accepted", + "required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-05", + "required_outcome": "Human and browser consumers can use the delivered identity", + "required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-06", + "required_outcome": "Actual agent and runner authority is bounded", + "required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-07", + "required_outcome": "Credential lifecycle is inventoried and simplified", + "required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-08", + "required_outcome": "Recovery is independent and measured", + "required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-09", + "required_outcome": "Security effects have independently reconciled evidence", + "required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-10", + "required_outcome": "Source and delivery controls cover declared entry paths", + "required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-11", + "required_outcome": "Discovery remains accurate", + "required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-12", + "required_outcome": "Improvement operates without repeated manual polling", + "required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-13", + "required_outcome": "Shared adapters reduce per-consumer implementation", + "required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-14", + "required_outcome": "Minimal profiles are independently reusable", + "required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-15", + "required_outcome": "Optimization improves measured operations", + "required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.", + "status": "incomplete", + "completion_evidence": [] + }, + { + "id": "TSA-16", + "required_outcome": "Governance and exceptions remain truthful", + "required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.", + "status": "incomplete", + "completion_evidence": [] + } + ], + "separate_required_deliverables": [ + "G01-G13 current closure evidence or already applicable approved exceptions", + "SEC-DSM requirement ledger reconciled with exact evidence", + "T05 real human and agent Playwright acceptance and supported discovery", + "Second real consumer and clean installation proves reuse", + "Residual handoffs before workplan finish; no required work left only in prose" + ], + "workplan_finished": false, + "sec_dsm_requirements": { + "path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json", + "sha256": "ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184", + "count": 116, + "requirements": [ + { + "id": "DSM-TRANS-001", + "title": "Highest Practical Mechanism", + "line": 411, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-TRANS-002", + "title": "Govern the Residual Secret", + "line": 415, + "normative_terms": [ + "MUST" + ], + "status": "incomplete", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [], + "assessment": { + "scope": "Current NetKingdom/KeyCape static privacyIDEA bootstrap/token source path; no estate-wide conformance inferred", + "observed": "Current profile no longer creates the obsolete Keycloak trigger credential. Remaining create-pi-token.sh authenticates as pi-admin, stores a local bearer and publishes keycape-pi-token; create-secrets.sh also embeds that bearer in full configuration. Documented expiry/refresh is not complete owner/scoped lifecycle acceptance.", + "remaining": "Native consumer/owner inventory, minimum feasible service authority, central authoritative custody, bounded refresh/rotation, revoke-old proof and private leak detection are not established. Existing legacy accounts/Secrets need inventory and authorized revocation.", + "owner_task": "NK-WP-0049-T02/T03; CUST-WP-0080-T03 (G04/G09/G12)", + "verification_evidence": [ + "admin-bootstrap.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-TRANS-003", + "title": "Do Not Fake Dynamism", + "line": 427, + "normative_terms": [ + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-TRANS-004", + "title": "Record Elimination Potential", + "line": 431, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-TRANS-005", + "title": "Account for Issuer Dependency", + "line": 444, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-TRANS-006", + "title": "Degraded Operation", + "line": 458, + "normative_terms": [ + "MUST NOT", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ARCH-001", + "title": "Minimize Persistent Secrets", + "line": 475, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ARCH-002", + "title": "Static Secrets Are Exceptions", + "line": 479, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ARCH-003", + "title": "Separate Identity From Authority", + "line": 492, + "normative_terms": [ + "MUST", + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ARCH-004", + "title": "Separate Control Plane From Delivery", + "line": 498, + "normative_terms": [ + "SHOULD", + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ARCH-005", + "title": "Optimize for Operability", + "line": 504, + "normative_terms": [ + "MUST", + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G04", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-001", + "title": "Secure Path of Least Resistance", + "line": 518, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-002", + "title": "Golden Paths", + "line": 522, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-003", + "title": "Self-Service", + "line": 534, + "normative_terms": [ + "SHOULD", + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-004", + "title": "Local Development", + "line": 540, + "normative_terms": [ + "SHOULD", + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-005", + "title": "Debuggability", + "line": 567, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DX-006", + "title": "Avoid Security Escape Hatches Becoming Defaults", + "line": 581, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G02", + "G05", + "G08" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ID-001", + "title": "Unique Workload Identity", + "line": 589, + "normative_terms": [ + "MUST NOT", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ID-002", + "title": "Federated Authentication", + "line": 597, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ID-003", + "title": "Eliminate Secret Zero", + "line": 611, + "normative_terms": [ + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ID-004", + "title": "Human and Machine Identity Separation", + "line": 615, + "normative_terms": [ + "MUST", + "MUST NOT", + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUTH-001", + "title": "Least Authority", + "line": 627, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUTH-002", + "title": "Contextual Scope", + "line": 631, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUTH-003", + "title": "Environment Isolation", + "line": 656, + "normative_terms": [ + "MUST", + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUTH-004", + "title": "Tenant Isolation", + "line": 662, + "normative_terms": [ + "MUST", + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05", + "G12", + "G13" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ISSUE-001", + "title": "Prefer Dynamic Issuance", + "line": 672, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ISSUE-002", + "title": "Shortest Practical Lifetime", + "line": 676, + "normative_terms": [ + "MUST", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ISSUE-003", + "title": "Per-Execution Credentials", + "line": 682, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ISSUE-004", + "title": "Producer Credential Protection", + "line": 686, + "normative_terms": [ + "MUST", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-STORE-001", + "title": "Authoritative Storage", + "line": 702, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-STORE-002", + "title": "Minimize Copies", + "line": 706, + "normative_terms": [ + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Removed emergency plaintext/root duplication and partial-decrypt copies; Make setup no longer installs or requires a permanent HOME key. Removed automatic creation of the unused legacy trigger-admin Secret from the current bootstrap profile.", + "remaining": "Existing permanent key copies were not deleted/reconciled; other caller copies and the estate inventory remain open.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json", + "admin-bootstrap.