coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Retain completion audit and verified public source evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 9s
Details

Browse source
This commit is contained in:
codex 2026-10-18 02:03:59 +02:00
parent 614f6321c7
commit aae10f5bbb
26 changed files with 4245 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/cli-attempt1-result.json Normal file
View file

@ -0,0 +1,7 @@
{
"returncode": 1,
"failure": "Composed marked DB context returns xorm.Session; CLI asserted xorm.Engine and rejected valid LOG_SQL=false operation before mutation.",
"real_credentials": false,
"source_binary_build": "consumer-build-attempt1.json",
"details": "Original CLI script and isolated workspace retained; no production database or credentials used."
}

155
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json Normal file
View file

@ -0,0 +1,155 @@
{
"returncode": 1,
"seconds": 23.13,
"argv": [
"bwrap",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--unshare-net",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/cache/download",
"/cached",
"--ro-bind",
"/etc/ssl/certs",
"/etc/ssl/certs",
"--ro-bind",
"/etc/resolv.conf",
"/etc/resolv.conf",
"--chdir",
"/work/source",
"--clearenv",
"--dir",
"/run",
"--ro-bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/forgejo-oidc",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/writable-input",
"--setenv",
"PATH",
"/work/go/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOPATH",
"/work/gopath",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOVCS",
"*:off",
"--setenv",
"GOMODCACHE",
"/work/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"1",
"--setenv",
"GIT_CONFIG_NOSYSTEM",
"1",
"--setenv",
"GIT_CONFIG_GLOBAL",
"/work/home/test.gitconfig",
"--setenv",
"GIT_TERMINAL_PROMPT",
"0",
"--",
"go",
"test",
"-p",
"1",
"-json",
"-tags",
"sqlite sqlite_unlock_notify",
"./services/auth/source/oauth2",
"./cmd",
"./models/auth",
"./models/db",
"-run",
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQLHooks",
"-count=1"
],
"workspace": "/tmp/custodian-forgejo-successor-attempt2",
"module_hashes": {
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
},
"composed_source_pins": {
"cmd/admin_auth_oauth.go": "sha256:c01084dd631937e3cd1d08593e7090d44661c6cba2838e217bdadbbc5f3c29d9",
"cmd/admin_auth_oauth_secret_linux.go": "sha256:6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b",
"cmd/admin_auth_oauth_secret_linux_test.go": "sha256:b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2",
"cmd/admin_auth_oauth_secret_other.go": "sha256:54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d",
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
"models/auth/source_operation.go": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31",
"models/auth/source_operation_internal_test.go": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb",
"models/auth/source_operation_process_test.go": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd",
"models/auth/source_operation_test.go": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428",
"models/db/context.go": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7",
"models/db/engine.go": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96",
"models/db/sensitive_sql.go": "8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e",
"models/db/sensitive_sql_test.go": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b",
"routers/web/admin/auths.go": "sha256:3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923",
"routers/web/auth/oauth.go": "sha256:58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17",
"services/auth/source/oauth2/access_engine.go": "sha256:8c34f864419f42ef6f2f7cba55afc8f5cd82af350e2186ed49fc8c7f18da886e",
"services/auth/source/oauth2/access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
"services/auth/source/oauth2/access_engine_callback_test.go": "e2fcbfcc2f1077996c947c5c6fd5150aaaa11ba0e77e05f07055a355978398be",
"services/auth/source/oauth2/access_engine_test.go": "sha256:0552719648e821243c5c6f887359a724c1440cd077e435f15a444bd3c99da888",
"services/auth/source/oauth2/providers_openid.go": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
"services/auth/source/oauth2/required_claim_values.go": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
"services/auth/source/oauth2/required_claim_values_test.go": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
"services/auth/source/oauth2/source.go": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
"services/auth/source/oauth2/source_callout.go": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
"services/forms/auth_form.go": "sha256:026720f23cbdb5e54f8c594109c2dc306b87e323cc649df5fa3194f609cd7737",
"third_party/access-engine-pep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
"third_party/access-engine-pep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
"third_party/access-engine-pep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
"third_party/access-engine-pep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
"third_party/access-engine-pep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
"third_party/access-engine-pep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
"third_party/access-engine-pep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"third_party/access-engine-pep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
"third_party/access-engine-pep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
"third_party/access-engine-pep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
"network": "disabled",
"pid_namespace": "private",
"real_credentials": false
}

156
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json Normal file
View file

@ -0,0 +1,156 @@
{
"returncode": 0,
"seconds": 29.72,
"argv": [
"bwrap",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--unshare-net",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/cache/download",
"/cached",
"--ro-bind",
"/etc/ssl/certs",
"/etc/ssl/certs",
"--ro-bind",
"/etc/resolv.conf",
"/etc/resolv.conf",
"--chdir",
"/work/source",
"--clearenv",
"--dir",
"/run",
"--ro-bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/forgejo-oidc",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/writable-input",
"--setenv",
"PATH",
"/work/go/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOPATH",
"/work/gopath",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOVCS",
"*:off",
"--setenv",
"GOMODCACHE",
"/work/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"1",
"--setenv",
"GIT_CONFIG_NOSYSTEM",
"1",
"--setenv",
"GIT_CONFIG_GLOBAL",
"/work/home/test.gitconfig",
"--setenv",
"GIT_TERMINAL_PROMPT",
"0",
"--",
"go",
"test",
"-p",
"1",
"-json",
"-tags",
"sqlite sqlite_unlock_notify",
"./services/auth/source/oauth2",
"./cmd",
"./models/auth",
"./models/db",
"-run",
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQL",
"-count=1"
],
"workspace": "/tmp/custodian-forgejo-successor-attempt2",
"module_hashes": {
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
},
"composed_source_pins": {
"cmd/admin_auth_oauth.go": "sha256:d718d817c46f6393488a9c5a894b7535640cd0ec1a1ae3f72f8411a2bbec3b38",
"cmd/admin_auth_oauth_secret_linux.go": "sha256:6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b",
"cmd/admin_auth_oauth_secret_linux_test.go": "sha256:b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2",
"cmd/admin_auth_oauth_secret_other.go": "sha256:54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d",
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
"models/auth/source_operation.go": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31",
"models/auth/source_operation_internal_test.go": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb",
"models/auth/source_operation_process_test.go": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd",
"models/auth/source_operation_test.go": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428",
"models/db/context.go": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7",
"models/db/engine.go": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96",
"models/db/sensitive_sql.go": "06a298d0d6e628e6920384d4ddeef449e40c090841ebaa3f6d175725a45ae584",
"models/db/sensitive_sql_logging_test.go": "d924b35d30686473caf29601cf51cc363ba68158cb4ef0981c9e2fc7b03c04b7",
"models/db/sensitive_sql_test.go": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b",
"routers/web/admin/auths.go": "sha256:3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923",
"routers/web/auth/oauth.go": "sha256:58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17",
"services/auth/source/oauth2/access_engine.go": "sha256:851dc8712c883ec2f3135406cdce58d7adf733c0f79501e2594e41646faf28a2",
"services/auth/source/oauth2/access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
"services/auth/source/oauth2/access_engine_callback_test.go": "e2fcbfcc2f1077996c947c5c6fd5150aaaa11ba0e77e05f07055a355978398be",
"services/auth/source/oauth2/access_engine_test.go": "sha256:0552719648e821243c5c6f887359a724c1440cd077e435f15a444bd3c99da888",
"services/auth/source/oauth2/providers_openid.go": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
"services/auth/source/oauth2/required_claim_values.go": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
"services/auth/source/oauth2/required_claim_values_test.go": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
"services/auth/source/oauth2/source.go": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
"services/auth/source/oauth2/source_callout.go": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
"services/forms/auth_form.go": "sha256:026720f23cbdb5e54f8c594109c2dc306b87e323cc649df5fa3194f609cd7737",
"third_party/access-engine-pep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
"third_party/access-engine-pep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
"third_party/access-engine-pep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
"third_party/access-engine-pep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
"third_party/access-engine-pep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
"third_party/access-engine-pep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
"third_party/access-engine-pep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"third_party/access-engine-pep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
"third_party/access-engine-pep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
"third_party/access-engine-pep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
"network": "disabled",
"pid_namespace": "private",
"real_credentials": false
}

