Record shared HTTPS upload budget for close-down review

docs/security-close-down-checklist.md

@@ -29,3 +29,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi
 | 20 | Unattended origin publication for assembly-economics checkpoints | rein-aharness approach `assembly-checkpoint` pushes to `coulomb/assembly-economics` origin without an attended session, limited to `checkpoints/`, fast-forward only, rebase-once, never force (mirrors the FI brief grant). Founder-approved 2026-10-12: assembly-economics `docs/decisions/2026-10-12-checkpoint-origin-publication.md`. Runs on legacy profile-absent routing until 2026-12-31. | Publication through rein-aharness's governed publish lane with a per-repo, path-scoped grant and a governed execution profile; legacy route removed. | rein-aharness / assembly-economics | 2026-10-12 |
 | 21 | Independent repository secret detection and response (CUST-WP-0080 G07) | Scanner active on 22 workstation checkouts and 166 of 167 Forgejo repositories. Exact expansion of 143 targets passed native SSH scanner verdicts and final cleanup audit; one repository with four external submodules remains builtin-only. [Expansion evidence](evidence/2026-10-13-netkingdom-security/forge-expansion-final.json). Template inheritance deployed October 13; its first rollout broke scanner custody permissions and is retained as failed. Recovery adds a pinned startup guard; two Kubernetes replacements (generations 13/14) pass 0755 custody and native clean/secret/quarantine/recovery checks. Thirty isolated configuration/lifecycle/rollback checks pass; authenticated production API/SSO/frontend acceptance remains open. Import/mirror fetch, historical/LFS/log/artifact coverage and private finding response remain open. [Recovery evidence](evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json). | Complete FORGE-WP-0006 and RMGR-WP-0021: admit the full repository denominator, persist/reconcile hooks across creation and lifecycle, verify deployed write paths and unsupported input handling, and prove private detection-to-response with existing custody owners. Rejection alone does not revoke prior exposure; CUST-WP-0073-T05 remains founder-deferred. | railiance-forge, repo-manager; Custodian coordinates | 2026-10-13 |
 | 22 | CI runner authority boundary (CUST-WP-0080 G12) | Reproduced unauthenticated cross-pod Docker access is closed: same-image generation 4 listens on loopback only, local ping and heartbeat pass, peer pod denied. [Evidence](evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json). Host-mode jobs still share the privileged runner; no full isolation or job-scoped credential claim. | Complete native workflow authority, required detection checks, job identity/expiry and privileged runner trust boundaries under FORGE-WP-0006 / RMGR-WP-0021. Preserve loopback-only listener across deployments. | railiance-forge, railiance-enablement, railiance-platform; source railiance-apps | 2026-10-13 |
+| 23 | Traefik HTTPS upload read budget | Prepared 2026-10-13: raise shared websecure readTimeout from 60s to bounded 600s because authenticated Forgejo OCI blobs are truncated at 60s. Activation and publication proof tracked by railiance-cluster RCLUSTER-WP-0016 and rapp-playwright WP-0003-T01. TLS and registry authentication stay enforced. | At production close-down review the 600s body-read budget and slow-upload exposure; retain a measured artifact-upload budget or isolate the registry entry point. Do not disable timeouts. | railiance-cluster / railiance-forge | 2026-10-13 |