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-STORE-003", + "title": "Encrypt at Rest", + "line": 712, + "normative_terms": [ + "MUST", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-STORE-004", + "title": "No Plaintext Source Control", + "line": 718, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-STORE-005", + "title": "Git-Encrypted Secrets", + "line": 722, + "normative_terms": [ + "MAY", + "MUST", + "MUST NOT", + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G04", + "G08", + "G11", + "G12" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Public-recipient-only bootstrap/direct encryption and explicit matching-key SOPS recovery now have disposable crypto proof. SOPS recovery isolates ambient credential discovery and rejects other custody backends.", + "remaining": "Native independent custody, intended-environment runtime isolation and rotation remain unverified; source SOPS profile is limited to age-only JSON/YAML.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-DELIV-001", + "title": "Prefer Direct Consumption", + "line": 737, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DELIV-002", + "title": "Minimize Persistence During Delivery", + "line": 741, + "normative_terms": [ + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Custody input is removed on command return; decrypt failures remove staging. Make recovery publishes only a new private output and suppresses raw tool output. Rotation file updates and database SQL use stdin, and break-glass uses private file input rather than plaintext argv literals.", + "remaining": "Successful recovery output requires operator cleanup; SIGKILL, child copy retention, other callers and native lifetime enforcement remain unverified. Rotation candidates deliberately remain in private files for custody/reconciliation; delegated child argv and partial native states are not closed.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json", + "rotation-output.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-DELIV-003", + "title": "Environment Variables", + "line": 754, + "normative_terms": [ + "MAY", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DELIV-004", + "title": "Kubernetes Secret Replication", + "line": 760, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DELIV-005", + "title": "Delivery Policy", + "line": 764, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G02", + "G03", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROT-001", + "title": "Rotation Policy", + "line": 772, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROT-002", + "title": "Automatic Rotation", + "line": 776, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROT-003", + "title": "Rotation Includes Adoption", + "line": 780, + "normative_terms": [ + "MUST NOT" + ], + "status": "incomplete", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom creds-rotate source and existing founder-deferred rotation; estate-wide adoption remains open", + "observed": "Reproduced missing database/unimplemented unattended LDAP steps falsely reaching completion. Source now refuses those cases and distinguishes successful script timestamps from native adoption. Synthetic apply/SQL failure tests prevent completion stamps. Admin bootstrap retries now verify without resetting passwords; actual-model tests exercise insert conflict and rollback.", + "remaining": "No native new-consumer acceptance, old-credential refusal or full copy/partial-state reconciliation. RSA rollback, legacy account revocation and multi-consumer lifecycle remain unverified. CUST-WP-0073-T05 remains founder-deferred.", + "owner_task": "NK-WP-0049-T02/T03; CUST-WP-0073-T05", + "verification_evidence": [ + "rotation-output.json", + "admin-bootstrap.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-ROT-004", + "title": "Zero/Low-Downtime Rotation", + "line": 794, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROT-005", + "title": "Dynamic Issuance Preferred", + "line": 798, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-REV-001", + "title": "Bounded Validity", + "line": 806, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-REV-002", + "title": "Explicit Revocation", + "line": 810, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-REV-003", + "title": "Known Revocation Procedure", + "line": 814, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-REV-004", + "title": "Compromise Response", + "line": 818, + "normative_terms": [ + "MUST", + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G09" + ], + "closure_evidence": [] + }, + { + "id": "DSM-DETECT-001", + "title": "Secret Detection", + "line": 830, + "normative_terms": [ + "MUST" + ], + "status": "incomplete", + "gap_refs": [ + "G07" + ], + "closure_evidence": [], + "assessment": { + "scope": "22 reviewed workstation checkouts and 166 of 167 deployed Forgejo repositories; isolated lifecycle checks separately scoped; no estate-wide conformance inferred", + "observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation is now verified on 22 Forgejo repositories. Actual SSH clean/detection probes passed under a temporary veto, with absent probe refs/quarantine and veto cleanup; fresh read-only hashes match. Ordinary source pushes to Custodian and railiance-forge succeeded. Separate exact-image isolated HTTP/API/merge, regeneration, Git-template inheritance and restart checks pass (23 assertions), with all earlier incomplete preparation attempts retained. Exact template source was deployed on October 13: same-image generation 12 Ready, actual global Git template selection and regular/executable inheritance in a native temporary repository verified, all original 22 profiles/binaries preserved. Thirty isolated mounted-file/configuration/rollback checks and six conditional-patch regressions pass. The first live template rollout subsequently failed ordinary source acceptance: group-writable0775 scanner permissions were refused. Trial retained as failed. Recovery restored0755 and persisted a hash/owner-checked startup guard (railiance-apps50b66c4). Two Kubernetes replacements, generations13/14, completed the guard and passed inherited native clean/secret/quarantine/recovery probes. Six isolated custody checks pass; builtin authorization excluded in temporary native probes. See recovery summary for separate ordinary SSH acceptance. Exact FORGE6-EXPAND-001 completed 143 further native SSH scanner/verdict probes under ref-specific vetoes. Final audit verifies 166 of 167 profiles, all 23 baseline profiles preserved, zero unknown profiles and no probe refs, vetoes or ownership markers.", + "remaining": "One repository (numeric ID 55) has four external submodules and remains builtin-only; other workstation clones remain uncovered. Production authenticated HTTP/API/SSO/frontend acceptance is open; protected credential route unavailable before child handoff. Import/mirror clone/fetch bypass receive-pack; historical, LFS, logs/artifacts/runtime coverage, CI authority and private detection-to-response remain unverified.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", + "verification_evidence": [ + "secret-detection.json", + "secret-hook-activation.json", + "receive-secret-detection.json", + "receive-hook-activation.json", + "../2026-10-13-netkingdom-security/receive-profile-recheck.json", + "../2026-10-13-netkingdom-security/receive-clean-push.json", + "../2026-10-13-netkingdom-security/forge-lifecycle-summary.json", + "../2026-10-13-netkingdom-security/forge-template-activation.json", + "../2026-10-13-netkingdom-security/forge-template-isolated.json", + "../2026-10-13-netkingdom-security/forge-hook-coverage-refresh.json", + "../2026-10-13-netkingdom-security/forge-custody-recovery-summary.json", + "../2026-10-13-netkingdom-security/forge-expansion-final.json", + "../2026-10-13-netkingdom-security/forge-api-route-readiness.json" + ], + "assessed_at": "2026-10-13" + } + }, + { + "id": "DSM-DETECT-002", + "title": "Layered Detection", + "line": 834, + "normative_terms": [ + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G07" + ], + "closure_evidence": [], + "assessment": { + "scope": "22 reviewed workstation checkouts and 166 of 167 deployed Forgejo repositories; isolated lifecycle checks separately scoped; no estate-wide conformance inferred", + "observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation is now verified on 22 Forgejo repositories. Actual SSH clean/detection probes passed under a temporary veto, with absent probe refs/quarantine and veto cleanup; fresh read-only hashes match. Ordinary source pushes