Break Forgejo good-case delivery into four observable checkpoints
This commit is contained in:
codex
parent
4367456d29
commit
bab3dd1c9d
5 changed files with 478 additions and 9 deletions
|
|
@ -79,3 +79,20 @@ flow before deciding whether a source change or rollout is needed. Publish its
|
|||
working owner commands and bounded measurements, then audit both functional
|
||||
milestones and the live hardening handoff. Source files remain authoritative;
|
||||
normal consistency/publication and exact Hub readback must verify this revision.
|
||||
|
||||
## Forgejo follow-through and publication
|
||||
|
||||
The read-only [Forgejo readiness check](forgejo-readiness.json) identifies the
|
||||
running upstream 11.0.3 image and its immutable runtime digest. The API and existing
|
||||
developer Git connection respond, while the login page has no NetKingdom option.
|
||||
The current release inventory is complete (T19). The next work is now split into
|
||||
four visible source tasks: T41 prepares the smallest existing-owner sign-in
|
||||
connection; T42 activates its exact reviewed/authorized revision; T43 verifies the
|
||||
real human account; T44 verifies coding-agent Git and authenticated API use.
|
||||
No blanket security-completion prerequisite or new runtime grant is implied.
|
||||
|
||||
The first refinement was normally published as `4367456d29069d7616d91b3b0cac549a09abf113`.
|
||||
[Primary readback](publication-readback.json) verified every original WP-80 binding
|
||||
and all 25 new WP-82 checkpoints, with all eight unrelated worktree/index states
|
||||
preserved exactly. The four additional functional tasks keep every original ID
|
||||
unchanged and use normal Repo Manager-assigned identifiers.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"observed_at": "2026-10-18",
|
||||
"observation_scope": "Read-only native/public metadata and ordinary existing Git connection; no authentication-source or deployment mutation",
|
||||
"deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
||||
"generation": 15,
|
||||
"ready_replicas": 1,
|
||||
"configured_image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
|
||||
"runtime_image_id": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
|
||||
"public_version_api": {
|
||||
"path": "/api/v1/version",
|
||||
"http_status": 200,
|
||||
"version": "11.0.3+gitea-1.22.0",
|
||||
"authenticated_consumer_proof": false
|
||||
},
|
||||
"public_login": {
|
||||
"path": "/user/login",
|
||||
"http_status": 200,
|
||||
"local_login_form": true,
|
||||
"netkingdom_keycape_oauth2_mentions": 0,
|
||||
"federated_signin_verified": false
|
||||
},
|
||||
"git_read": {
|
||||
"command": "git ls-remote origin refs/heads/main",
|
||||
"status": "passed",
|
||||
"observed_revision_before_refinement": "6dd619fdc7d1351fcdfd3fcac571a90b1925e3ac",
|
||||
"profile": "existing authenticated workstation developer SSH path",
|
||||
"independent_current_keycape_identity_proved": false
|
||||
},
|
||||
"next_functional_blocker": "No NetKingdom sign-in option. Prepare existing owner registration/custody/authentication-source connection using the current release first.",
|
||||
"remaining_checkpoints": [
|
||||
"CUST-WP-0080-T41",
|
||||
"CUST-WP-0080-T42",
|
||||
"CUST-WP-0080-T43",
|
||||
"CUST-WP-0080-T44"
|
||||
],
|
||||
"no_new_native_or_credential_authority": true
|
||||
}
|
||||
|
|
@ -0,0 +1,348 @@
|
|||
{
|
||||
"verified": true,
|
||||
"commit": "4367456d29069d7616d91b3b0cac549a09abf113",
|
||||
"primary_projection_exact": true,
|
||||
"workplans": [
|
||||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"source": "CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"verified_tasks": 40,
|
||||
"bindings": [
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T01",
|
||||
"hub_task_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T02",
|
||||
"hub_task_id": "5973026f-8ca9-5882-99fe-65a54bc250ac",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T03",
|
||||
"hub_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T04",
|
||||
"hub_task_id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T05",
|
||||
"hub_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T06",
|
||||
"hub_task_id": "6aca534c-5c7a-556f-b6b6-406433670c29",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T07",
|
||||
"hub_task_id": "bb236dea-30f7-5437-b01c-f14d2509e061",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T08",
|
||||