76
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-export-test.json Normal file
View file

@ -0,0 +1,76 @@
{
"returncode": 0,
"seconds": 1.02,
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-resume-producer-all-i56scyc5",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--chdir",
"/work/source",
"--clearenv",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"0",
"--",
"go",
"test",
"-p",
"4",
"-json",
"./pkg/decisionpep",
"-count=1"
]
}

80
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-layer-check.json Normal file
View file

@ -0,0 +1,80 @@
{
"returncode": 0,
"seconds": 14.63,
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-resume-producer-race-oa_wz3sd",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--chdir",
"/work/source",
"--clearenv",
"--ro-bind",
"/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine",
"/home/worsch/secrets-engine",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"1",
"--setenv",
"PYTHONPATH",
"/work/public-fixtures/python",
"--",
"go",
"run",
"./tools/check_layer_conformance.go"
],
"stdout": "Validated against: net-kingdom/canon/standards/security-layer-model_v0.8.md (sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)\nScope: this repository only \u2014 source/INTENT.md frontmatter (the \u00a711 declaration), optional derived layer.yaml/layer.yml declarations, the files INTENT names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\nPASS \u2014 Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.\n",
"stderr": ""
}

176
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json Normal file
View file

@ -0,0 +1,176 @@
{
"target": "producer-race",
"source_revision": "d328a2601095686f74376d87791bff01e2a3a2a3",
"returncode": 0,
"seconds": 130.97,
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-resume-producer-race-oa_wz3sd",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--chdir",
"/work/source",
"--clearenv",
"--ro-bind",
"/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine",
"/home/worsch/secrets-engine",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"1",
"--setenv",
"PYTHONPATH",
"/work/public-fixtures/python",
"--",
"go",
"test",
"-race",
"-p",
"4",
"-json",
"./...",
"-count=1"
],
"workspace": "/tmp/custodian-resume-producer-race-oa_wz3sd",
"network": "disabled",
"pid_namespace": "private",
"real_credentials": false,
"canonical_owner_modified": false,
"candidate_files": {
"adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
"adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
"adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
"adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
"adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
"adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
"adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"adapters/go/decisionpep/pkg/decisionpep/client_test.go": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62",
"adapters/go/decisionpep/producer-source.json": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb",
"adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29",
"cmd/access-engine/forgejo_application_profile_test.go": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe",
"cmd/access-engine/main.go": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d",
"examples/forgejo-application-access/policy.md": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac",
"examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
"examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
"internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d",
"internal/decision/json_profile.go": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f",
"pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"pkg/decisionpep/client_test.go": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62",
"pkg/decisionpep/export_test.go": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843",
"testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29",
"tools/export_decisionpep_adapter.py": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1"
},
"public_fixture_pins": {
"python/yaml/__init__.py": "b19dfcc333d6a75dfd73073901164507252f271b41d3b5f7d85510033a0547a7",
"python/yaml/_yaml.cpython-312-x86_64-linux-gnu.so": "957a099a4521c1f7669306fb6f79ca63fa4b9a0b4c463f7cac833a65a5c5c0cb",
"python/yaml/composer.py": "fcaa37d16afa783594794a5ab94193dcb720f503c19ce3d59539c8311189f453",
"python/yaml/constructor.py": "90d8247da78b524c10618fd0e857f54f3d97570fe91b5c5513d024ef3faf88b0",
"python/yaml/cyaml.py": "e99ac01bd7c062f7557b614aff0d21997a06ed962ca185306a91bc0a20bbd87d",
"python/yaml/dumper.py": "3cb72d66563064ba7b5e679477046ebf89d8399d940670c8532f3e94a7cb17ea",
"python/yaml/emitter.py": "8e086d694ede170837d5b1b407b45979aff6f40762f422a65eafd08e04290a44",
"python/yaml/error.py": "021f73fada072546c4f63f8cf18a7181244ce4280b09cc15cc980b2d1176171a",
"python/yaml/events.py": "e74fd392c810884e2ea7e94aa3f57e9c1cbeb402319083d0c58e6a0e1282787c",
"python/yaml/loader.py": "5156becc8aa6905482218abf3e04869b835226db4763645fff3438fdbd5f1cdd",
"python/yaml/nodes.py": "80f28d8fca4a09d87677882bde021820d9cf39a3b11a12405226211919cf13ce",
"python/yaml/parser.py": "8a55a9e6fbe0a07146cef3990c8b45a068c3e83e369e1959ad9ca30306b4a09a",
"python/yaml/reader.py": "d1d9b38ab3a20c6e17a38d519ee412ecaf6b918df18c78956ac7c330d4ea08dc",
"python/yaml/representer.py": "22e58ff9c016f6c1ca1274b4802a926bcf78935060e1c813c5a0f021c6d143e6",
"python/yaml/resolver.py": "f4bf9561f9b89961f1503d558385fbae30d12bfed565de9bf76c33abb63620a6",
"python/yaml/scanner.py": "60433788b652690c17710460da5d91e0c753d3318fd85f5e1e42862a71f25906",
"python/yaml/serializer.py": "0a1b85826854d35863e31808f0668abfabdf33606e8f06bd8bb7761401e3edc0",
"python/yaml/tokens.py": "sha256:953408cd2570f0c83dc2fe39f7e4e388e41eeb05738aa69196a5f6ffcf6ba79e",
"secrets-engine/src/secrets_engine/__init__.py": "6536fc21988755467f71a91e79c90bf984f1ee16e696566a03cc4c1240920573",
"secrets-engine/src/secrets_engine/__main__.py": "1684b0f3f895e6450e1718ad07b0c4f461fd3608f55317887e901e85e64dea9e",
"secrets-engine/src/secrets_engine/application_time.py": "39b014bb3a42dcef82b0a5d6ed1dec27725a4a51c79d443c02996a0aebb0ff4d",
"secrets-engine/src/secrets_engine/apply.py": "df3567c914f16b450bc8654fbc76272d9c87453d56238e6a5b89c2b1360bdeba",
"secrets-engine/src/secrets_engine/approval_auth.py": "sha256:6f3b033e7928e1c527bc19f5a1e01bf243540769a8646bd8cd47268da25637b5",
"secrets-engine/src/secrets_engine/approval_claim.py": "15d20b15917ecc9d996de6d587ca2ba87e760920eb51ad64384e12f76e7e6693",
"secrets-engine/src/secrets_engine/approval_consume.py": "4e3de16ed77bca3023993065556edd635d35073668f1a3b0d079284969111d37",
"secrets-engine/src/secrets_engine/audit.py": "0a5560f462a9cd0f4fc2293ce1092915ea037d8f1102b2caf3f52011780adccd",
"secrets-engine/src/secrets_engine/authorization.py": "d58e5fd01ca2470a5d11a6b4f7e9d262a0c1565637e07b35466faa30e4991d14",
"secrets-engine/src/secrets_engine/catalog.py": "9af3a10cca7f45a201ef0567fb885d086390bc6fd2091e982ef0cd6191619514",
"secrets-engine/src/secrets_engine/cli.py": "b7f74330732fd991f080adb6d1c4ef576c81884809103812612652cafe3ee4d0",
"secrets-engine/src/secrets_engine/config.py": "228f548822620d538ad0c025eb68d88091be542819ed571be06c9e69c5e912c6",
"secrets-engine/src/secrets_engine/decision_check.py": "36d1b628963705192ab0a35e8f1e38627a9496d97826ccd8fd98c645c69e8db0",
"secrets-engine/src/secrets_engine/decision_signature.py": "74a9caa43f93aae5c9e945c0a872c0e58c83aea00e9b970a4dbda673af2df805",
"secrets-engine/src/secrets_engine/decisions.py": "7121ac833d6a9bcfd4f82de44e6c7e35fd509f3d854c0b02740a2a13f1b709fb",
"secrets-engine/src/secrets_engine/engine_auth.py": "sha256:e0479cf6d8c13233cf99dc39491143478c021597941ae8b6ba0e37957a42f330",
"secrets-engine/src/secrets_engine/errors.py": "4cd0bfdc009556b35d4359a37d797a6bacf644ca4969d46e33f60435b4bafac8",
"secrets-engine/src/secrets_engine/evidence.py": "555c7cf9915514364c69a920716846beb417b68efdc046d369192f3fa0fae59c",
"secrets-engine/src/secrets_engine/evidence_class.py": "548cec24196e819ba2551c60d4f2455de6845edefd9a61b5d7d1a8f6ecb2c379",
"secrets-engine/src/secrets_engine/exec_delivery.py": "3947c217ebba37f817501492eaee37777301d46177f74152d10a66ef65ac0b56",
"secrets-engine/src/secrets_engine/exec_owner.py": "245f3c1715fed487e941aeea66e2ba6966c10696363fda0f5d50493d2741ac12",
"secrets-engine/src/secrets_engine/execution_contract.py": "ca62bfb1716c0e882eac6512320b127405511affdc1ebd46f9496ce030c0ed01",
"secrets-engine/src/secrets_engine/handoff.py": "279cec94c14f8ea1b107cc7fd552836ff3263c3ed0054862a5fd2fa3696de023",
"secrets-engine/src/secrets_engine/lane_state.py": "28f1cc8f1830057bd4094aec645769a43d22379ea28e14a01f767078466237cb",
"secrets-engine/src/secrets_engine/lifecycle.py": "c17644356524cd83e96f58a1022638e71fa373cd338c1bf38980ed6cd45a757c",
"secrets-engine/src/secrets_engine/openbao.py": "c1d17ca30367fd2c856927e8ce4021599a992c6c22509f82a6d8d4588ea46199",
"secrets-engine/src/secrets_engine/pep_stance.py": "c4cacb4ac0c5043cf6fc062b43a6cfac06f15b662a4ed4941db10265985fb1b5",
"secrets-engine/src/secrets_engine/plan.py": "d67aaf5a6d22b4d86bab20c7f02f9cf9bf89c87888c945bddb46fb85325c84c6",
"secrets-engine/src/secrets_engine/provision.py": "f2ab4fbe0c6bcfc93fe423f74368cedb311bb6f8384674b2ef14b4015bd89a17",
"secrets-engine/src/secrets_engine/publication_policy.py": "360aca599ddc16df4efac2af45b2e341018732de665162b4fbc74b7c6c9b2b87",
"secrets-engine/src/secrets_engine/redact.py": "503ade16cefd9620c6474b6be327e75ad2487f2a76f1d42b112a6fa8c510a314",
"secrets-engine/src/secrets_engine/roles.py": "69923fe9f3a6df6503bd9e0b25cfdf34f80ce7477462cfafdb3d59a030703ffe",
"secrets-engine/src/secrets_engine/rotate.py": "9b6bed6b8ae736e525bab96d99bd0ad39a807ef10f948292a82ab1a6d86c7c80",
"secrets-engine/src/secrets_engine/routing.py": "9d5050d7494a207394ce8251d8aac574ca0c08e3252639b5f05b373d6e35a076",
"secrets-engine/src/secrets_engine/safe_paths.py": "90e31769f66f34910b562d64bebcaa3e8cea23e79678eff4d625efcefc0d4f73",
"secrets-engine/src/secrets_engine/secret_use.py": "sha256:07dc7eaa44d8e0372167e84fc9ab543614c962c36f180957579f835493012ff2",
"secrets-engine/src/secrets_engine/service_auth.py": "sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0",
"secrets-engine/src/secrets_engine/task_execution_handoff.py": "f673443dc5f3a796a09db5ad51bcdf59d83d718cc00912489dbb8d43df95aefe",
"secrets-engine/src/secrets_engine/verify.py": "a122f598e7a63756906ce8e5c75ebb1331b248ffbe445130848272afc6b8cf28",
"secrets-engine/src/secrets_engine/wrap.py": "a37c491a93c8803015d2f1fca6ea502b8da28a9279900404d8f9ebf06a0c0a70",
"intake-submitters.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
"secrets_source_revision": "git:691dc742362eeec45d5bd32d2b468f31a959748e"
}
}