to Custodian and railiance-forge succeeded. Separate exact-image isolated HTTP/API/merge, regeneration, Git-template inheritance and restart checks pass (23 assertions), with all earlier incomplete preparation attempts retained. Exact template source was deployed on October 13: same-image generation 12 Ready, actual global Git template selection and regular/executable inheritance in a native temporary repository verified, all original 22 profiles/binaries preserved. Thirty isolated mounted-file/configuration/rollback checks and six conditional-patch regressions pass. The first live template rollout subsequently failed ordinary source acceptance: group-writable0775 scanner permissions were refused. Trial retained as failed. Recovery restored0755 and persisted a hash/owner-checked startup guard (railiance-apps50b66c4). Two Kubernetes replacements, generations13/14, completed the guard and passed inherited native clean/secret/quarantine/recovery probes. Six isolated custody checks pass; builtin authorization excluded in temporary native probes. See recovery summary for separate ordinary SSH acceptance. Exact FORGE6-EXPAND-001 completed 143 further native SSH scanner/verdict probes under ref-specific vetoes. Final audit verifies 166 of 167 profiles, all 23 baseline profiles preserved, zero unknown profiles and no probe refs, vetoes or ownership markers.", + "remaining": "One repository (numeric ID 55) has four external submodules and remains builtin-only; other workstation clones remain uncovered. Production authenticated HTTP/API/SSO/frontend acceptance is open; protected credential route unavailable before child handoff. Import/mirror clone/fetch bypass receive-pack; historical, LFS, logs/artifacts/runtime coverage, CI authority and private detection-to-response remain unverified.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", + "verification_evidence": [ + "secret-detection.json", + "secret-hook-activation.json", + "receive-secret-detection.json", + "receive-hook-activation.json", + "../2026-10-13-netkingdom-security/receive-profile-recheck.json", + "../2026-10-13-netkingdom-security/receive-clean-push.json", + "../2026-10-13-netkingdom-security/forge-lifecycle-summary.json", + "../2026-10-13-netkingdom-security/forge-template-activation.json", + "../2026-10-13-netkingdom-security/forge-template-isolated.json", + "../2026-10-13-netkingdom-security/forge-hook-coverage-refresh.json", + "../2026-10-13-netkingdom-security/forge-custody-recovery-summary.json", + "../2026-10-13-netkingdom-security/forge-expansion-final.json", + "../2026-10-13-netkingdom-security/forge-api-route-readiness.json" + ], + "assessed_at": "2026-10-13" + } + }, + { + "id": "DSM-DETECT-003", + "title": "Push Prevention", + "line": 848, + "normative_terms": [ + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G07" + ], + "closure_evidence": [], + "assessment": { + "scope": "Reviewed workstation checkouts and 22 deployed Forgejo repositories; separate exact-image isolated lifecycle checks; no estate-wide conformance inferred", + "observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation is now verified on 22 Forgejo repositories. Actual SSH clean/detection probes passed under a temporary veto, with absent probe refs/quarantine and veto cleanup; fresh read-only hashes match. Ordinary source pushes to Custodian and railiance-forge succeeded. Separate exact-image isolated HTTP/API/merge, regeneration, Git-template inheritance and restart checks pass (23 assertions), with all earlier incomplete preparation attempts retained. Exact template source was deployed on October 13: same-image generation 12 Ready, actual global Git template selection and regular/executable inheritance in a native temporary repository verified, all original 22 profiles/binaries preserved. Thirty isolated mounted-file/configuration/rollback checks and six conditional-patch regressions pass. The first live template rollout subsequently failed ordinary source acceptance: group-writable0775 scanner permissions were refused. Trial retained as failed. Recovery restored0755 and persisted a hash/owner-checked startup guard (railiance-apps50b66c4). Two Kubernetes replacements, generations13/14, completed the guard and passed inherited native clean/secret/quarantine/recovery probes. Six isolated custody checks pass; builtin authorization excluded in temporary native probes. See recovery summary for separate ordinary SSH acceptance.", + "remaining": "Fresh inventory has 166 repositories: 22 installed profiles and 144 builtin-only; other workstation clones remain uncovered. Production authenticated HTTP/SSO/frontend creation remains open. Import/mirror clone/fetch bypass receive-pack; historical, LFS, logs/artifacts/runtime coverage, CI authority and private detection-to-response are unverified.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03", + "verification_evidence": [ + "secret-detection.json", + "secret-hook-activation.json", + "receive-secret-detection.json", + "receive-hook-activation.json", + "../2026-10-13-netkingdom-security/receive-profile-recheck.json", + "../2026-10-13-netkingdom-security/receive-clean-push.json", + "../2026-10-13-netkingdom-security/forge-lifecycle-summary.json", + "../2026-10-13-netkingdom-security/forge-template-activation.json", + "../2026-10-13-netkingdom-security/forge-template-isolated.json", + "../2026-10-13-netkingdom-security/forge-hook-coverage-refresh.json", + "../2026-10-13-netkingdom-security/forge-custody-recovery-summary.json" + ], + "assessed_at": "2026-10-13" + } + }, + { + "id": "DSM-DETECT-004", + "title": "Detection-to-Revocation", + "line": 852, + "normative_terms": [ + "SHOULD" + ], + "status": "incomplete", + "gap_refs": [ + "G07" + ], + "closure_evidence": [], + "assessment": { + "scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred", + "observed": "Source adapter emits only fixed status/counts and blocked blob IDs, suitable for private owner triage without finding disclosure.", + "remaining": "No exercised detection-to-response path or automatic/semi-automatic revocation integration. Actual exposed credentials require separately authorized response; founder-deferred rotation is unchanged.", + "owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03", + "verification_evidence": [ + "secret-detection.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-CI-001", + "title": "CI/CD Is Production Security Infrastructure", + "line": 862, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "closure_evidence": [], + "assessment": { + "scope": "Existing Forgejo runner Docker network listener only; full production-grade CI/CD posture remains unverified", + "observed": "Unauthenticated Docker ping from a separate pod succeeded before repair. Exact same-image generation 4 now binds only 127.0.0.1:2375; local readiness/ping and runner heartbeat pass; peer-pod ping is refused. Resources and Recreate strategy preserved; zero queued/running jobs at change.", + "remaining": "Host-mode job privilege sharing, workflow authority, required checks, short-lived job identity, detection and response remain open. No complete DSM-CI-001 conformance inferred.", + "verification_evidence": [ + "../2026-10-13-netkingdom-security/forge-runner-loopback-activation.json", + "../2026-10-13-netkingdom-security/forge-runner-heartbeat.json" + ], + "owner_task": "FORGE-WP-0006-T03; RMGR-WP-0021-T03/T04; CUST-WP-0080-T03", + "assessed_at": "2026-10-13" + } + }, + { + "id": "DSM-CI-002", + "title": "OIDC/Federation", + "line": 866, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-CI-003", + "title": "Pipeline Change Authority", + "line": 872, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-CI-004", + "title": "Secret Masking Is Not Protection", + "line": 876, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-CI-005", + "title": "Job-Scoped Credentials", + "line": 880, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G07", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-KEY-001", + "title": "Non-Exportability", + "line": 972, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-KEY-002", + "title": "KMS/HSM", + "line": 976, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-KEY-003", + "title": "Cryptographic Operations Instead of Key Retrieval", + "line": 980, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-KEY-004", + "title": "Local Key Material", + "line": 999, + "normative_terms": [ + "MAY", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-KEY-005", + "title": "Keyless Signing", + "line": 1010, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-HUM-001", + "title": "No Human Transport", + "line": 1018, + "normative_terms": [ + "SHOULD NOT" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "closure_evidence": [] + }, + { + "id": "DSM-HUM-002", + "title": "Human Readability", + "line": 1031, + "normative_terms": [ + "SHOULD NOT" + ], + "status": "incomplete", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Emergency/generation/custody tracing leaks repaired; Make decrypt now routes plaintext into a private file rather than the terminal. Rotation values/tracing/child diagnostics now remain off stdout/stderr in synthetic success and failure tests. Admin bootstrap now removes unused trigger-credential creation and sends the remaining input only on stdin, with no shell sourcing or raw diagnostic output.", + "remaining": "KeyCape token issuance/projection and other delegated helpers still need source and native review; actual deployed MFA/custody and legacy credential revocation remain unverified.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json", + "rotation-output.json", + "admin-bootstrap.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-HUM-003", + "title": "Break Glass", + "line": 1035, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G01", + "G03", + "G08", + "G11" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-001", + "title": "Agent Identity", + "line": 1050, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-002", + "title": "Per-Run Identity", + "line": 1054, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-003", + "title": "Short Agent Identity Lifetime", + "line": 1067, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-004", + "title": "No Embedded Master Credential", + "line": 1078, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-005", + "title": "Capability Brokerage", + "line": 1082, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-006", + "title": "Deterministic Enforcement", + "line": 1086, + "normative_terms": [ + "MUST", + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-007", + "title": "Prevent Credential Accumulation", + "line": 1092, + "normative_terms": [ + "MUST NOT", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AGENT-008", + "title": "Tool Authority Is Agent Authority", + "line": 1098, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G03", + "G05" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUDIT-001", + "title": "Audit Security-Relevant Operations", + "line": 1126, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G06" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUDIT-002", + "title": "Never Audit Plaintext Secrets", + "line": 1139, + "normative_terms": [ + "MUST NOT" + ], + "status": "unverified", + "gap_refs": [ + "G06" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUDIT-003", + "title": "Attribution", + "line": 1143, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G06" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUDIT-004", + "title": "Audit Integrity", + "line": 1157, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G06" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AUDIT-005", + "title": "Identity Failure Observability", + "line": 1163, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G06" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROOT-001", + "title": "Enumerate Roots", + "line": 1180, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROOT-002", + "title": "Minimize Roots", + "line": 1186, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "closure_evidence": [] + }, + { + "id": "DSM-ROOT-003", + "title": "Root Isolation", + "line": 1190, + "normative_terms": [ + "MUST NOT" + ], + "status": "incomplete", + "gap_refs": [ + "G08", + "G11" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Bootstrap/direct encryption no longer discover private keys; decryption requires explicit custody. Make setup is public-only; age-only SOPS recovery requires a matching private key with isolated HOME/XDG/environment.", + "remaining": "Runtime agent isolation is unproved. Existing key copies and direct editor/rotate/delegated caller coverage remain open; this wrapper is not an OS sandbox.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-ROOT-004", + "title": "Recovery", + "line": 1194, + "normative_terms": [ + "MUST" + ], + "status": "incomplete", + "gap_refs": [ + "G08", + "G11" + ], + "closure_evidence": [], + "assessment": { + "scope": "NetKingdom bootstrap/custody source; broader requirement remains open", + "observed": "Explicit-custody recovery procedures and real disposable age/SOPS roundtrip/refusal/cleanup tests exist.", + "remaining": "No fresh owner-scoped off-host isolated recovery acceptance for this secret-bearing bootstrap path; NK-WP-0045 covers non-secret root-grant history only.", + "owner_task": "NK-WP-0049-T02/T03", + "verification_evidence": [ + "bootstrap-handoff.json", + "custody-entrypoints.json", + "sops-make-entrypoints.json" + ], + "assessed_at": "2026-10-12" + } + }, + { + "id": "DSM-ROOT-005", + "title": "Quorum for Extreme Authority", + "line": 1198, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G08", + "G11" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-001", + "title": "Secret Inventory", + "line": 1221, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-002", + "title": "Inventory Attributes", + "line": 1225, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-003", + "title": "Ownership", + "line": 1250, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-004", + "title": "Automated Discovery", + "line": 1254, + "normative_terms": [ + "MAY", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-005", + "title": "Evidence State", + "line": 1269, + "normative_terms": [ + "MUST NOT", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-006", + "title": "Discovered but Unowned", + "line": 1285, + "normative_terms": [ + "MUST", + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-INV-007", + "title": "Orphan Detection", + "line": 1296, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04" + ], + "closure_evidence": [] + }, + { + "id": "DSM-EXC-001", + "title": "Explicit Exceptions", + "line": 1304, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "closure_evidence": [] + }, + { + "id": "DSM-EXC-002", + "title": "Exception Record", + "line": 1308, + "normative_terms": [ + "MUST" + ], + "status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "closure_evidence": [] + }, + { + "id": "DSM-EXC-003", + "title": "Exceptions Expire or Revalidate", + "line": 1324, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "closure_evidence": [] + }, + { + "id": "DSM-EXC-004", + "title": "Elimination Path", + "line": 1330, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G09", + "G10" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-001", + "title": "Secrets in Git", + "line": 1348, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-002", + "title": "CI Variable as Universal Vault", + "line": 1352, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-003", + "title": "Shared Production Account", + "line": 1356, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-004", + "title": "Vault Token Beside Application", + "line": 1360, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-005", + "title": "Eternal API Token", + "line": 1366, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-006", + "title": "Kubernetes as Universal Vault", + "line": 1370, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-007", + "title": "Human Rotation Ritual", + "line": 1374, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-008", + "title": "Rotation Without Adoption", + "line": 1378, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-009", + "title": "Deleting the Leak", + "line": 1382, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-010", + "title": "Secret Scanning Without Response", + "line": 1386, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-011", + "title": "Masked Means Safe", + "line": 1390, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-012", + "title": "Developer Production Secret", + "line": 1394, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-013", + "title": "Root Everywhere", + "line": 1398, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-014", + "title": "One Credential Per Environment", + "line": 1402, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-015", + "title": "Secrets Manager as Generic Database", + "line": 1406, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-016", + "title": "LLM Gatekeeper", + "line": 1410, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-017", + "title": "Permanent Agent Authority", + "line": 1414, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-018", + "title": "Dynamic at Any Cost", + "line": 1418, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-019", + "title": "Undebuggable Federation", + "line": 1422, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-AP-020", + "title": "Hidden Credential Through Tooling", + "line": 1426, + "normative_terms": [], + "status": "reference", + "gap_refs": [ + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-CORE-1", + "title": "Minimum Viable Adoption", + "line": 1544, + "normative_terms": [], + "status": "unverified", + "gap_refs": [ + "G04", + "G05", + "G07", + "G09", + "G10", + "G12" + ], + "closure_evidence": [] + }, + { + "id": "DSM-CORE-2", + "title": "Next Best Investment", + "line": 1563, + "normative_terms": [ + "SHOULD" + ], + "status": "unverified", + "gap_refs": [ + "G04", + "G05", + "G07", + "G09", + "G10", + "G12" + ], + "closure_evidence": [] + } + ] + }, + "gap_ids": [ + "G01", + "G02", + "G03", + "G04", + "G05", + "G06", + "G07", + "G08", + "G09", + "G10", + "G11", + "G12", + "G13" + ], + "source_progress": { + "observed_at": "2026-10-17T23:36:49.758150+00:00", + "producer_source_commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3", + "producer_source_paths_verified": 24, + "projection": "primary/railiance01", + "producer_full_race": { + "returncode": 0, + "passed_tests_and_subtests": 494, + "existing_skips": 3 + }, + "consumer_packages": { + "returncode": 0, + "passed_tests_and_subtests": 76, + "skips": 0 + }, + "composed_cli": { + "returncode": 0, + "subprocesses": 48, + "real_credentials": false + }, + "composite_patch": { + "status": "verified", + "paths": 35, + "patch_sha256": "9bfc7384e81dc33fd2499dd0e13aa4367b2a61c0281eca500854aaf08498a15c", + "fuzz": 0, + "all_postimages_exact": true, + "native_changes": false + }, + "native_gates_closed": 0, + "formal_owner_assent": false, + "known_open": "Actual KeyCape structured assurance/authentication-time/provenance interoperability; ongoing protected paths; complete owner sessions/exclusion/evidence/custody/native acceptance." + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/annotate_public_metadata.py b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/annotate_public_metadata.py new file mode 100644 index 0000000..a2b69c3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/annotate_public_metadata.py @@ -0,0 +1,106 @@ +"""Verify flagged public artifacts before annotating their digest/commit types.""" +from pathlib import Path +import hashlib +import json +import re +import subprocess + +HERE = Path(__file__).resolve().parent +ROOT = HERE.parents[3] +PACKET = ROOT / 'docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2' +findings = json.loads((HERE / 'redacted-scanner-findings.json').read_text()) +assert not (HERE / 'public-metadata-derivation.json').exists() + + +def sha(raw): + return hashlib.sha256(raw).hexdigest() + + +def verify_consumer_source(name, digest, data): + candidates = [Path(data['workspace']) / 'source' / name] + for prefix in [PACKET / 'forgejo-source', PACKET / 'preimages/forgejo', PACKET / 'recovered-source', + PACKET.parent / 'forgejo-private-input-r1/postimages/forgejo', + PACKET.parent / 'forgejo-private-input-r1/postimages/shared', + PACKET.parent / 'forgejo-required-claim-values-r1/postimages', + PACKET.parent / 'apps-operation-backend-r1/postimages']: + candidates.append(prefix / name) + for candidate in candidates: + if candidate.is_file() and sha(candidate.read_bytes()) == digest: + return str(candidate) + if name == 'services/auth/source/oauth2/access_engine.go': + text = (PACKET / 'forgejo-source' / name).read_text() + after = '''\tif authorizedParty, present := claims["azp"]; present { +\t\tif azp, ok := authorizedParty.(string); !ok || azp != a.Audience { +\t\t\treturn out, errApplicationDecision +\t\t} +\t} else if len(aud) > 1 { +\t\treturn out, errApplicationDecision +\t}''' + before = '''\tif len(aud) > 1 { +\t\tif azp, ok := claims["azp"].(string); !ok || azp != a.Audience { +\t\t\treturn out, errApplicationDecision +\t\t} +\t}''' + assert after in text + if sha(text.replace(after, before).encode()) == digest: + return 'Exact reconstructed public source before the retained authorized-party correction' + raise AssertionError('Unverified consumer source digest: ' + name) + + +prepared = [] +for row in findings: + file = ROOT / row['path'] + raw = file.read_bytes() + data = json.loads(raw) + lines = raw.decode().splitlines(keepends=True) + modifications = [] + for finding in row['redacted_findings']: + assert finding['RuleID'] == 'generic-api-key' and finding['StartLine'] == finding['EndLine'] + index = finding['StartLine'] - 1 + entry = json.loads('{' + lines[index].strip().rstrip(',') + '}') + key, value = next(iter(entry.items())) + assert re.fullmatch('[0-9a-f]{40}|[0-9a-f]{64}', value) + prefix = 'sha256:' if len(value) == 64 else 'git:' + if file.name == 'producer-race-result.json': + assert data['public_fixture_pins'][key] == value + if key == 'secrets_source_revision': + assert subprocess.check_output(['git', '-C', '/home/worsch/secrets-engine', 'cat-file', '-t', value], text=True).strip() == 'commit' + evidence = 'Existing Secrets Engine public source commit' + else: + source = Path(data['workspace']) / 'public-fixtures' / key + assert source.is_file() and sha(source.read_bytes()) == value + evidence = str(source) + elif file.name.startswith('consumer-test-attempt'): + assert data['composed_source_pins'][key] == value + evidence = verify_consumer_source(key, value, data) + else: + assert file.name == 'issuer-fixture-result.json' and key == 'source_token_go_sha256' + source = subprocess.check_output(['git', '-C', '/home/worsch/key-cape', 'show', data['source_commit'] + ':src/internal/server/oidc/token.go']) + assert sha(source) == value + evidence = 'Verified KeyCape public source at the revision recorded in issuer-fixture-result.json' + quoted = json.dumps(value) + assert lines[index].count(quoted) == 1 + lines[index] = lines[index].replace(quoted, json.dumps(prefix + value)) + modifications.append({'line': index + 1, 'key': key, 'type': prefix[:-1], 'verified_against': evidence}) + published = ''.join(lines).encode() + restored = published.decode().splitlines(keepends=True) + for change in modifications: + index = change['line'] - 1 + entry = json.loads('{' + restored[index].strip().rstrip(',') + '}') + typed = entry[change['key']] + restored[index] = restored[index].replace(json.dumps(typed), json.dumps(typed.split(':', 1)[1])) + assert ''.join(restored).encode() == raw + prepared.append((file, raw, published, {'path': row['path'], 'blocked_blob': row['blob'], + 'original_sha256': 'sha256:' + sha(raw), 'published_sha256': 'sha256:' + sha(published), + 'changes': modifications, 'original_byte_exact_reconstructed': True})) + +# Complete verification precedes all writes. Original frozen receipts stay local. +backup = HERE / 'original-metadata' +backup.mkdir() +for file, raw, published, row in prepared: + (backup / file.name).write_bytes(raw) + file.write_bytes(published) +(HERE / 'public-metadata-derivation.json').write_text(json.dumps({'scope': 'Verified public code-file digests and one public Git revision only', + 'scanner_rules_or_allowlists_changed': False, 'credential_values_transformed': False, + 'originals_preserved_locally': True, 'records': [row for _, _, _, row in prepared]}, indent=2) + '\n') +print(json.dumps({'verified_records': len(prepared), 'verified_public_identifiers': sum(len(row['changes']) for _, _, _, row in prepared), 'credential_values_transformed': False})) diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/first-commit-refusal.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/first-commit-refusal.json new file mode 100644 index 0000000..14c892a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/first-commit-refusal.json @@ -0,0 +1,7 @@ +{ + "chunk_id": "d63574", + "wall_time_seconds": 0.000011696, + "exit_code": 1, + "original_token_count": 98, + "output": "{\"blocked_blob_ids\": [\"6d7bc9cb1ad8321b4133d42538e2690a9cd9715c\", \"7bb6c37b3765646b5f61a90c2e08e0c57145725d\", \"ca6b81ce6d8a0a4aee73ebb44017d43eec0db388\", \"cd8906e2f8655d3d840136108e5c0e8d9342baa4\"], \"scanned_blobs\": 21, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"blocked\"}\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json new file mode 100644 index 0000000..fdcd2ac --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json @@ -0,0 +1,206 @@ +{ + "scope": "Verified public code-file digests and one public Git revision only", + "scanner_rules_or_allowlists_changed": false, + "credential_values_transformed": false, + "originals_preserved_locally": true, + "records": [ + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json", + "blocked_blob": "7bb6c37b3765646b5f61a90c2e08e0c57145725d", + "original_sha256": "sha256:117e9d757b69ee0b68986276a6fdbac55cdbba9e2f32697ccc1e435e5668b14b", + "published_sha256": "sha256:7ec4d209bb6cb60e4e50d7d18f968a969687adf0364a529c72edf68905779930", + "changes": [ + { + "line": 132, + "key": "python/yaml/tokens.py", + "type": "sha256", + "verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/python/yaml/tokens.py" + }, + { + "line": 137, + "key": "secrets-engine/src/secrets_engine/approval_auth.py", + "type": "sha256", + "verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/approval_auth.py" + }, + { + "line": 148, + "key": "secrets-engine/src/secrets_engine/engine_auth.py", + "type": "sha256", + "verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/engine_auth.py" + }, + { + "line": 168, + "key": "secrets-engine/src/secrets_engine/secret_use.py", + "type": "sha256", + "verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/secret_use.py" + }, + { + "line": 169, + "key": "secrets-engine/src/secrets_engine/service_auth.py", + "type": "sha256", + "verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/service_auth.py" + }, + { + "line": 174, + "key": "secrets_source_revision", + "type": "git", + "verified_against": "Existing Secrets Engine public source commit" + } + ], + "original_byte_exact_reconstructed": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json", + "blocked_blob": "cd8906e2f8655d3d840136108e5c0e8d9342baa4", + "original_sha256": "sha256:07957ced6417b02f2be1d1594f7fcc91b01667c51cbaa868f2f5fd8cd2fd5a1d", + "published_sha256": "sha256:f35955bab3b36750b2a9930b89e376d1582c083fa6bd7bad0dc4c6462da74dd4", + "changes": [ + { + "line": 115, + "key": "cmd/admin_auth_oauth.go", + "type": "sha256", + "verified_against": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/cmd/admin_auth_oauth.go" + }, + { + "line": 116, + "key": "cmd/admin_auth_oauth_secret_linux.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux.go" + }, + { + "line": 117, + "key": "cmd/admin_auth_oauth_secret_linux_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux_test.go" + }, + { + "line": 118, + "key": "cmd/admin_auth_oauth_secret_other.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_other.go" + }, + { + "line": 129, + "key": "routers/web/admin/auths.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/admin/auths.go" + }, + { + "line": 130, + "key": "routers/web/auth/oauth.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/auth/oauth.go" + }, + { + "line": 131, + "key": "services/auth/source/oauth2/access_engine.go", + "type": "sha256", + "verified_against": "Exact reconstructed public source before the retained authorized-party correction" + }, + { + "line": 132, + "key": "services/auth/source/oauth2/access_engine_azp_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_azp_test.go" + }, + { + "line": 134, + "key": "services/auth/source/oauth2/access_engine_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_test.go" + }, + { + "line": 140, + "key": "services/forms/auth_form.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/forms/auth_form.go" + } + ], + "original_byte_exact_reconstructed": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json", + "blocked_blob": "ca6b81ce6d8a0a4aee73ebb44017d43eec0db388", + "original_sha256": "sha256:d6dd1c27ccd758ccc68e936fde69ea118a38e47cd9002fbee7d2957be4a71795", + "published_sha256": "sha256:7721bf00e3e9b1494b6d37bc2296efe0030f5acaeb4b6f4f07fec7ba3518b8a4", + "changes": [ + { + "line": 115, + "key": "cmd/admin_auth_oauth.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth.go" + }, + { + "line": 116, + "key": "cmd/admin_auth_oauth_secret_linux.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux.go" + }, + { + "line": 117, + "key": "cmd/admin_auth_oauth_secret_linux_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux_test.go" + }, + { + "line": 118, + "key": "cmd/admin_auth_oauth_secret_other.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_other.go" + }, + { + "line": 130, + "key": "routers/web/admin/auths.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/admin/auths.go" + }, + { + "line": 131, + "key": "routers/web/auth/oauth.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/auth/oauth.go" + }, + { + "line": 132, + "key": "services/auth/source/oauth2/access_engine.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine.go" + }, + { + "line": 133, + "key": "services/auth/source/oauth2/access_engine_azp_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_azp_test.go" + }, + { + "line": 135, + "key": "services/auth/source/oauth2/access_engine_test.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_test.go" + }, + { + "line": 141, + "key": "services/forms/auth_form.go", + "type": "sha256", + "verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/forms/auth_form.go" + } + ], + "original_byte_exact_reconstructed": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json", + "blocked_blob": "6d7bc9cb1ad8321b4133d42538e2690a9cd9715c", + "original_sha256": "sha256:856427415cb681e2d1ad2462ef7e61cb0a380e934f5b123150c5dc4100bb7e2e", + "published_sha256": "sha256:dc42ce04fa3744604005f13d9c2b644c087c8af46463edc3551203014bca8813", + "changes": [ + { + "line": 5, + "key": "source_token_go_sha256", + "type": "sha256", + "verified_against": "Verified KeyCape public source at the revision recorded in issuer-fixture-result.json" + } + ], + "original_byte_exact_reconstructed": true + } + ] +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/redacted-scanner-findings.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/redacted-scanner-findings.json new file mode 100644 index 0000000..c8ccdc5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/redacted-scanner-findings.json @@ -0,0 +1,161 @@ +[ + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json", + "blob": "7bb6c37b3765646b5f61a90c2e08e0c57145725d", + "redacted_findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 132, + "EndLine": 132 + }, + { + "RuleID": "generic-api-key", + "StartLine": 137, + "EndLine": 137 + }, + { + "RuleID": "generic-api-key", + "StartLine": 148, + "EndLine": 148 + }, + { + "RuleID": "generic-api-key", + "StartLine": 168, + "EndLine": 168 + }, + { + "RuleID": "generic-api-key", + "StartLine": 169, + "EndLine": 169 + }, + { + "RuleID": "generic-api-key", + "StartLine": 174, + "EndLine": 174 + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json", + "blob": "cd8906e2f8655d3d840136108e5c0e8d9342baa4", + "redacted_findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 115, + "EndLine": 115 + }, + { + "RuleID": "generic-api-key", + "StartLine": 116, + "EndLine": 116 + }, + { + "RuleID": "generic-api-key", + "StartLine": 117, + "EndLine": 117 + }, + { + "RuleID": "generic-api-key", + "StartLine": 118, + "EndLine": 118 + }, + { + "RuleID": "generic-api-key", + "StartLine": 129, + "EndLine": 129 + }, + { + "RuleID": "generic-api-key", + "StartLine": 130, + "EndLine": 130 + }, + { + "RuleID": "generic-api-key", + "StartLine": 131, + "EndLine": 131 + }, + { + "RuleID": "generic-api-key", + "StartLine": 132, + "EndLine": 132 + }, + { + "RuleID": "generic-api-key", + "StartLine": 134, + "EndLine": 134 + }, + { + "RuleID": "generic-api-key", + "StartLine": 140, + "EndLine": 140 + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json", + "blob": "ca6b81ce6d8a0a4aee73ebb44017d43eec0db388", + "redacted_findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 115, + "EndLine": 115 + }, + { + "RuleID": "generic-api-key", + "StartLine": 116, + "EndLine": 116 + }, + { + "RuleID": "generic-api-key", + "StartLine": 117, + "EndLine": 117 + }, + { + "RuleID": "generic-api-key", + "StartLine": 118, + "EndLine": 118 + }, + { + "RuleID": "generic-api-key", + "StartLine": 130, + "EndLine": 130 + }, + { + "RuleID": "generic-api-key", + "StartLine": 131, + "EndLine": 131 + }, + { + "RuleID": "generic-api-key", + "StartLine": 132, + "EndLine": 132 + }, + { + "RuleID": "generic-api-key", + "StartLine": 133, + "EndLine": 133 + }, + { + "RuleID": "generic-api-key", + "StartLine": 135, + "EndLine": 135 + }, + { + "RuleID": "generic-api-key", + "StartLine": 141, + "EndLine": 141 + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json", + "blob": "6d7bc9cb1ad8321b4133d42538e2690a9cd9715c", + "redacted_findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 5, + "EndLine": 5 + } + ] + } +] diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/second-redacted-scanner-findings.