From bab3dd1c9df67f344fb207904a8edb3896bf4bd1 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 18 Oct 2026 18:51:35 +0200 Subject: [PATCH] Break Forgejo good-case delivery into four observable checkpoints --- .../wp80-build-mode-r1/README.md | 17 + .../wp80-build-mode-r1/forgejo-readiness.json | 37 ++ .../publication-readback.json | 348 ++++++++++++++++++ .../wp80-build-mode-r1/validation-r2.json | 18 + ...gdom-security-blueprint-and-gap-closure.md | 67 +++- 5 files changed, 478 insertions(+), 9 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/forgejo-readiness.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/publication-readback.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation-r2.json diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md index 234b529..78d982f 100644 --- a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md @@ -79,3 +79,20 @@ flow before deciding whether a source change or rollout is needed. Publish its working owner commands and bounded measurements, then audit both functional milestones and the live hardening handoff. Source files remain authoritative; normal consistency/publication and exact Hub readback must verify this revision. + +## Forgejo follow-through and publication + +The read-only [Forgejo readiness check](forgejo-readiness.json) identifies the +running upstream 11.0.3 image and its immutable runtime digest. The API and existing +developer Git connection respond, while the login page has no NetKingdom option. +The current release inventory is complete (T19). The next work is now split into +four visible source tasks: T41 prepares the smallest existing-owner sign-in +connection; T42 activates its exact reviewed/authorized revision; T43 verifies the +real human account; T44 verifies coding-agent Git and authenticated API use. +No blanket security-completion prerequisite or new runtime grant is implied. + +The first refinement was normally published as `4367456d29069d7616d91b3b0cac549a09abf113`. +[Primary readback](publication-readback.json) verified every original WP-80 binding +and all 25 new WP-82 checkpoints, with all eight unrelated worktree/index states +preserved exactly. The four additional functional tasks keep every original ID +unchanged and use normal Repo Manager-assigned identifiers. diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/forgejo-readiness.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/forgejo-readiness.json new file mode 100644 index 0000000..0734ae0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/forgejo-readiness.json @@ -0,0 +1,37 @@ +{ + "observed_at": "2026-10-18", + "observation_scope": "Read-only native/public metadata and ordinary existing Git connection; no authentication-source or deployment mutation", + "deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355", + "generation": 15, + "ready_replicas": 1, + "configured_image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless", + "runtime_image_id": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba", + "public_version_api": { + "path": "/api/v1/version", + "http_status": 200, + "version": "11.0.3+gitea-1.22.0", + "authenticated_consumer_proof": false + }, + "public_login": { + "path": "/user/login", + "http_status": 200, + "local_login_form": true, + "netkingdom_keycape_oauth2_mentions": 0, + "federated_signin_verified": false + }, + "git_read": { + "command": "git ls-remote origin refs/heads/main", + "status": "passed", + "observed_revision_before_refinement": "6dd619fdc7d1351fcdfd3fcac571a90b1925e3ac", + "profile": "existing authenticated workstation developer SSH path", + "independent_current_keycape_identity_proved": false + }, + "next_functional_blocker": "No NetKingdom sign-in option. Prepare existing owner registration/custody/authentication-source connection using the current release first.", + "remaining_checkpoints": [ + "CUST-WP-0080-T41", + "CUST-WP-0080-T42", + "CUST-WP-0080-T43", + "CUST-WP-0080-T44" + ], + "no_new_native_or_credential_authority": true +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/publication-readback.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/publication-readback.json new file mode 100644 index 0000000..863d1d3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/publication-readback.json @@ -0,0 +1,348 @@ +{ + "verified": true, + "commit": "4367456d29069d7616d91b3b0cac549a09abf113", + "primary_projection_exact": true, + "workplans": [ + { + "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52", + "source": "CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md", + "verified_tasks": 40, + "bindings": [ + { + "task_id": "CUST-WP-0080-T01", + "hub_task_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T02", + "hub_task_id": "5973026f-8ca9-5882-99fe-65a54bc250ac", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T03", + "hub_task_id": "87637402-02f1-57c1-8fbc-4141598af8e3", + "status": "progress" + }, + { + "task_id": "CUST-WP-0080-T04", + "hub_task_id": "82378b0f-7004-5c2f-9683-b356a1227576", + "status": "todo" + }, + { + "task_id": "CUST-WP-0080-T05", + "hub_task_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T06", + "hub_task_id": "6aca534c-5c7a-556f-b6b6-406433670c29", + "status": "progress" + }, + { + "task_id": "CUST-WP-0080-T07", + "hub_task_id": "bb236dea-30f7-5437-b01c-f14d2509e061", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T08", + "hub_task_id": "18b885fe-503f-5ebc-b390-808f71316264", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T09", + "hub_task_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T10", + "hub_task_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T11", + "hub_task_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T12", + "hub_task_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T13", + "hub_task_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T14", + "hub_task_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T15", + "hub_task_id": "434d9c78-7789-5b78-8d9d-d87b0638b469", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T16", + "hub_task_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T17", + "hub_task_id": "4de46468-7ae2-59e3-be2b-1a32506153a5", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T18", + "hub_task_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T19", + "hub_task_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8", + "status": "progress" + }, + { + "task_id": "CUST-WP-0080-T20", + "hub_task_id": "0d9df435-b9a2-5b89-833d-799785c969a9", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T21", + "hub_task_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T22", + "hub_task_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T23", + "hub_task_id": "266e228b-7754-5323-b0c6-37f860592d90", + "status": "todo" + }, + { + "task_id": "CUST-WP-0080-T24", + "hub_task_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T25", + "hub_task_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T26", + "hub_task_id": "0491b6b4-a238-58ef-bf3a-505749e5655c", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T27", + "hub_task_id": "19540d29-c4df-5f1a-acf7-127965c9a396", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T28", + "hub_task_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T29", + "hub_task_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T30", + "hub_task_id": "457400ad-6c44-5160-a77a-63c6ad5acabc", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T31", + "hub_task_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T32", + "hub_task_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T33", + "hub_task_id": "4547ac4c-8893-54fe-ae6e-362682bb7920", + "status": "todo" + }, + { + "task_id": "CUST-WP-0080-T34", + "hub_task_id": "393b9fcc-323b-5182-92c6-44530fce7efb", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T35", + "hub_task_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T36", + "hub_task_id": "586232a1-57b0-5e04-a61b-fb687bcc8999", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T37", + "hub_task_id": "d533ca34-a691-5f8e-8cc2-5f408b679538", + "status": "progress" + }, + { + "task_id": "CUST-WP-0080-T38", + "hub_task_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228", + "status": "done" + }, + { + "task_id": "CUST-WP-0080-T39", + "hub_task_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c", + "status": "cancel" + }, + { + "task_id": "CUST-WP-0080-T40", + "hub_task_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e", + "status": "cancel" + } + ] + }, + { + "workplan_id": "b29f9f25-b508-5c2c-98fd-2f6877f109cf", + "source": "CUST-WP-0082-netkingdom-security-hardening.md", + "verified_tasks": 25, + "bindings": [ + { + "task_id": "CUST-WP-0082-T01", + "hub_task_id": "2ac61e1a-5a01-5ff9-ae35-017efe1e987c", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T02", + "hub_task_id": "a88d7bbe-49d8-5dc0-a613-eeebb756bd0c", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T03", + "hub_task_id": "55e99c7e-69de-523a-88f1-660c3f69edb0", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T04", + "hub_task_id": "aa7112b1-e76e-520e-a59a-6aa4aa39b35d", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T05", + "hub_task_id": "8e9c5b9a-8315-5efa-9cd3-00a113c6ea81", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T06", + "hub_task_id": "a7cf387e-da06-5cca-8815-43a4ecbf8ea9", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T07", + "hub_task_id": "c555c76a-00e8-5d07-9aef-7a4e6ac7ea11", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T08", + "hub_task_id": "f1dbdb5d-30cb-5012-9fa5-e59520ba2aae", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T09", + "hub_task_id": "88c0467d-b8b8-5972-b50a-2a87b51365fb", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T10", + "hub_task_id": "5ddfe024-b823-51c9-ac4d-ec5e53c47346", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T11", + "hub_task_id": "5b3767a0-5657-5ae3-b094-70e429a26617", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T12", + "hub_task_id": "cbac0912-ac45-58d4-93db-8f49ac7750b2", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T13", + "hub_task_id": "1903466c-674f-5025-acd7-873396c6d2fe", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T14", + "hub_task_id": "38363478-e46b-54bd-972d-ce998f3b8dd0", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T15", + "hub_task_id": "564a545a-b43d-5013-8f1b-e34cd54b52c7", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T16", + "hub_task_id": "90c8fb36-9032-57e7-85da-684d18e5c0b1", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T17", + "hub_task_id": "9e35af30-ec53-58f4-8517-5a5df85b6c79", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T18", + "hub_task_id": "316d9fc2-27e3-53ce-809d-a50769fa9734", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T19", + "hub_task_id": "9e26f419-0547-596a-bd0c-66b39f2d6ba8", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T20", + "hub_task_id": "eef7e3d9-9cfb-5525-af82-a8cc1bba6e67", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T21", + "hub_task_id": "d3dd8c35-284b-5035-a1a3-e0a0dbef86ba", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T22", + "hub_task_id": "43a94f1e-e906-55ac-a837-d9ce5c495d6b", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T23", + "hub_task_id": "4fda91f5-94c1-52fc-9dbd-c3693950165b", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T24", + "hub_task_id": "2c92d61d-61ed-5813-a2e0-6e055c6cb564", + "status": "todo" + }, + { + "task_id": "CUST-WP-0082-T25", + "hub_task_id": "18cc3a93-f3ac-561c-84ce-8f009130c951", + "status": "todo" + } + ] + } + ], + "unrelated_worktree_and_index_states_preserved": 8, + "hardening_conformance_claimed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation-r2.json b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation-r2.json new file mode 100644 index 0000000..568a7e6 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/validation-r2.json @@ -0,0 +1,18 @@ +{ + "verified": true, + "original_bindings_preserved": 40, + "new_functional_breakdown_tasks": 4, + "wp80_total_tasks": 44, + "wp82_live_hardening_tasks": 25, + "deferred_full_checkpoints_not_completed": 19, + "actual_human_and_agent_playwright_trials": "passed", + "forgejo_next_blocker": "NetKingdom sign-in option absent", + "wp80_status_counts": { + "done": 15, + "progress": 4, + "todo": 6, + "cancel": 19 + }, + "prior_publication_proof": "publication-readback.json", + "goal_complete": false +} diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 53e7450..f661ab7 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -23,7 +23,7 @@ decision `9663d4ca-3793-4ad7-9dc1-954001d43596`. | Delivery milestone | Status | Observable result / remaining work | | --- | --- | --- | | 1. Playwright for a human and coding agent | **Delivered in the supervised build profile** | Both actual supported-command trials passed on railiance01, each with 14 steps, keyboard interaction and desktop/mobile screenshots. T25/T26. | -| 2. Everyday Forgejo development | **Next; not yet accepted** | Record the actual release, verify supported sign-in and everyday Git/API use, then publish the entry commands. T19/T23. | +| 2. Everyday Forgejo development | **Next; not yet accepted** | Current 11.0.3 release identified; API and Git respond, but NetKingdom sign-in is absent. T41 prepares the existing-owner connection; T42 activates the reviewed change; T43/T44 verify human sign-in and agent Git/API use. T23 collects acceptance. | | 3. Repeatable entry points and close-out | **In progress** | Supported commands, measured steps/manual touches, exact source/Hub readback and final functional audit. T33/T37/T38/T04. | | Earlier delivered engineering | **8 checkpoints** | Seven bounded source reviews T07-T13 plus the native scanner/publication repair T20. These retain their original scope. | | Security hardening | **Deferred, not fixed** | 19 complete checkpoints and 6 remaining acceptance scopes transferred to live CUST-WP-0082. All 16 full architecture gates remain unaccepted. | @@ -35,9 +35,10 @@ This is a supervised development connection; independently authenticated human and registered-agent transport remains hardening work. No new service, gateway, identity evaluator or browser client was built. -**Next:** T19 first checks whether the already deployed Forgejo release supports -the selected positive flow. Build or integrate only a demonstrated functional -blocker; then T23 verifies actual sign-in and everyday Git/API use. Broader current +**Next:** T19 identified the current upstream Forgejo release and the concrete +missing NetKingdom sign-in option. T41 prepares the smallest existing-owner +connection for that release. T42-T44 then cover activation and actual use. +Build or integrate only a demonstrated functional blocker. Broader current identity, inverse, writer-exclusion and negative matrices are no longer blanket prerequisites for the good case. Keep at most two delivery checkpoints active. @@ -301,13 +302,13 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T19 -status: progress +status: done priority: high depends_on: [CUST-WP-0080-T25, CUST-WP-0080-T26] state_hub_task_id: "4ffd2e33-d887-5686-bad1-7f32a56191a8" ``` -Stage: functional release readiness. Owner implementation: Apps / Forge; existing release records. First identify the current deployed image, source revision and supported sign-in/Git/API behavior. Reuse it if it delivers the selected good case. Build an exact owner revision with required assets and ordinary checks only if a demonstrated functional blocker requires it. No automatic new rollout. The complete integrated security artifact acceptance remains CUST-WP-0082-T20. +Completed functional release inventory: actual Ready Forgejo 11.0.3 upstream image, runtime digest 691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba, Deployment generation 15. Public version API and ordinary authenticated Git read respond; the login page exposes the local form with no NetKingdom option. Exact read-only observations are in wp80-build-mode-r1/forgejo-readiness.json. This identifies T41's functional blocker; it does not prove federated sign-in. Reuse the existing upstream OIDC integration first; build a changed owner revision only for an observed incompatibility. The complete