"hub_task_id": "18b885fe-503f-5ebc-b390-808f71316264",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T09",
|
||||
"hub_task_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T10",
|
||||
"hub_task_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T11",
|
||||
"hub_task_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T12",
|
||||
"hub_task_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T13",
|
||||
"hub_task_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T14",
|
||||
"hub_task_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T15",
|
||||
"hub_task_id": "434d9c78-7789-5b78-8d9d-d87b0638b469",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T16",
|
||||
"hub_task_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T17",
|
||||
"hub_task_id": "4de46468-7ae2-59e3-be2b-1a32506153a5",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T18",
|
||||
"hub_task_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T19",
|
||||
"hub_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T20",
|
||||
"hub_task_id": "0d9df435-b9a2-5b89-833d-799785c969a9",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T21",
|
||||
"hub_task_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T22",
|
||||
"hub_task_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T23",
|
||||
"hub_task_id": "266e228b-7754-5323-b0c6-37f860592d90",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T24",
|
||||
"hub_task_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T25",
|
||||
"hub_task_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T26",
|
||||
"hub_task_id": "0491b6b4-a238-58ef-bf3a-505749e5655c",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T27",
|
||||
"hub_task_id": "19540d29-c4df-5f1a-acf7-127965c9a396",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T28",
|
||||
"hub_task_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T29",
|
||||
"hub_task_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T30",
|
||||
"hub_task_id": "457400ad-6c44-5160-a77a-63c6ad5acabc",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T31",
|
||||
"hub_task_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T32",
|
||||
"hub_task_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T33",
|
||||
"hub_task_id": "4547ac4c-8893-54fe-ae6e-362682bb7920",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T34",
|
||||
"hub_task_id": "393b9fcc-323b-5182-92c6-44530fce7efb",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T35",
|
||||
"hub_task_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T36",
|
||||
"hub_task_id": "586232a1-57b0-5e04-a61b-fb687bcc8999",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T37",
|
||||
"hub_task_id": "d533ca34-a691-5f8e-8cc2-5f408b679538",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T38",
|
||||
"hub_task_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T39",
|
||||
"hub_task_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c",
|
||||
"status": "cancel"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0080-T40",
|
||||
"hub_task_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e",
|
||||
"status": "cancel"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"workplan_id": "b29f9f25-b508-5c2c-98fd-2f6877f109cf",
|
||||
"source": "CUST-WP-0082-netkingdom-security-hardening.md",
|
||||
"verified_tasks": 25,
|
||||
"bindings": [
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T01",
|
||||
"hub_task_id": "2ac61e1a-5a01-5ff9-ae35-017efe1e987c",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T02",
|
||||
"hub_task_id": "a88d7bbe-49d8-5dc0-a613-eeebb756bd0c",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T03",
|
||||
"hub_task_id": "55e99c7e-69de-523a-88f1-660c3f69edb0",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T04",
|
||||
"hub_task_id": "aa7112b1-e76e-520e-a59a-6aa4aa39b35d",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T05",
|
||||
"hub_task_id": "8e9c5b9a-8315-5efa-9cd3-00a113c6ea81",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T06",
|
||||
"hub_task_id": "a7cf387e-da06-5cca-8815-43a4ecbf8ea9",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T07",
|
||||
"hub_task_id": "c555c76a-00e8-5d07-9aef-7a4e6ac7ea11",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T08",
|
||||
"hub_task_id": "f1dbdb5d-30cb-5012-9fa5-e59520ba2aae",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T09",
|
||||
"hub_task_id": "88c0467d-b8b8-5972-b50a-2a87b51365fb",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T10",