99
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-after.json Normal file
View file

@ -0,0 +1,99 @@
{
"returncode": 0,
"seconds": 1.07,
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-resume-producer-all-i56scyc5",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--chdir",
"/work/source",
"--clearenv",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"0",
"--",
"go",
"test",
"-p",
"4",
"-json",
"./cmd/access-engine",
"-run",
"^TestForgejoActualPolicySignedLosslessAndLegacy$",
"-count=1"
],
"source_pins": {
"internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d",
"internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc",
"cmd/access-engine/forgejo_application_profile_test.go": "4a26549b174ee4b32ca674c93d02c5adda827d6ed1cd896e3c3070fbf44fd85c",
"cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445",
"adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
"adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
"adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
"adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29",
"adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
"adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
"adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
"adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
"adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
"examples/forgejo-application-access/policy.md": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac",
"examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
"examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e"
},
"network": "disabled",
"pid_namespace": "private"
}

99
docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/shapes-before.json Normal file
View file

@ -0,0 +1,99 @@
{
"returncode": 1,
"seconds": 13.31,
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-resume-producer-all-i56scyc5",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--chdir",
"/work/source",
"--clearenv",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"0",
"--",
"go",
"test",
"-p",
"4",
"-json",
"./cmd/access-engine",
"-run",
"^TestForgejoActualPolicySignedLosslessAndLegacy$",
"-count=1"
],
"source_pins": {
"internal/decision/engine.go": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d",
"internal/decision/json_profile.go": "430d2c89f47d218ec843af76a9766b42e9d938a15063fc8e979f14c56306f4bc",
"cmd/access-engine/forgejo_application_profile_test.go": "4a26549b174ee4b32ca674c93d02c5adda827d6ed1cd896e3c3070fbf44fd85c",
"cmd/access-engine/main.go": "e4b6ad3b3dd4bb72e9a908fa7eb1296c8202ae92b81922c640c632415dbd6445",
"adapters/go/decisionpep/go.mod": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
"adapters/go/decisionpep/producer-source.json": "09039298bb6e2ad32a6c8c9248468ae8a0e20376b52e05be5d6e5ab9bfd5ecfa",
"adapters/go/decisionpep/LICENSE": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
"adapters/go/decisionpep/testsupport/signfixture/sign.go": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29",
"adapters/go/decisionpep/pkg/api/caring.go": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
"adapters/go/decisionpep/pkg/api/resource_manifest.go": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
"adapters/go/decisionpep/pkg/api/canonical.go": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
"adapters/go/decisionpep/pkg/decisionpep/client.go": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
"adapters/go/decisionpep/pkg/decisionpep/client_test.go": "bff576b84df6aea607feea19c6372f543b29dbcc74df76ed43a852c9dc3e48ee",
"adapters/go/decisionpep/internal/sign/sign.go": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
"examples/forgejo-application-access/policy.md": "1ad11259f7ea8aae160f2542d88719cdb247037a2754c339c3a83e807953fa31",
"examples/forgejo-application-access/registry.synthetic.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e",
"examples/forgejo-application-access/registry_snapshot.json": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e"
},
"network": "disabled",
"pid_namespace": "private"
}

105
docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/publication-commit.json Normal file
View file

@ -0,0 +1,105 @@
{
"exit_code": 0,
"commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
"base": "d328a2601095686f74376d87791bff01e2a3a2a3",
"files": [
{
"path": "Makefile",
"sha256": "7ef0d92d357c18ba3237f1e52727ffa06790195c7ed63f9e774eb186b1a241d9"
},
{
"path": "adapters/go/decisionpep/LICENSE",
"sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
},
{
"path": "adapters/go/decisionpep/go.mod",
"sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3"
},
{
"path": "adapters/go/decisionpep/internal/sign/sign.go",
"sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde"
},
{
"path": "adapters/go/decisionpep/pkg/api/canonical.go",
"sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19"
},
{
"path": "adapters/go/decisionpep/pkg/api/caring.go",
"sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3"
},
{
"path": "adapters/go/decisionpep/pkg/api/resource_manifest.go",
"sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f"
},
{
"path": "adapters/go/decisionpep/pkg/decisionpep/client.go",
"sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
},
{
"path": "adapters/go/decisionpep/pkg/decisionpep/client_test.go",
"sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
},
{
"path": "adapters/go/decisionpep/producer-source.json",
"sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb"
},
{
"path": "adapters/go/decisionpep/testsupport/signfixture/sign.go",
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
{
"path": "cmd/access-engine/forgejo_application_profile_test.go",
"sha256": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe"
},
{
"path": "cmd/access-engine/main.go",
"sha256": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d"
},
{
"path": "docs/decisionpep-adapter.md",
"sha256": "48ebf9bf71e12ac09553d2ed19eb7c9fdb785a67560dd173f169c616c35e26b2"
},
{
"path": "examples/forgejo-application-access/policy.md",
"sha256": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac"
},
{
"path": "examples/forgejo-application-access/registry_snapshot.json",
"sha256": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e"
},
{
"path": "internal/decision/engine.go",
"sha256": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d"
},
{
"path": "internal/decision/json_profile.go",
"sha256": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f"
},
{
"path": "pkg/decisionpep/client.go",
"sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
},
{
"path": "pkg/decisionpep/client_test.go",
"sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
},
{
"path": "pkg/decisionpep/export_test.go",
"sha256": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843"
},
{
"path": "testsupport/signfixture/sign.go",
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
{
"path": "tools/export_decisionpep_adapter.py",
"sha256": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1"
},
{
"path": "workplans/FLEX-WP-0024-decision-envelope-authenticity.md",
"sha256": "f578b116587bc9d269081129b78d6d4ab6a2bd14105bfa57a464f07597823ab6"
}
],
"stdout": "[main ca0cb75] Add producer-owned authenticated Go decision client and validated Forgejo profile\n 24 files changed, 2980 insertions(+), 4 deletions(-)\n create mode 100644 adapters/go/decisionpep/LICENSE\n create mode 100644 adapters/go/decisionpep/go.mod\n create mode 100644 adapters/go/decisionpep/internal/sign/sign.go\n create mode 100644 adapters/go/decisionpep/pkg/api/canonical.go\n create mode 100644 adapters/go/decisionpep/pkg/api/caring.go\n create mode 100644 adapters/go/decisionpep/pkg/api/resource_manifest.go\n create mode 100644 adapters/go/decisionpep/pkg/decisionpep/client.go\n create mode 100644 adapters/go/decisionpep/pkg/decisionpep/client_test.go\n create mode 100644 adapters/go/decisionpep/producer-source.json\n create mode 100644 adapters/go/decisionpep/testsupport/signfixture/sign.go\n create mode 100644 cmd/access-engine/forgejo_application_profile_test.go\n create mode 100644 docs/decisionpep-adapter.md\n create mode 100644 examples/forgejo-application-access/policy.md\n create mode 100644 examples/forgejo-application-access/registry_snapshot.json\n create mode 100644 internal/decision/json_profile.go\n create mode 100644 pkg/decisionpep/client.go\n create mode 100644 pkg/decisionpep/client_test.go\n create mode 100644 pkg/decisionpep/export_test.go\n create mode 100644 testsupport/signfixture/sign.go\n create mode 100644 tools/export_decisionpep_adapter.py\n",
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 21, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
}

8
docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-application.json Normal file
View file

@ -0,0 +1,8 @@
{
"status": "applied",
"files": 24,
"base": "d328a2601095686f74376d87791bff01e2a3a2a3",
"native_changes": false,
"protected_worktree_and_index_preserved": true,
"formal_owner_assent": false
}

163
docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/source-manifest.json Normal file
View file

@ -0,0 +1,163 @@
{
"base": "d328a2601095686f74376d87791bff01e2a3a2a3",
"files": [
{
"path": "Makefile",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/Makefile",
"before_sha256": "aa32fe04336d4613835629d969ec8c49782d61ee0e2a62f09fd67d19796f58b7",
"sha256": "7ef0d92d357c18ba3237f1e52727ffa06790195c7ed63f9e774eb186b1a241d9"
},
{
"path": "adapters/go/decisionpep/LICENSE",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/LICENSE",
"before_sha256": null,
"sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
},
{
"path": "adapters/go/decisionpep/go.mod",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/go.mod",
"before_sha256": null,
"sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3"
},
{
"path": "adapters/go/decisionpep/internal/sign/sign.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/internal/sign/sign.go",
"before_sha256": null,
"sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde"
},
{
"path": "adapters/go/decisionpep/pkg/api/canonical.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/canonical.go",
"before_sha256": null,
"sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19"
},
{
"path": "adapters/go/decisionpep/pkg/api/caring.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/caring.go",
"before_sha256": null,
"sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3"
},
{
"path": "adapters/go/decisionpep/pkg/api/resource_manifest.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/api/resource_manifest.go",
"before_sha256": null,
"sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f"
},
{
"path": "adapters/go/decisionpep/pkg/decisionpep/client.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client.go",
"before_sha256": null,
"sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
},
{
"path": "adapters/go/decisionpep/pkg/decisionpep/client_test.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/pkg/decisionpep/client_test.go",
"before_sha256": null,
"sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
},
{
"path": "adapters/go/decisionpep/producer-source.json",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/producer-source.json",
"before_sha256": null,
"sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb"
},
{
"path": "adapters/go/decisionpep/testsupport/signfixture/sign.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/adapters/go/decisionpep/testsupport/signfixture/sign.go",
"before_sha256": null,
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
{
"path": "cmd/access-engine/forgejo_application_profile_test.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/cmd/access-engine/forgejo_application_profile_test.go",
"before_sha256": null,
"sha256": "559de3fa47bdd1ad265c401f1c0645ee895001555dae1a6a5712953c85d508fe"
},
{
"path": "cmd/access-engine/main.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/cmd/access-engine/main.go",
"before_sha256": "da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758",
"sha256": "0bce5b48d41fce65d6deac3b81cda88e24b57e5b696143aac1f3929e1677319d"
},
{
"path": "docs/decisionpep-adapter.md",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/docs/decisionpep-adapter.md",
"before_sha256": null,
"sha256": "48ebf9bf71e12ac09553d2ed19eb7c9fdb785a67560dd173f169c616c35e26b2"
},
{
"path": "examples/forgejo-application-access/policy.md",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/examples/forgejo-application-access/policy.md",
"before_sha256": null,
"sha256": "3a5b0c348d8ee89236b3f7064bdd07afddc2613eda69ff6f4d88ba7cde3024ac"
},
{
"path": "examples/forgejo-application-access/registry_snapshot.json",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/examples/forgejo-application-access/registry_snapshot.json",
"before_sha256": null,
"sha256": "f83c53afad98ba72dc199ccada552c9e844d903a94a3168229d985e827fa2f0e"
},
{
"path": "internal/decision/engine.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/internal/decision/engine.go",
"before_sha256": "be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd",
"sha256": "ecbb73644d979b1f15e1df6945536c20507fb3d3f9640f755a7081a344782c7d"
},
{
"path": "internal/decision/json_profile.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/internal/decision/json_profile.go",
"before_sha256": null,
"sha256": "5c6ff75b30372df0350bd48d6f6c77fa71665de6553dc39dc38cc1ecae07b60f"
},
{
"path": "pkg/decisionpep/client.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/client.go",
"before_sha256": null,
"sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
},
{
"path": "pkg/decisionpep/client_test.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/client_test.go",
"before_sha256": null,
"sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
},
{
"path": "pkg/decisionpep/export_test.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/pkg/decisionpep/export_test.go",
"before_sha256": null,
"sha256": "ecf763d1b3fb8525c5a31a25825cca5dd5c5ccc26e631f3943bd60b8a441f843"
},
{
"path": "testsupport/signfixture/sign.go",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/testsupport/signfixture/sign.go",
"before_sha256": null,
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
},
{
"path": "tools/export_decisionpep_adapter.py",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/access-engine-source/tools/export_decisionpep_adapter.py",
"before_sha256": null,
"sha256": "6aea657b99f55fbe87582f225fb5308f97489330a9a29cd2010844f6930d9ac1"
},
{
"path": "workplans/FLEX-WP-0024-decision-envelope-authenticity.md",
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/access-engine-pep-source-integration-r1/workplan.postimage.md",
"before_sha256": "cc94a493c23c16a3baa718b75ef5d48a596c6386c11534d50fd4839a6f0448f2",
"sha256": "f578b116587bc9d269081129b78d6d4ab6a2bd14105bfa57a464f07597823ab6"
}
],
"protected": [
{
"path": ".custodian-brief.md",
"sha256": "009d2b150ad8f519818187298527da687946dc019bc35c72821170e7dd1942f8",
"index": "100644 5e12ebd1d7606f88c606a5cc23b2c24d1afa8a3a 0\t.custodian-brief.md"
},
{
"path": "WORK-RECORDS.md",
"sha256": "f713204e5c524f22e4a831fa480bf0e2018e206cd48f55fbf9d5472bfca104a5",
"index": "100644 62ffebf8500114c6080a7a15809cb3e344a555d7 0\tWORK-RECORDS.md"
}
],
"native_changes": false,
"formal_owner_assent": false
}

2214
docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json Normal file
View file

File diff suppressed because it is too large Load diff

106
docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/annotate_public_metadata.py Normal file
View file

@ -0,0 +1,106 @@
"""Verify flagged public artifacts before annotating their digest/commit types."""
from pathlib import Path
import hashlib
import json
import re
import subprocess
HERE = Path(__file__).resolve().parent
ROOT = HERE.parents[3]
PACKET = ROOT / 'docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2'
findings = json.loads((HERE / 'redacted-scanner-findings.json').read_text())
assert not (HERE / 'public-metadata-derivation.json').exists()
def sha(raw):
return hashlib.sha256(raw).hexdigest()
def verify_consumer_source(name, digest, data):
candidates = [Path(data['workspace']) / 'source' / name]
for prefix in [PACKET / 'forgejo-source', PACKET / 'preimages/forgejo', PACKET / 'recovered-source',
PACKET.parent / 'forgejo-private-input-r1/postimages/forgejo',
PACKET.parent / 'forgejo-private-input-r1/postimages/shared',
PACKET.parent / 'forgejo-required-claim-values-r1/postimages',
PACKET.parent / 'apps-operation-backend-r1/postimages']:
candidates.append(prefix / name)
for candidate in candidates:
if candidate.is_file() and sha(candidate.read_bytes()) == digest:
return str(candidate)
if name == 'services/auth/source/oauth2/access_engine.go':
text = (PACKET / 'forgejo-source' / name).read_text()
after = '''\tif authorizedParty, present := claims["azp"]; present {
\t\tif azp, ok := authorizedParty.(string); !ok || azp != a.Audience {
\t\t\treturn out, errApplicationDecision
\t\t}
\t} else if len(aud) > 1 {
\t\treturn out, errApplicationDecision
\t}'''
before = '''\tif len(aud) > 1 {
\t\tif azp, ok := claims["azp"].(string); !ok || azp != a.Audience {
\t\t\treturn out, errApplicationDecision
\t\t}
\t}'''
assert after in text
if sha(text.replace(after, before).encode()) == digest:
return 'Exact reconstructed public source before the retained authorized-party correction'
raise AssertionError('Unverified consumer source digest: ' + name)
prepared = []
for row in findings:
file = ROOT / row['path']
raw = file.read_bytes()
data = json.loads(raw)
lines = raw.decode().splitlines(keepends=True)
modifications = []
for finding in row['redacted_findings']:
assert finding['RuleID'] == 'generic-api-key' and finding['StartLine'] == finding['EndLine']
index = finding['StartLine'] - 1
entry = json.loads('{' + lines[index].strip().rstrip(',') + '}')
key, value = next(iter(entry.items()))
assert re.fullmatch('[0-9a-f]{40}|[0-9a-f]{64}', value)
prefix = 'sha256:' if len(value) == 64 else 'git:'
if file.name == 'producer-race-result.json':
assert data['public_fixture_pins'][key] == value
if key == 'secrets_source_revision':
assert subprocess.check_output(['git', '-C', '/home/worsch/secrets-engine', 'cat-file', '-t', value], text=True).strip() == 'commit'
evidence = 'Existing Secrets Engine public source commit'
else:
source = Path(data['workspace']) / 'public-fixtures' / key
assert source.is_file() and sha(source.read_bytes()) == value
evidence = str(source)
elif file.name.startswith('consumer-test-attempt'):
assert data['composed_source_pins'][key] == value
evidence = verify_consumer_source(key, value, data)
else:
assert file.name == 'issuer-fixture-result.json' and key == 'source_token_go_sha256'
source = subprocess.check_output(['git', '-C', '/home/worsch/key-cape', 'show', data['source_commit'] + ':src/internal/server/oidc/token.go'])
assert sha(source) == value
evidence = 'Verified KeyCape public source at the revision recorded in issuer-fixture-result.json'
quoted = json.dumps(value)
assert lines[index].count(quoted) == 1
lines[index] = lines[index].replace(quoted, json.dumps(prefix + value))
modifications.append({'line': index + 1, 'key': key, 'type': prefix[:-1], 'verified_against': evidence})
published = ''.join(lines).encode()
restored = published.decode().splitlines(keepends=True)
for change in modifications:
index = change['line'] - 1
entry = json.loads('{' + restored[index].strip().rstrip(',') + '}')
typed = entry[change['key']]
restored[index] = restored[index].replace(json.dumps(typed), json.dumps(typed.split(':', 1)[1]))
assert ''.join(restored).encode() == raw
prepared.append((file, raw, published, {'path': row['path'], 'blocked_blob': row['blob'],
'original_sha256': 'sha256:' + sha(raw), 'published_sha256': 'sha256:' + sha(published),
'changes': modifications, 'original_byte_exact_reconstructed': True}))
# Complete verification precedes all writes. Original frozen receipts stay local.
backup = HERE / 'original-metadata'
backup.mkdir()
for file, raw, published, row in prepared:
(backup / file.name).write_bytes(raw)
file.write_bytes(published)
(HERE / 'public-metadata-derivation.json').write_text(json.dumps({'scope': 'Verified public code-file digests and one public Git revision only',
'scanner_rules_or_allowlists_changed': False, 'credential_values_transformed': False,
'originals_preserved_locally': True, 'records': [row for _, _, _, row in prepared]}, indent=2) + '\n')
print(json.dumps({'verified_records': len(prepared), 'verified_public_identifiers': sum(len(row['changes']) for _, _, _, row in prepared), 'credential_values_transformed': False}))

7
docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/first-commit-refusal.json Normal file
View file

@ -0,0 +1,7 @@
{
"chunk_id": "d63574",
"wall_time_seconds": 0.000011696,
"exit_code": 1,
"original_token_count": 98,
"output": "{\"blocked_blob_ids\": [\"6d7bc9cb1ad8321b4133d42538e2690a9cd9715c\", \"7bb6c37b3765646b5f61a90c2e08e0c57145725d\", \"ca6b81ce6d8a0a4aee73ebb44017d43eec0db388\", \"cd8906e2f8655d3d840136108e5c0e8d9342baa4\"], \"scanned_blobs\": 21, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"blocked\"}\n"
}

206
docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json Normal file
View file

@ -0,0 +1,206 @@
{
"scope": "Verified public code-file digests and one public Git revision only",
"scanner_rules_or_allowlists_changed": false,
"credential_values_transformed": false,
"originals_preserved_locally": true,
"records": [
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json",
"blocked_blob": "7bb6c37b3765646b5f61a90c2e08e0c57145725d",
"original_sha256": "sha256:117e9d757b69ee0b68986276a6fdbac55cdbba9e2f32697ccc1e435e5668b14b",
"published_sha256": "sha256:7ec4d209bb6cb60e4e50d7d18f968a969687adf0364a529c72edf68905779930",
"changes": [
{
"line": 132,
"key": "python/yaml/tokens.py",
"type": "sha256",
"verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/python/yaml/tokens.py"
},
{
"line": 137,
"key": "secrets-engine/src/secrets_engine/approval_auth.py",
"type": "sha256",
"verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/approval_auth.py"
},
{
"line": 148,
"key": "secrets-engine/src/secrets_engine/engine_auth.py",
"type": "sha256",
"verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/engine_auth.py"
},
{
"line": 168,
"key": "secrets-engine/src/secrets_engine/secret_use.py",
"type": "sha256",
"verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/secret_use.py"
},
{
"line": 169,
"key": "secrets-engine/src/secrets_engine/service_auth.py",
"type": "sha256",
"verified_against": "/tmp/custodian-resume-producer-race-oa_wz3sd/public-fixtures/secrets-engine/src/secrets_engine/service_auth.py"
},
{
"line": 174,
"key": "secrets_source_revision",
"type": "git",
"verified_against": "Existing Secrets Engine public source commit"
}
],
"original_byte_exact_reconstructed": true
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json",
"blocked_blob": "cd8906e2f8655d3d840136108e5c0e8d9342baa4",
"original_sha256": "sha256:07957ced6417b02f2be1d1594f7fcc91b01667c51cbaa868f2f5fd8cd2fd5a1d",
"published_sha256": "sha256:f35955bab3b36750b2a9930b89e376d1582c083fa6bd7bad0dc4c6462da74dd4",
"changes": [
{
"line": 115,
"key": "cmd/admin_auth_oauth.go",
"type": "sha256",
"verified_against": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/preimages/forgejo/cmd/admin_auth_oauth.go"
},
{
"line": 116,
"key": "cmd/admin_auth_oauth_secret_linux.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux.go"
},
{
"line": 117,
"key": "cmd/admin_auth_oauth_secret_linux_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux_test.go"
},
{
"line": 118,
"key": "cmd/admin_auth_oauth_secret_other.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_other.go"
},
{
"line": 129,
"key": "routers/web/admin/auths.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/admin/auths.go"
},
{
"line": 130,
"key": "routers/web/auth/oauth.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/auth/oauth.go"
},
{
"line": 131,
"key": "services/auth/source/oauth2/access_engine.go",
"type": "sha256",
"verified_against": "Exact reconstructed public source before the retained authorized-party correction"
},
{
"line": 132,
"key": "services/auth/source/oauth2/access_engine_azp_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_azp_test.go"
},
{
"line": 134,
"key": "services/auth/source/oauth2/access_engine_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_test.go"
},
{
"line": 140,
"key": "services/forms/auth_form.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/forms/auth_form.go"
}
],
"original_byte_exact_reconstructed": true
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json",
"blocked_blob": "ca6b81ce6d8a0a4aee73ebb44017d43eec0db388",
"original_sha256": "sha256:d6dd1c27ccd758ccc68e936fde69ea118a38e47cd9002fbee7d2957be4a71795",
"published_sha256": "sha256:7721bf00e3e9b1494b6d37bc2296efe0030f5acaeb4b6f4f07fec7ba3518b8a4",
"changes": [
{
"line": 115,
"key": "cmd/admin_auth_oauth.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth.go"
},
{
"line": 116,
"key": "cmd/admin_auth_oauth_secret_linux.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux.go"
},
{
"line": 117,
"key": "cmd/admin_auth_oauth_secret_linux_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_linux_test.go"
},
{
"line": 118,
"key": "cmd/admin_auth_oauth_secret_other.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/cmd/admin_auth_oauth_secret_other.go"
},
{
"line": 130,
"key": "routers/web/admin/auths.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/admin/auths.go"
},
{
"line": 131,
"key": "routers/web/auth/oauth.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/routers/web/auth/oauth.go"
},
{
"line": 132,
"key": "services/auth/source/oauth2/access_engine.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine.go"
},
{
"line": 133,
"key": "services/auth/source/oauth2/access_engine_azp_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_azp_test.go"
},
{
"line": 135,
"key": "services/auth/source/oauth2/access_engine_test.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2/access_engine_test.go"
},
{
"line": 141,
"key": "services/forms/auth_form.go",
"type": "sha256",
"verified_against": "/tmp/custodian-forgejo-successor-attempt2/source/services/forms/auth_form.go"
}
],
"original_byte_exact_reconstructed": true
},
{
"path": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json",
"blocked_blob": "6d7bc9cb1ad8321b4133d42538e2690a9cd9715c",
"original_sha256": "sha256:856427415cb681e2d1ad2462ef7e61cb0a380e934f5b123150c5dc4100bb7e2e",
"published_sha256": "sha256:dc42ce04fa3744604005f13d9c2b644c087c8af46463edc3551203014bca8813",
"changes": [
{
"line": 5,
"key": "source_token_go_sha256",
"type": "sha256",
"verified_against": "Verified KeyCape public source at the revision recorded in issuer-fixture-result.json"
}
],
"original_byte_exact_reconstructed": true
}
]
}

161
docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/redacted-scanner-findings.json Normal file
View file

@ -0,0 +1,161 @@
[
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-race-result.json",
"blob": "7bb6c37b3765646b5f61a90c2e08e0c57145725d",
"redacted_findings": [
{
"RuleID": "generic-api-key",
"StartLine": 132,
"EndLine": 132
},
{
"RuleID": "generic-api-key",
"StartLine": 137,
"EndLine": 137
},
{
"RuleID": "generic-api-key",
"StartLine": 148,
"EndLine": 148
},
{
"RuleID": "generic-api-key",
"StartLine": 168,
"EndLine": 168
},
{
"RuleID": "generic-api-key",
"StartLine": 169,
"EndLine": 169
},
{
"RuleID": "generic-api-key",
"StartLine": 174,
"EndLine": 174
}
]
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt3.json",
"blob": "cd8906e2f8655d3d840136108e5c0e8d9342baa4",
"redacted_findings": [
{
"RuleID": "generic-api-key",
"StartLine": 115,
"EndLine": 115
},
{
"RuleID": "generic-api-key",
"StartLine": 116,
"EndLine": 116
},
{
"RuleID": "generic-api-key",
"StartLine": 117,
"EndLine": 117
},
{
"RuleID": "generic-api-key",
"StartLine": 118,
"EndLine": 118
},
{
"RuleID": "generic-api-key",
"StartLine": 129,
"EndLine": 129
},
{
"RuleID": "generic-api-key",
"StartLine": 130,
"EndLine": 130
},
{
"RuleID": "generic-api-key",
"StartLine": 131,
"EndLine": 131
},
{
"RuleID": "generic-api-key",
"StartLine": 132,
"EndLine": 132
},
{
"RuleID": "generic-api-key",
"StartLine": 134,
"EndLine": 134
},
{
"RuleID": "generic-api-key",
"StartLine": 140,
"EndLine": 140
}
]
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt6.json",
"blob": "ca6b81ce6d8a0a4aee73ebb44017d43eec0db388",
"redacted_findings": [
{
"RuleID": "generic-api-key",
"StartLine": 115,
"EndLine": 115
},
{
"RuleID": "generic-api-key",
"StartLine": 116,
"EndLine": 116
},
{
"RuleID": "generic-api-key",
"StartLine": 117,
"EndLine": 117
},
{
"RuleID": "generic-api-key",
"StartLine": 118,
"EndLine": 118
},
{
"RuleID": "generic-api-key",
"StartLine": 130,
"EndLine": 130
},
{
"RuleID": "generic-api-key",
"StartLine": 131,
"EndLine": 131
},
{
"RuleID": "generic-api-key",
"StartLine": 132,
"EndLine": 132
},
{
"RuleID": "generic-api-key",
"StartLine": 133,
"EndLine": 133
},
{
"RuleID": "generic-api-key",
"StartLine": 135,
"EndLine": 135
},
{
"RuleID": "generic-api-key",
"StartLine": 141,
"EndLine": 141
}
]
},
{
"path": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json",
"blob": "6d7bc9cb1ad8321b4133d42538e2690a9cd9715c",
"redacted_findings": [
{
"RuleID": "generic-api-key",
"StartLine": 5,
"EndLine": 5
}
]
}
]

14
docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/second-redacted-scanner-findings.json Normal file
View file

@ -0,0 +1,14 @@
{
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/public-metadata-derivation.json",
"blob": "d29533ee292929c085387963323367f26a6ac15d",
"findings": [
{
"RuleID": "generic-api-key",
"StartLine": 200,
"EndLine": 200
}
],
"classification": "Verified public KeyCape Git revision redundantly embedded in explanatory prose. Exact revision remains in the referenced issuer receipt; source and digests unchanged.",
"refinement": "Use an explicit reference to the existing source revision field instead of duplicating the public commit in prose.",
"scanner_changed": false
}

7
docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/commit-terminal-result.json Normal file
View file

@ -0,0 +1,7 @@
{
"chunk_id": "a4953e",
"wall_time_seconds": 0.000009901,
"exit_code": 0,
"original_token_count": 88,
"output": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 2, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n[main 614f632] Record implemented producer client and actual issuer compatibility work\n 2 files changed, 69 insertions(+), 1 deletion(-)\n"
}

6
docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/local-chain-validation.json Normal file
View file

@ -0,0 +1,6 @@
{
"local_base": "af81f354adde344cf271035082da8bd2c598449c",
"remote_base": "33a7815e7bd8480dc7cf7b0167058f659cf3ea6f",
"preceding_capsule_verified": true,
"reason": "Stack the bounded local source commits before the required final consistency sync; preserve the exact-normal remote guard refusal."
}

4
docs/changes/netkingdom-target-2026-10-18/cust80-source-progress-publication-r1/preparation-refinement.json Normal file
View file

@ -0,0 +1,4 @@
{
"original_preparation": "Aggregate selected bytes exceeded conservative 260000-byte preparation bound; manifest was not written. Subsequent publication call refused before staging due to missing manifest. No source/index/commit changed.",
"refinement": "Publish two existing workplan/implementation documents first, then the separate bounded evidence set. Normal scanner and hooks remain unchanged."
}

121
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer-before.json Normal file
View file

@ -0,0 +1,121 @@
{
"returncode": 1,
"seconds": 4.88,
"workspace": "/tmp/custodian-forgejo-wire-9wx2syhq",
"argv": [
"bwrap",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--unshare-net",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod/cache/download",
"/cached",
"--ro-bind",
"/etc/ssl/certs",
"/etc/ssl/certs",
"--ro-bind",
"/etc/resolv.conf",
"/etc/resolv.conf",
"--chdir",
"/work/source",
"--clearenv",
"--dir",
"/run",
"--ro-bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/forgejo-oidc",
"--bind",
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
"/run/writable-input",
"--setenv",
"PATH",
"/work/go/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOPATH",
"/work/gopath",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOVCS",
"*:off",
"--setenv",
"GOMODCACHE",
"/work/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"1",
"--setenv",
"GIT_CONFIG_NOSYSTEM",
"1",
"--setenv",
"GIT_CONFIG_GLOBAL",
"/work/home/test.gitconfig",
"--setenv",
"GIT_TERMINAL_PROMPT",
"0",
"--ro-bind",
"/tmp/custodian-forgejo-wire-9wx2syhq/oauth2",
"/work/source/services/auth/source/oauth2",
"--ro-bind",
"/tmp/custodian-keycape-wire-rsi4f6hj/identity.json",
"/work/keycape-wire-fixture.json",
"--setenv",
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
"/work/keycape-wire-fixture.json",
"--",
"go",
"test",
"-p",
"1",
"-json",
"-tags",
"sqlite sqlite_unlock_notify",
"./services/auth/source/oauth2",
"-run",
"^TestAccessEngineActualKeyCapeIssuer$",
"-count=1"
],
"actual_issuer_source": "d803e9282a47b49daf930fb905312fa5104c0ace",
"fixture_sha256": "f7ab0b865db577588ca100deb9f11d27c3e947f980961cd9a359c2eadfe394ec",
"fixture_values_published": false,
"synthetic_authentication": true,
"real_credentials": false
}

38
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/consumer_wire_test.go Normal file
View file

@ -0,0 +1,38 @@
package oauth2
import (
"encoding/json"
"os"
"testing"
"time"
)
func TestAccessEngineActualKeyCapeIssuer(t *testing.T) {
raw, err := os.ReadFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE"))
if err != nil {
t.Fatal("actual issuer fixture unavailable")
}
var fixture struct {
Token string `json:"id_token"`
Key string `json:"public_key_pem"`
Kid string `json:"kid"`
Issuer string `json:"issuer"`
Audience string `json:"audience"`
}
if json.Unmarshal(raw, &fixture) != nil {
t.Fatal("actual issuer fixture malformed")
}
admission, _, _, _ := identityFixture(t)
admission.Issuer = fixture.Issuer
admission.Audience = fixture.Audience
admission.AssuranceClaim = "assurance"
admission.Algorithms = []string{"RS256"}
admission.IdentityKeys = map[string]string{fixture.Kid: fixture.Key}
identity, err := VerifyApplicationIdentity(fixture.Token, admission, time.Now().UTC())
if err != nil {
t.Fatal("actual KeyCape token rejected by consumer", err)
}
if identity.Subject != "user:synthetic" || identity.Tenant != "tenant:synthetic" || identity.Assurance != "aal2" {
t.Fatal("actual issuer identity snapshot mismatch")
}
}

88
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer-fixture-result.json Normal file
View file

@ -0,0 +1,88 @@
{
"returncode": 0,
"seconds": 21.09,
"source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace",
"source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
"workspace": "/tmp/custodian-keycape-wire-rsi4f6hj",
"argv": [
"bwrap",
"--unshare-net",
"--unshare-pid",
"--die-with-parent",
"--new-session",
"--ro-bind",
"/usr",
"/usr",
"--ro-bind",
"/lib",
"/lib",
"--ro-bind",
"/lib64",
"/lib64",
"--symlink",
"usr/bin",
"/bin",
"--proc",
"/proc",
"--dev",
"/dev",
"--tmpfs",
"/tmp",
"--bind",
"/tmp/custodian-keycape-wire-rsi4f6hj",
"/work",
"--ro-bind",
"/home/worsch/go/pkg/mod",
"/modules",
"--ro-bind",
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
"/toolchain",
"--chdir",
"/work/src",
"--clearenv",
"--setenv",
"PATH",
"/toolchain/bin:/usr/bin:/bin",
"--setenv",
"HOME",
"/work/home",
"--setenv",
"GOTOOLCHAIN",
"local",
"--setenv",
"GOPROXY",
"off",
"--setenv",
"GOSUMDB",
"off",
"--setenv",
"GOMODCACHE",
"/modules",
"--setenv",
"GOCACHE",
"/work/gocache",
"--setenv",
"GOMAXPROCS",
"4",
"--setenv",
"CGO_ENABLED",
"0",
"--setenv",
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
"/work/identity.json",
"--",
"go",
"test",
"-p",
"4",
"-json",
"./internal/server/oidc",
"-run",
"^TestCustodianForgejoIssuerFixture$",
"-count=1"
],
"synthetic_authentication": true,
"real_credentials": false,
"fixture_values_published": false,
"fixture_sha256": "f7ab0b865db577588ca100deb9f11d27c3e947f980961cd9a359c2eadfe394ec"
}