integrated security artifact acceptance remains CUST-WP-0082-T20. ## T20 - Accept the native receive-scanner correction and ordinary publication @@ -349,13 +350,13 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T23 -status: todo +status: progress priority: high depends_on: [CUST-WP-0080-T19] state_hub_task_id: "266e228b-7754-5323-b0c6-37f860592d90" ``` -Stage: functional acceptance. Owners: NetKingdom / KeyCape / Apps / Forge; existing NK-WP-0048 and owner release paths. Use the supported entry points to demonstrate actual sign-in, an everyday permitted Git operation and an API operation under the stated build profile. Record concrete results, limitations and cleanup of any trial objects. Prepare an exact reviewable change if needed; do not deploy without its actual authorization. Full per-operation current identity, denied cases, revocation, exact inverse and rollback remain CUST-WP-0082-T01-T05 and T20. +Functional acceptance umbrella for T41-T44. Owners: NetKingdom / KeyCape / Apps / Forge; existing NK-WP-0048 and RAPPS-WP-0016 paths. Demonstrate real NetKingdom sign-in for the existing human account, plus everyday coding-agent Git and authenticated API use under the stated build profile. Preserve account/repository history and record trial cleanup. Existing local sign-in and public version API availability do not close the federated sign-in requirement. Full per-operation current identity, denied cases, revocation, exact inverse and rollback remain CUST-WP-0082-T01-T05 and T20. ## T24 - Accept attended U08 factor recovery and fresh sign-in @@ -505,7 +506,7 @@ Transferred, not implemented: the original security acceptance and implementatio ```task id: CUST-WP-0080-T37 -status: progress +status: todo priority: high state_hub_task_id: "d533ca34-a691-5f8e-8cc2-5f408b679538" ``` @@ -545,6 +546,54 @@ state_hub_task_id: "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e" Transferred, not implemented: the original security acceptance and implementation-owner references now live in CUST-WP-0082-T19 in [WP-82](CUST-WP-0082-netkingdom-security-hardening.md). Founder sequencing decision 9663d4ca-3793-4ad7-9dc1-954001d43596. Original identity and history are retained; this cancellation counts as deferred work, not completed delivery. +## T41 - Prepare the minimal existing-owner Forgejo sign-in connection + +```task +id: CUST-WP-0080-T41 +status: progress +priority: high +depends_on: [CUST-WP-0080-T19] +state_hub_task_id: "d6f1da6c-4e5f-5bb6-bbf2-ddddd69646e8" +``` + +Implementation owners: Apps RAPPS-WP-0016-T02; KeyCape KEY-WP-0038-T02; existing NetKingdom registration/delivery path. Produce exact current issuer/client/callback and value-free custody references, then prepare the supported upstream 11.0.3 authentication-source configuration. Inspect current metadata and reuse existing registrations/delivery where present. Prove positive protocol compatibility before requiring a custom backend build. Exit: a concrete source diff and exact activation/verification/rollback packet, including actual prerequisites still missing. Do not resume the deferred per-operation client draft or implement a parallel issuer/registration service. + +## T42 - Activate the reviewed Forgejo sign-in connection + +```task +id: CUST-WP-0080-T42 +status: todo +priority: high +depends_on: [CUST-WP-0080-T41] +state_hub_task_id: "bd135b74-05db-5f51-ac89-d1967fdcf36b" +``` + +Implementation owners: existing Apps / NetKingdom / Platform paths. Obtain the actual founder go for the exact prepared native change, plus any required owner reviews; existing scanner approval does not cover it. Execute the admitted revision, verify issuer/source readiness and the NetKingdom option, preserve local break-glass, and retain rollback/readback evidence. Exit: the sign-in option reaches the intended issuer successfully. Broader hardening is not a prerequisite unless a concrete functional blocker requires it. + +## T43 - Verify the human Forgejo sign-in and existing-account continuity + +```task +id: CUST-WP-0080-T43 +status: todo +priority: high +depends_on: [CUST-WP-0080-T42] +state_hub_task_id: "f869f913-2349-5223-8c3e-5c76f4cebe60" +``` + +Prepare the shortest supported link/sign-in instructions for the founder's existing account. After the actual human run, verify successful NetKingdom sign-in and access to the same repositories/organisations, with a value-free receipt. Do not substitute the local password form, synthetic factors or another actor. Keep the later revocation/negative matrices in WP-82. + +## T44 - Verify coding-agent Git and authenticated API use + +```task +id: CUST-WP-0080-T44 +status: todo +priority: high +depends_on: [CUST-WP-0080-T42] +state_hub_task_id: "8c9c4dda-5047-5d37-9037-4f7e5eac53d8" +``` + +Use an existing supported coding-agent access path and its stated build profile. Verify an ordinary Git read/write and authenticated API read, with exact source/result evidence and cleanup for any disposable object. Discover credential ownership through warden route; distribute no administrator kubeconfig or secret through coordination. The public version endpoint alone is insufficient. Publish the canonical owner commands and actual profile limits for T33/T37; independent current KeyCape checks per operation remain WP-82 work. + ## Original security acceptance mapping retained for WP-82 | Architecture gate | Custodian evidence checkpoints |