|
||||
"hub_task_id": "5ddfe024-b823-51c9-ac4d-ec5e53c47346",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T11",
|
||||
"hub_task_id": "5b3767a0-5657-5ae3-b094-70e429a26617",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T12",
|
||||
"hub_task_id": "cbac0912-ac45-58d4-93db-8f49ac7750b2",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T13",
|
||||
"hub_task_id": "1903466c-674f-5025-acd7-873396c6d2fe",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T14",
|
||||
"hub_task_id": "38363478-e46b-54bd-972d-ce998f3b8dd0",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T15",
|
||||
"hub_task_id": "564a545a-b43d-5013-8f1b-e34cd54b52c7",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T16",
|
||||
"hub_task_id": "90c8fb36-9032-57e7-85da-684d18e5c0b1",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T17",
|
||||
"hub_task_id": "9e35af30-ec53-58f4-8517-5a5df85b6c79",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T18",
|
||||
"hub_task_id": "316d9fc2-27e3-53ce-809d-a50769fa9734",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T19",
|
||||
"hub_task_id": "9e26f419-0547-596a-bd0c-66b39f2d6ba8",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T20",
|
||||
"hub_task_id": "eef7e3d9-9cfb-5525-af82-a8cc1bba6e67",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T21",
|
||||
"hub_task_id": "d3dd8c35-284b-5035-a1a3-e0a0dbef86ba",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T22",
|
||||
"hub_task_id": "43a94f1e-e906-55ac-a837-d9ce5c495d6b",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T23",
|
||||
"hub_task_id": "4fda91f5-94c1-52fc-9dbd-c3693950165b",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T24",
|
||||
"hub_task_id": "2c92d61d-61ed-5813-a2e0-6e055c6cb564",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"task_id": "CUST-WP-0082-T25",
|
||||
"hub_task_id": "18cc3a93-f3ac-561c-84ce-8f009130c951",
|
||||
"status": "todo"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"unrelated_worktree_and_index_states_preserved": 8,
|
||||
"hardening_conformance_claimed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"verified": true,
|
||||
"original_bindings_preserved": 40,
|
||||
"new_functional_breakdown_tasks": 4,
|
||||
"wp80_total_tasks": 44,
|
||||
"wp82_live_hardening_tasks": 25,
|
||||
"deferred_full_checkpoints_not_completed": 19,
|
||||
"actual_human_and_agent_playwright_trials": "passed",
|
||||
"forgejo_next_blocker": "NetKingdom sign-in option absent",
|
||||
"wp80_status_counts": {
|
||||
"done": 15,
|
||||
"progress": 4,
|
||||
"todo": 6,
|
||||
"cancel": 19
|
||||
},
|
||||
"prior_publication_proof": "publication-readback.json",
|
||||
"goal_complete": false
|
||||
}
|
||||
|
|
@ -23,7 +23,7 @@ decision `9663d4ca-3793-4ad7-9dc1-954001d43596`.
|
|||
| Delivery milestone | Status | Observable result / remaining work |
|
||||
| --- | --- | --- |
|
||||
| 1. Playwright for a human and coding agent | **Delivered in the supervised build profile** | Both actual supported-command trials passed on railiance01, each with 14 steps, keyboard interaction and desktop/mobile screenshots. T25/T26. |
|
||||
| 2. Everyday Forgejo development | **Next; not yet accepted** | Record the actual release, verify supported sign-in and everyday Git/API use, then publish the entry commands. T19/T23. |
|
||||
| 2. Everyday Forgejo development | **Next; not yet accepted** | Current 11.0.3 release identified; API and Git respond, but NetKingdom sign-in is absent. T41 prepares the existing-owner connection; T42 activates the reviewed change; T43/T44 verify human sign-in and agent Git/API use. T23 collects acceptance. |
|
||||
| 3. Repeatable entry points and close-out | **In progress** | Supported commands, measured steps/manual touches, exact source/Hub readback and final functional audit. T33/T37/T38/T04. |
|
||||
| Earlier delivered engineering | **8 checkpoints** | Seven bounded source reviews T07-T13 plus the native scanner/publication repair T20. These retain their original scope. |
|
||||
| Security hardening | **Deferred, not fixed** | 19 complete checkpoints and 6 remaining acceptance scopes transferred to live CUST-WP-0082. All 16 full architecture gates remain unaccepted. |
|
||||
|
|
@ -35,9 +35,10 @@ This is a supervised development connection; independently authenticated human
|
|||
and registered-agent transport remains hardening work. No new service, gateway,
|
||||
identity evaluator or browser client was built.
