From c882bbf7970658418cf5f45b82fe5d7d1cc67429 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 00:26:54 +0100 Subject: [PATCH] docs: record native-return metadata refusal and final consistency proof --- .../consistency-confirmation.json | 15 ++++++++++++ .../smtp-return-file-checks.json | 12 ++++++++++ .../smtp-return-finding.json | 23 +++++++++++++++++++ .../sync-closeout-receipt.json | 17 ++++++++++++++ docs/repository-sync-2026-11-01.md | 10 +++++++- 5 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 docs/changes/2026-11-01-scanner-json-digest/consistency-confirmation.json create mode 100644 docs/changes/2026-11-01-scanner-json-digest/smtp-return-file-checks.json create mode 100644 docs/changes/2026-11-01-scanner-json-digest/smtp-return-finding.json diff --git a/docs/changes/2026-11-01-scanner-json-digest/consistency-confirmation.json b/docs/changes/2026-11-01-scanner-json-digest/consistency-confirmation.json new file mode 100644 index 00000000..8e5eb721 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/consistency-confirmation.json @@ -0,0 +1,15 @@ +{ + "repo_slug": "the-custodian", + "source_revision": "fb7c116c3d8d9d8dc4ae80bbe9e64230ef6d8eaa", + "result": "warn", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 10, + "info": 4 + }, + "fixes_applied": [ + "bindings: synced 91/91", + "brief: .custodian-brief.md updated" + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/smtp-return-file-checks.json b/docs/changes/2026-11-01-scanner-json-digest/smtp-return-file-checks.json new file mode 100644 index 00000000..66a021ee --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/smtp-return-file-checks.json @@ -0,0 +1,12 @@ +[ + { + "path": "/home/worsch/coulomb-social/docs/release/platform-sender-independent-return-2026-11-01.json", + "scanner_exit": 1, + "sha256": "1658ba35a77c525bbc7aa577a6b24aaf855cdcf0b94b3638e20a22f3f4728dad" + }, + { + "path": "/home/worsch/coulomb-social/docs/release/platform-smtp-independent-return-2026-11-01.json", + "scanner_exit": 1, + "sha256": "06e691dbbc2bba60597b3531814a490dbb8c5c4eeba79a6d6b7d54830abac991" + } +] diff --git a/docs/changes/2026-11-01-scanner-json-digest/smtp-return-finding.json b/docs/changes/2026-11-01-scanner-json-digest/smtp-return-finding.json new file mode 100644 index 00000000..357e0360 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/smtp-return-finding.json @@ -0,0 +1,23 @@ +{ + "object_id": "2080be11f9d68802a5df426b9dda5256d41e928f", + "findings": [ + { + "rule": "generic-api-key", + "line": 23, + "key": "\"SecretStore\"", + "value_is_uuid": true + }, + { + "rule": "generic-api-key", + "line": 24, + "key": "\"ExternalSecret\"", + "value_is_uuid": true + }, + { + "rule": "generic-api-key", + "line": 25, + "key": "\"Secret\"", + "value_is_uuid": true + } + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json index 99963ef8..85519e40 100644 --- a/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json +++ b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json @@ -179,5 +179,22 @@ "coulomb-social": "ea09958", "railiance-platform": "16b4e33", "both_normal_receiver_acceptances": true + }, + "late_smtp_return_records": { + "coulomb-social_unpublished_commit": "8ef931e950660d3574ea853a30cd448af1213ffd", + "receiver_blocked_object": "2080be11f9d68802a5df426b9dda5256d41e928f", + "classification": "UUID-valued Kubernetes resource identity fields; schema-specific metadata finding", + "both_return_files_locally_refused": true, + "platform_readiness_and_paired_receipt_preserved_unstaged": true + }, + "consistency_confirmation": { + "source_revision": "fb7c116c3d8d9d8dc4ae80bbe9e64230ef6d8eaa", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 10, + "info": 4 + }, + "source_files_unchanged_by_confirmation": true } } diff --git a/docs/repository-sync-2026-11-01.md b/docs/repository-sync-2026-11-01.md index 78619b1f..bc4c7194 100644 --- a/docs/repository-sync-2026-11-01.md +++ b/docs/repository-sync-2026-11-01.md @@ -25,11 +25,19 @@ The latest full tip sweep proved 168 equal checkout tips: 167 primary repositori | Apps custody/cust81-apps-unpublished-r2 | JSON filename/SHA256 manifest in introduced history | Historical branch preserved; same tested serialization class | | RApp user-engine backup/wp0004-pre-envstrip | Captured GPG_KEY entries in native image environment reports, four findings | 40-character hexadecimal fingerprint-shaped data is not a private-key payload; preserve historical branch pending exact review rather than call it a credential leak | | Social csoc-unpublished-progress-20261027 | Receiver rejects docs/usecases/platform-communication.md blob 0a6ca11b651ad3acde166e332e5653001741ee71, line 41 | Redacted review identifies prose in a diagnostic-redaction requirement; branch retained pending content-bound adjudication | -| State-hub nine weekly review JSON files | Generated-only commit guard | Preserve local evidence; define an approved durable operating-evidence publication rule rather than bypass the source-change gate | +| State-hub weekly review JSON files (ten at the final pass) | Generated-only commit guard | Preserve local evidence; define an approved durable operating-evidence publication rule rather than bypass the source-change gate | | Four managed INTENT.md overlays | Generated bootstrap content in old pinned caches differs from current owner intent | Preserve as analysis state; do not publish over the primary owner declaration | All 139 Custodian paths have actual rule/line diagnostics, not an assumption of harmlessness. The report describes line contexts (hash-like strings, UUIDs, fixture text or source expressions); those classifications do not establish credential validity. An earlier empty report-transport experiment was discarded as unverified and superseded by complete redacted reports. The social history also demonstrates why commit-diff scanning is insufficient: its diff inspection was clean, but the complete introduced-object receiver found the blob. +## Late native-return metadata refusal + +The completed SMTP return records appeared during final verification. Their inspected JSON is value-free native-result metadata, but the current scanner rejects UUID-valued Kubernetes resource identities under SecretStore, ExternalSecret and Secret. The shared foundation receipt is blob 2080be11f9d68802a5df426b9dda5256d41e928f. The receiver rejected the resulting unpublished coulomb-social commit 8ef931e950660d3574ea853a30cd448af1213ffd; separate checks show both return files refuse under the original profile. Its published main remains at the tested launcher commit. The paired railiance-platform readiness update and receipt were kept together and unstaged after their failed commit, preserving every working file. No branch history was rewritten to conceal the failure. + +These resource identities require schema-specific, content-bound adjudication. A global UUID exception for fields named Secret would be too broad. The source candidate for JSON filename/digest serialization does not claim to solve this different case. Value-free diagnostics are in smtp-return-finding.json and smtp-return-file-checks.json beside the existing proposal. + +The required consistency pass created all ten task bindings; direct API reads verified five done and five wait, including the human-needed founder checkpoint. After those source IDs were committed and published, a confirmation pass reported zero failures/automation errors and left authoritative source files unchanged; its ten warnings are separate consistency advisories. See consistency-receipt.json, projected-tasks.json and consistency-confirmation.json. The native scanner preflight result remains unavailable. Publication is still incomplete, and the full goal/workplan remains blocked on the controlled scanner review and native path. + ## Class-level repairs and suggestions 1. **Generated local state:** keep orientation briefs local with precise ignores and remove tracked copies without deleting the working file. Generate tracked indexes from staged authoritative sources, as now adopted in the three affected repositories. Keep disposable analysis overlays outside owner source.