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/second-redacted-scanner-findings.json new file mode 100644 index 0000000..31d93b6 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/second-redacted-scanner-findings.json @@ -0,0 +1,14 @@ +{ + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json", + "blob": "d29533ee292929c085387963323367f26a6ac15d", + "findings": [ + { + "RuleID": "generic-api-key", + "StartLine": 200, + "EndLine": 200 + } + ], + "classification": "Verified public KeyCape Git revision redundantly embedded in explanatory prose. Exact revision remains in the referenced issuer receipt; source and digests unchanged.", + "refinement": "Use an explicit reference to the existing source revision field instead of duplicating the public commit in prose.", + "scanner_changed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/commit-terminal-result.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/commit-terminal-result.json new file mode 100644 index 0000000..598bbdf --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/commit-terminal-result.json @@ -0,0 +1,7 @@ +{ + "chunk_id": "a4953e", + "wall_time_seconds": 0.000009901, + "exit_code": 0, + "original_token_count": 88, + "output": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 2, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n[main 614f632] Record implemented producer client and actual issuer compatibility work\n 2 files changed, 69 insertions(+), 1 deletion(-)\n" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/local-chain-validation.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/local-chain-validation.json new file mode 100644 index 0000000..aa2d831 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/local-chain-validation.json @@ -0,0 +1,6 @@ +{ + "local_base": "af81f354adde344cf271035082da8bd2c598449c", + "remote_base": "33a7815e7bd8480dc7cf7b0167058f659cf3ea6f", + "preceding_capsule_verified": true, + "reason": "Stack the bounded local source commits before the required final consistency sync; preserve the exact-normal remote guard refusal." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/preparation-refinement.json b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/preparation-refinement.json new file mode 100644 index 0000000..f8fe95d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/preparation-refinement.json @@ -0,0 +1,4 @@ +{ + "original_preparation": "Aggregate selected bytes exceeded conservative 260000-byte preparation bound; manifest was not written. Subsequent publication call refused before staging due to missing manifest. No source/index/commit changed.", + "refinement": "Publish two existing workplan/implementation documents first, then the separate bounded evidence set. Normal scanner and hooks remain unchanged." +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer-before.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer-before.json new file mode 100644 index 0000000..42ab7a8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer-before.json @@ -0,0 +1,121 @@ +{ + "returncode": 1, + "seconds": 4.88, + "workspace": "/tmp/custodian-forgejo-wire-9wx2syhq", + "argv": [ + "bwrap", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--unshare-net", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod/cache/download", + "/cached", + "--ro-bind", + "/etc/ssl/certs", + "/etc/ssl/certs", + "--ro-bind", + "/etc/resolv.conf", + "/etc/resolv.conf", + "--chdir", + "/work/source", + "--clearenv", + "--dir", + "/run", + "--ro-bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/forgejo-oidc", + "--bind", + "/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures", + "/run/writable-input", + "--setenv", + "PATH", + "/work/go/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOPATH", + "/work/gopath", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOVCS", + "*:off", + "--setenv", + "GOMODCACHE", + "/work/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "1", + "--setenv", + "GIT_CONFIG_NOSYSTEM", + "1", + "--setenv", + "GIT_CONFIG_GLOBAL", + "/work/home/test.gitconfig", + "--setenv", + "GIT_TERMINAL_PROMPT", + "0", + "--ro-bind", + "/tmp/custodian-forgejo-wire-9wx2syhq/oauth2", + "/work/source/services/auth/source/oauth2", + "--ro-bind", + "/tmp/custodian-keycape-wire-rsi4f6hj/identity.json", + "/work/keycape-wire-fixture.json", + "--setenv", + "CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE", + "/work/keycape-wire-fixture.json", + "--", + "go", + "test", + "-p", + "1", + "-json", + "-tags", + "sqlite sqlite_unlock_notify", + "./services/auth/source/oauth2", + "-run", + "^TestAccessEngineActualKeyCapeIssuer$", + "-count=1" + ], + "actual_issuer_source": "d803e9282a47b49daf930fb905312fa5104c0ace", + "fixture_sha256": "f7ab0b865db577588ca100deb9f11d27c3e947f980961cd9a359c2eadfe394ec", + "fixture_values_published": false, + "synthetic_authentication": true, + "real_credentials": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer_wire_test.go b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer_wire_test.go new file mode 100644 index 0000000..aaa64af --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer_wire_test.go @@ -0,0 +1,38 @@ +package oauth2 + +import ( + "encoding/json" + "os" + "testing" + "time" +) + +func TestAccessEngineActualKeyCapeIssuer(t *testing.T) { + raw, err := os.ReadFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE")) + if err != nil { + t.Fatal("actual issuer fixture unavailable") + } + var fixture struct { + Token string `json:"id_token"` + Key string `json:"public_key_pem"` + Kid string `json:"kid"` + Issuer string `json:"issuer"` + Audience string `json:"audience"` + } + if json.Unmarshal(raw, &fixture) != nil { + t.Fatal("actual issuer fixture malformed") + } + admission, _, _, _ := identityFixture(t) + admission.Issuer = fixture.Issuer + admission.Audience = fixture.Audience + admission.AssuranceClaim = "assurance" + admission.Algorithms = []string{"RS256"} + admission.IdentityKeys = map[string]string{fixture.Kid: fixture.Key} + identity, err := VerifyApplicationIdentity(fixture.Token, admission, time.Now().UTC()) + if err != nil { + t.Fatal("actual KeyCape token rejected by consumer", err) + } + if identity.Subject != "user:synthetic" || identity.Tenant != "tenant:synthetic" || identity.Assurance != "aal2" { + t.Fatal("actual issuer identity snapshot mismatch") + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json new file mode 100644 index 0000000..03fc465 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json @@ -0,0 +1,88 @@ +{ + "returncode": 0, + "seconds": 21.09, + "source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace", + "source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3", + "workspace": "/tmp/custodian-keycape-wire-rsi4f6hj", + "argv": [ + "bwrap", + "--unshare-net", + "--unshare-pid", + "--die-with-parent", + "--new-session", + "--ro-bind", + "/usr", + "/usr", + "--ro-bind", + "/lib", + "/lib", + "--ro-bind", + "/lib64", + "/lib64", + "--symlink", + "usr/bin", + "/bin", + "--proc", + "/proc", + "--dev", + "/dev", + "--tmpfs", + "/tmp", + "--bind", + "/tmp/custodian-keycape-wire-rsi4f6hj", + "/work", + "--ro-bind", + "/home/worsch/go/pkg/mod", + "/modules", + "--ro-bind", + "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64", + "/toolchain", + "--chdir", + "/work/src", + "--clearenv", + "--setenv", + "PATH", + "/toolchain/bin:/usr/bin:/bin", + "--setenv", + "HOME", + "/work/home", + "--setenv", + "GOTOOLCHAIN", + "local", + "--setenv", + "GOPROXY", + "off", + "--setenv", + "GOSUMDB", + "off", + "--setenv", + "GOMODCACHE", + "/modules", + "--setenv", + "GOCACHE", + "/work/gocache", + "--setenv", + "GOMAXPROCS", + "4", + "--setenv", + "CGO_ENABLED", + "0", + "--setenv", + "CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE", + "/work/identity.json", + "--", + "go", + "test", + "-p", + "4", + "-json", + "./internal/server/oidc", + "-run", + "^TestCustodianForgejoIssuerFixture$", + "-count=1" + ], + "synthetic_authentication": true, + "real_credentials": false, + "fixture_values_published": false, + "fixture_sha256": "f7ab0b865db577588ca100deb9f11d27c3e947f980961cd9a359c2eadfe394ec" +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer_fixture_test.go b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer_fixture_test.go new file mode 100644 index 0000000..cb0d4f2 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer_fixture_test.go @@ -0,0 +1,66 @@ +package oidc_test + +import ( + "crypto/x509" + "encoding/json" + "encoding/pem" + "net/http" + "net/http/httptest" + "net/url" + "os" + "testing" + "time" + + "keycape/internal/domain" + "keycape/internal/server/oidc" +) + +// This runs the actual token endpoint and serializer. Authentication and its key +// are synthetic; neither the fixture nor this test proves an attended MFA flow. +func TestCustodianForgejoIssuerFixture(t *testing.T) { + users := &mockUserRepo{users: map[string]*domain.User{"alice": { + ID: "user:synthetic", Username: "alice", Enabled: true, + Tenant: "tenant:synthetic", Groups: []string{"forge-admins"}, + }}} + sessions := oidc.NewSessionStore() + verifier, _ := makeVerifierAndChallenge() + code := seededSession(sessions, verifier) + session, ok := sessions.Get(code) + if !ok { + t.Fatal("fixture session missing") + } + session.MFAVerified = true // Explicit synthetic upstream authentication. + session.AuthTime = time.Now().Add(-10 * time.Second) + handler, key := newTokenHandler(t, sessions, users) + handler.Issuer = "https://issuer.invalid" + handler.ClientConfig["test-client"].ClientType = "confidential" + handler.ClientConfig["test-client"].ClientSecret = "synthetic-issuer-client" + request := tokenRequest(url.Values{"grant_type": {"authorization_code"}, "code": {code}, "client_id": {"test-client"}, "code_verifier": {verifier}}) + request.SetBasicAuth("test-client", "synthetic-issuer-client") + response := httptest.NewRecorder() + handler.ServeHTTP(response, request) + if response.Code != http.StatusOK { + t.Fatal("actual issuer fixture refused", response.Code) + } + var body struct { + IDToken string `json:"id_token"` + } + if json.Unmarshal(response.Body.Bytes(), &body) != nil || body.IDToken == "" { + t.Fatal("actual issuer ID token missing") + } + public, err := x509.MarshalPKIXPublicKey(&key.PublicKey) + if err != nil { + t.Fatal(err) + } + fixture := map[string]any{"id_token": body.IDToken, + "public_key_pem": string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: public})), + "kid": "key-1", "issuer": handler.Issuer, "audience": "test-client", + "synthetic_authentication": true, "real_credentials": false} + raw, err := json.Marshal(fixture) + if err != nil { + t.Fatal(err) + } + if err := os.WriteFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE"), raw, 0600); err != nil { + t.Fatal("fixture output unavailable") + } +} diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/produce_fixture.py b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/produce_fixture.py new file mode 100644 index 0000000..397312f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/produce_fixture.py @@ -0,0 +1,46 @@ +"""Generate a private synthetic identity through the committed actual issuer.""" +from pathlib import Path +import hashlib +import io +import json +import shutil +import subprocess +import tarfile +import tempfile +import time + +HERE = Path(__file__).resolve().parent +OWNER = Path('/home/worsch/key-cape') +WORK = Path(tempfile.mkdtemp(prefix='custodian-keycape-wire-')) +revision = subprocess.check_output(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'], text=True).strip() +archive = subprocess.check_output(['git', '-C', str(OWNER), 'archive', revision, 'src']) +with tarfile.open(fileobj=io.BytesIO(archive)) as tar: + tar.extractall(WORK, filter='data') +shutil.copyfile(HERE / 'issuer_fixture_test.go', WORK / 'src/internal/server/oidc/custodian_fixture_test.go') +(WORK / 'home').mkdir() +argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session'] +for name in ['/usr', '/lib', '/lib64']: + argv += ['--ro-bind', name, name] +argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp', + '--bind', str(WORK), '/work', '--ro-bind', '/home/worsch/go/pkg/mod', '/modules', + '--ro-bind', '/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64', '/toolchain', + '--chdir', '/work/src', '--clearenv'] +for key, value in {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOTOOLCHAIN': 'local', + 'GOPROXY': 'off', 'GOSUMDB': 'off', 'GOMODCACHE': '/modules', 'GOCACHE': '/work/gocache', + 'GOMAXPROCS': '4', 'CGO_ENABLED': '0', + 'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE': '/work/identity.json'}.items(): + argv += ['--setenv', key, value] +argv += ['--', 'go', 'test', '-p', '4', '-json', './internal/server/oidc', '-run', '^TestCustodianForgejoIssuerFixture$', '-count=1'] +assert not (HERE / 'issuer-fixture-result.json').exists() +started = time.monotonic() +with (HERE / 'issuer-fixture.jsonl').open('xb') as log: + result = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=300) +receipt = {'returncode': result.returncode, 'seconds': round(time.monotonic() - started, 2), + 'source_commit': revision, 'source_token_go_sha256': hashlib.sha256((WORK / 'src/internal/server/oidc/token.go').read_bytes()).hexdigest(), + 'workspace': str(WORK), 'argv': argv, 'synthetic_authentication': True, 'real_credentials': False, + 'fixture_values_published': False} +if result.returncode == 0: + receipt['fixture_sha256'] = hashlib.sha256((WORK / 'identity.json').read_bytes()).hexdigest() +(HERE / 'issuer-fixture-result.json').write_text(json.dumps(receipt, indent=2) + '\n') +print(json.dumps({'returncode': result.returncode, 'source_commit': revision, 'fixture_values_published': False})) +raise SystemExit(result.returncode) diff --git a/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/run_consumer_wire.py b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/run_consumer_wire.py new file mode 100644 index 0000000..806d651 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/run_consumer_wire.py @@ -0,0 +1,37 @@ +"""Check the actual issued token in a separate copy of the consumer package.""" +from pathlib import Path +import hashlib +import json +import shutil +import subprocess +import tempfile +import time + +HERE = Path(__file__).resolve().parent +ROOT = HERE.parents[3] +BASE = ROOT / 'docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2' +WORK = Path(tempfile.mkdtemp(prefix='custodian-forgejo-wire-')) +original = Path('/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2') +shutil.copytree(original, WORK / 'oauth2') +shutil.copyfile(HERE / 'consumer_wire_test.go', WORK / 'oauth2/keycape_wire_test.go') +issued = json.loads((HERE / 'issuer-fixture-result.json').read_text()) +assert issued['returncode'] == 0 +fixture = Path(issued['workspace']) / 'identity.json' +assert hashlib.sha256(fixture.read_bytes()).hexdigest() == issued['fixture_sha256'] +prior = json.loads((BASE / 'consumer-test-attempt6.json').read_text()) +argv = prior['argv'][:prior['argv'].index('--')] +argv += ['--ro-bind', str(WORK / 'oauth2'), '/work/source/services/auth/source/oauth2', + '--ro-bind', str(fixture), '/work/keycape-wire-fixture.json', + '--setenv', 'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE', '/work/keycape-wire-fixture.json'] +argv += ['--', 'go', 'test', '-p', '1', '-json', '-tags', 'sqlite sqlite_unlock_notify', + './services/auth/source/oauth2', '-run', '^TestAccessEngineActualKeyCapeIssuer$', '-count=1'] +assert not (HERE / 'consumer-before.json').exists() +started = time.monotonic() +with (HERE / 'consumer-before.jsonl').open('xb') as log: + run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=180) +(HERE / 'consumer-before.json').write_text(json.dumps({'returncode': run.returncode, + 'seconds': round(time.monotonic() - started, 2), 'workspace': str(WORK), 'argv': argv, + 'actual_issuer_source': issued['source_commit'], 'fixture_sha256': issued['fixture_sha256'], + 'fixture_values_published': False, 'synthetic_authentication': True, 'real_credentials': False}, indent=2) + '\n') +print(json.dumps({'returncode': run.returncode, 'actual_issuer_source': issued['source_commit'], 'fixture_values_published': False})) +raise SystemExit(run.returncode)