|
||||
|
||||
**Next:** T19 first checks whether the already deployed Forgejo release supports
|
||||
the selected positive flow. Build or integrate only a demonstrated functional
|
||||
blocker; then T23 verifies actual sign-in and everyday Git/API use. Broader current
|
||||
**Next:** T19 identified the current upstream Forgejo release and the concrete
|
||||
missing NetKingdom sign-in option. T41 prepares the smallest existing-owner
|
||||
connection for that release. T42-T44 then cover activation and actual use.
|
||||
Build or integrate only a demonstrated functional blocker. Broader current
|
||||
identity, inverse, writer-exclusion and negative matrices are no longer blanket
|
||||
prerequisites for the good case. Keep at most two delivery checkpoints active.
|
||||
|
||||
|
|
@ -301,13 +302,13 @@ Transferred, not implemented: the original security acceptance and implementatio
|
|||
|
||||
```task
|
||||
id: CUST-WP-0080-T19
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T25, CUST-WP-0080-T26]
|
||||
state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8"
|
||||
```
|
||||
|
||||
Stage: functional release readiness. Owner implementation: Apps / Forge; existing release records. First identify the current deployed image, source revision and supported sign-in/Git/API behavior. Reuse it if it delivers the selected good case. Build an exact owner revision with required assets and ordinary checks only if a demonstrated functional blocker requires it. No automatic new rollout. The complete integrated security artifact acceptance remains CUST-WP-0082-T20.
|
||||
Completed functional release inventory: actual Ready Forgejo 11.0.3 upstream image, runtime digest 691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba, Deployment generation 15. Public version API and ordinary authenticated Git read respond; the login page exposes the local form with no NetKingdom option. Exact read-only observations are in wp80-build-mode-r1/forgejo-readiness.json. This identifies T41's functional blocker; it does not prove federated sign-in. Reuse the existing upstream OIDC integration first; build a changed owner revision only for an observed incompatibility. The complete integrated security artifact acceptance remains CUST-WP-0082-T20.
|
||||
|
||||
## T20 - Accept the native receive-scanner correction and ordinary publication
|
||||
|
||||
|
|
@ -349,13 +350,13 @@ Transferred, not implemented: the original security acceptance and implementatio
|
|||
|
||||
```task
|
||||
id: CUST-WP-0080-T23
|
||||
status: todo
|
||||
status: progress
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T19]
|
||||
state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90"
|
||||
```
|
||||
|
||||
Stage: functional acceptance. Owners: NetKingdom / KeyCape / Apps / Forge; existing NK-WP-0048 and owner release paths. Use the supported entry points to demonstrate actual sign-in, an everyday permitted Git operation and an API operation under the stated build profile. Record concrete results, limitations and cleanup of any trial objects. Prepare an exact reviewable change if needed; do not deploy without its actual authorization. Full per-operation current identity, denied cases, revocation, exact inverse and rollback remain CUST-WP-0082-T01-T05 and T20.
|
||||
Functional acceptance umbrella for T41-T44. Owners: NetKingdom / KeyCape / Apps / Forge; existing NK-WP-0048 and RAPPS-WP-0016 paths. Demonstrate real NetKingdom sign-in for the existing human account, plus everyday coding-agent Git and authenticated API use under the stated build profile. Preserve account/repository history and record trial cleanup. Existing local sign-in and public version API availability do not close the federated sign-in requirement. Full per-operation current identity, denied cases, revocation, exact inverse and rollback remain CUST-WP-0082-T01-T05 and T20.