66
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/issuer_fixture_test.go Normal file
View file

@ -0,0 +1,66 @@
package oidc_test
import (
"crypto/x509"
"encoding/json"
"encoding/pem"
"net/http"
"net/http/httptest"
"net/url"
"os"
"testing"
"time"
"keycape/internal/domain"
"keycape/internal/server/oidc"
)
// This runs the actual token endpoint and serializer. Authentication and its key
// are synthetic; neither the fixture nor this test proves an attended MFA flow.
func TestCustodianForgejoIssuerFixture(t *testing.T) {
users := &mockUserRepo{users: map[string]*domain.User{"alice": {
ID: "user:synthetic", Username: "alice", Enabled: true,
Tenant: "tenant:synthetic", Groups: []string{"forge-admins"},
}}}
sessions := oidc.NewSessionStore()
verifier, _ := makeVerifierAndChallenge()
code := seededSession(sessions, verifier)
session, ok := sessions.Get(code)
if !ok {
t.Fatal("fixture session missing")
}
session.MFAVerified = true // Explicit synthetic upstream authentication.
session.AuthTime = time.Now().Add(-10 * time.Second)
handler, key := newTokenHandler(t, sessions, users)
handler.Issuer = "https://issuer.invalid"
handler.ClientConfig["test-client"].ClientType = "confidential"
handler.ClientConfig["test-client"].ClientSecret = "synthetic-issuer-client"
request := tokenRequest(url.Values{"grant_type": {"authorization_code"}, "code": {code}, "client_id": {"test-client"}, "code_verifier": {verifier}})
request.SetBasicAuth("test-client", "synthetic-issuer-client")
response := httptest.NewRecorder()
handler.ServeHTTP(response, request)
if response.Code != http.StatusOK {
t.Fatal("actual issuer fixture refused", response.Code)
}
var body struct {
IDToken string `json:"id_token"`
}
if json.Unmarshal(response.Body.Bytes(), &body) != nil || body.IDToken == "" {
t.Fatal("actual issuer ID token missing")
}
public, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
if err != nil {
t.Fatal(err)
}
fixture := map[string]any{"id_token": body.IDToken,
"public_key_pem": string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: public})),
"kid": "key-1", "issuer": handler.Issuer, "audience": "test-client",
"synthetic_authentication": true, "real_credentials": false}
raw, err := json.Marshal(fixture)
if err != nil {
t.Fatal(err)
}
if err := os.WriteFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE"), raw, 0600); err != nil {
t.Fatal("fixture output unavailable")
}
}

46
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/produce_fixture.py Normal file
View file

@ -0,0 +1,46 @@
"""Generate a private synthetic identity through the committed actual issuer."""
from pathlib import Path
import hashlib
import io
import json
import shutil
import subprocess
import tarfile
import tempfile
import time
HERE = Path(__file__).resolve().parent
OWNER = Path('/home/worsch/key-cape')
WORK = Path(tempfile.mkdtemp(prefix='custodian-keycape-wire-'))
revision = subprocess.check_output(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'], text=True).strip()
archive = subprocess.check_output(['git', '-C', str(OWNER), 'archive', revision, 'src'])
with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
tar.extractall(WORK, filter='data')
shutil.copyfile(HERE / 'issuer_fixture_test.go', WORK / 'src/internal/server/oidc/custodian_fixture_test.go')
(WORK / 'home').mkdir()
argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session']
for name in ['/usr', '/lib', '/lib64']:
argv += ['--ro-bind', name, name]
argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp',
'--bind', str(WORK), '/work', '--ro-bind', '/home/worsch/go/pkg/mod', '/modules',
'--ro-bind', '/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64', '/toolchain',
'--chdir', '/work/src', '--clearenv']
for key, value in {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOTOOLCHAIN': 'local',
'GOPROXY': 'off', 'GOSUMDB': 'off', 'GOMODCACHE': '/modules', 'GOCACHE': '/work/gocache',
'GOMAXPROCS': '4', 'CGO_ENABLED': '0',
'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE': '/work/identity.json'}.items():
argv += ['--setenv', key, value]
argv += ['--', 'go', 'test', '-p', '4', '-json', './internal/server/oidc', '-run', '^TestCustodianForgejoIssuerFixture$', '-count=1']
assert not (HERE / 'issuer-fixture-result.json').exists()
started = time.monotonic()
with (HERE / 'issuer-fixture.jsonl').open('xb') as log:
result = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=300)
receipt = {'returncode': result.returncode, 'seconds': round(time.monotonic() - started, 2),
'source_commit': revision, 'source_token_go_sha256': hashlib.sha256((WORK / 'src/internal/server/oidc/token.go').read_bytes()).hexdigest(),
'workspace': str(WORK), 'argv': argv, 'synthetic_authentication': True, 'real_credentials': False,
'fixture_values_published': False}
if result.returncode == 0:
receipt['fixture_sha256'] = hashlib.sha256((WORK / 'identity.json').read_bytes()).hexdigest()
(HERE / 'issuer-fixture-result.json').write_text(json.dumps(receipt, indent=2) + '\n')
print(json.dumps({'returncode': result.returncode, 'source_commit': revision, 'fixture_values_published': False}))
raise SystemExit(result.returncode)

37
docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/run_consumer_wire.py Normal file
View file

@ -0,0 +1,37 @@
"""Check the actual issued token in a separate copy of the consumer package."""
from pathlib import Path
import hashlib
import json
import shutil
import subprocess
import tempfile
import time
HERE = Path(__file__).resolve().parent
ROOT = HERE.parents[3]
BASE = ROOT / 'docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2'
WORK = Path(tempfile.mkdtemp(prefix='custodian-forgejo-wire-'))
original = Path('/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2')
shutil.copytree(original, WORK / 'oauth2')
shutil.copyfile(HERE / 'consumer_wire_test.go', WORK / 'oauth2/keycape_wire_test.go')
issued = json.loads((HERE / 'issuer-fixture-result.json').read_text())
assert issued['returncode'] == 0
fixture = Path(issued['workspace']) / 'identity.json'
assert hashlib.sha256(fixture.read_bytes()).hexdigest() == issued['fixture_sha256']
prior = json.loads((BASE / 'consumer-test-attempt6.json').read_text())
argv = prior['argv'][:prior['argv'].index('--')]
argv += ['--ro-bind', str(WORK / 'oauth2'), '/work/source/services/auth/source/oauth2',
'--ro-bind', str(fixture), '/work/keycape-wire-fixture.json',
'--setenv', 'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE', '/work/keycape-wire-fixture.json']
argv += ['--', 'go', 'test', '-p', '1', '-json', '-tags', 'sqlite sqlite_unlock_notify',
'./services/auth/source/oauth2', '-run', '^TestAccessEngineActualKeyCapeIssuer$', '-count=1']
assert not (HERE / 'consumer-before.json').exists()
started = time.monotonic()
with (HERE / 'consumer-before.jsonl').open('xb') as log:
run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=180)
(HERE / 'consumer-before.json').write_text(json.dumps({'returncode': run.returncode,
'seconds': round(time.monotonic() - started, 2), 'workspace': str(WORK), 'argv': argv,
'actual_issuer_source': issued['source_commit'], 'fixture_sha256': issued['fixture_sha256'],
'fixture_values_published': False, 'synthetic_authentication': True, 'real_credentials': False}, indent=2) + '\n')
print(json.dumps({'returncode': run.returncode, 'actual_issuer_source': issued['source_commit'], 'fixture_values_published': False}))
raise SystemExit(run.returncode)