|
||||
|
||||
## T24 - Accept attended U08 factor recovery and fresh sign-in
|
||||
|
||||
|
|
@ -505,7 +506,7 @@ Transferred, not implemented: the original security acceptance and implementatio
|
|||
|
||||
```task
|
||||
id: CUST-WP-0080-T37
|
||||
status: progress
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538"
|
||||
```
|
||||
|
|
@ -545,6 +546,54 @@ state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e"
|
|||
|
||||
Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T19 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery.
|
||||
|
||||
## T41 - Prepare the minimal existing-owner Forgejo sign-in connection
|
||||
|
||||
```task
|
||||
id: CUST-WP-0080-T41
|
||||
status: progress
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T19]
|
||||
state_hub_task_id: "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8"
|
||||
```
|
||||
|
||||
Implementation owners: Apps RAPPS-WP-0016-T02; KeyCape KEY-WP-0038-T02; existing NetKingdom registration/delivery path. Produce exact current issuer/client/callback and value-free custody references, then prepare the supported upstream 11.0.3 authentication-source configuration. Inspect current metadata and reuse existing registrations/delivery where present. Prove positive protocol compatibility before requiring a custom backend build. Exit: a concrete source diff and exact activation/verification/rollback packet, including actual prerequisites still missing. Do not resume the deferred per-operation client draft or implement a parallel issuer/registration service.
|
||||
|
||||
## T42 - Activate the reviewed Forgejo sign-in connection
|
||||
|
||||
```task
|
||||
id: CUST-WP-0080-T42
|
||||
status: todo
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T41]
|
||||
state_hub_task_id: "bd135b74-05db-5f51-ac89-d1967fdcf36b"
|
||||
```
|
||||
|
||||
Implementation owners: existing Apps / NetKingdom / Platform paths. Obtain the actual founder go for the exact prepared native change, plus any required owner reviews; existing scanner approval does not cover it. Execute the admitted revision, verify issuer/source readiness and the NetKingdom option, preserve local break-glass, and retain rollback/readback evidence. Exit: the sign-in option reaches the intended issuer successfully. Broader hardening is not a prerequisite unless a concrete functional blocker requires it.
|
||||
|
||||
## T43 - Verify the human Forgejo sign-in and existing-account continuity
|
||||
|
||||
```task
|
||||
id: CUST-WP-0080-T43
|
||||
status: todo
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T42]
|
||||
state_hub_task_id: "f869f913-2349-5223-8c3e-5c76f4cebe60"
|
||||
```
|
||||
|
||||
Prepare the shortest supported link/sign-in instructions for the founder's existing account. After the actual human run, verify successful NetKingdom sign-in and access to the same repositories/organisations, with a value-free receipt. Do not substitute the local password form, synthetic factors or another actor. Keep the later revocation/negative matrices in WP-82.
|
||||
|
||||
## T44 - Verify coding-agent Git and authenticated API use
|
||||
|
||||
```task
|
||||
id: CUST-WP-0080-T44
|
||||
status: todo
|
||||
priority: high
|
||||
depends_on: [CUST-WP-0080-T42]
|
||||
state_hub_task_id: "8c9c4dda-5047-5d37-9037-4f7e5eac53d8"
|
||||
```
|
||||
|
||||
Use an existing supported coding-agent access path and its stated build profile. Verify an ordinary Git read/write and authenticated API read, with exact source/result evidence and cleanup for any disposable object. Discover credential ownership through warden route; distribute no administrator kubeconfig or secret through coordination. The public version endpoint alone is insufficient. Publish the canonical owner commands and actual profile limits for T33/T37; independent current KeyCape checks per operation remain WP-82 work.
|
||||
|
||||
## Original security acceptance mapping retained for WP-82
|
||||
|
||||
| Architecture gate | Custodian evidence checkpoints |
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue