From df7aa88bcac3a2c22a61f5bbafd8af6720b85a25 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 12:18:46 +0100 Subject: [PATCH] Verify remaining finding classes and preserve historical publication blockers --- .../remaining-branch-publication-check.json | 56 ++ .../remaining-git-object-identities.json | 549 ++++++++++++++++++ .../remaining-matched-value-shapes.json | 39 ++ docs/repository-sync-2026-11-01.md | 18 + ...0083-fleet-sync-and-scanner-remediation.md | 4 +- 5 files changed, 664 insertions(+), 2 deletions(-) create mode 100644 docs/changes/2026-11-01-scanner-json-digest/remaining-branch-publication-check.json create mode 100644 docs/changes/2026-11-01-scanner-json-digest/remaining-git-object-identities.json create mode 100644 docs/changes/2026-11-01-scanner-json-digest/remaining-matched-value-shapes.json diff --git a/docs/changes/2026-11-01-scanner-json-digest/remaining-branch-publication-check.json b/docs/changes/2026-11-01-scanner-json-digest/remaining-branch-publication-check.json new file mode 100644 index 00000000..86f14478 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/remaining-branch-publication-check.json @@ -0,0 +1,56 @@ +{ + "captured_at": "2026-11-02T11:18:36.065106+00:00", + "scope": "Exact remote branch names for local histories absent from fetched refs. No branch was pushed or rewritten.", + "rows": [ + { + "path": "/home/worsch/rapp-user-engine", + "branch": "refs/heads/backup/wp0004-pre-envstrip", + "tip": "018f79e40e180c5d62890248473b50e98c88db94", + "commits_absent_from_fetched_remote_refs": 4, + "remote_query_returncode": 2, + "remote_branch_tip": null, + "same_named_branch_published": false, + "remote_branch_absent": true + }, + { + "path": "/home/worsch/coulomb-social", + "branch": "refs/heads/archive/csoc-t02-before-public-uid-correction-20261102", + "tip": "871e0b11f71019c373750749d71a0643dcdb848e", + "commits_absent_from_fetched_remote_refs": 4, + "remote_query_returncode": 2, + "remote_branch_tip": null, + "same_named_branch_published": false, + "remote_branch_absent": true + }, + { + "path": "/home/worsch/coulomb-social", + "branch": "refs/heads/csoc-unpublished-progress-20261027", + "tip": "c6bd899d81257436ab6050891f82f92f47cd8c3b", + "commits_absent_from_fetched_remote_refs": 4, + "remote_query_returncode": 2, + "remote_branch_tip": null, + "same_named_branch_published": false, + "remote_branch_absent": true + }, + { + "path": "/home/worsch/rapp-flex-auth-secrets-engine", + "branch": "refs/heads/main", + "tip": "6e1753a379b72e2d0d6fbc62cd7d0468b87d8d22", + "commits_absent_from_fetched_remote_refs": 3, + "remote_query_returncode": 0, + "remote_branch_tip": "7bc817bd2b4440de97382a2330ef3cf68a81832d", + "same_named_branch_published": false, + "remote_branch_absent": false + }, + { + "path": "/home/worsch/railiance-apps", + "branch": "refs/heads/custody/cust81-apps-unpublished-r2", + "tip": "6a8a54d609d8c6f9d984d97414ecaadcab1f894c", + "commits_absent_from_fetched_remote_refs": 2, + "remote_query_returncode": 2, + "remote_branch_tip": null, + "same_named_branch_published": false, + "remote_branch_absent": true + } + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/remaining-git-object-identities.json b/docs/changes/2026-11-01-scanner-json-digest/remaining-git-object-identities.json new file mode 100644 index 00000000..ffb3aa98 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/remaining-git-object-identities.json @@ -0,0 +1,549 @@ +{ + "findings": 45, + "distinct_values": 10, + "verified_findings": 45, + "verified_distinct_values": 10, + "limits": "Object existence proves a Git identity, not that its content or every containing blob is approved for publication.", + "rows": [ + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/manifest-r2.json", + "line": 26, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/manifest.json", + "line": 26, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/owner-source-review-r1.json", + "line": 49, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/actual-python-source/source-dependencies.json", + "line": 19, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/manifest.json", + "line": 43, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-preparation/trusted-positive-path-r1.json", + "line": 36, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/manifest-r1.json", + "line": 4, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/manifest-r2.json", + "line": 4, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/owner-review-r1.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/owner-review-r2.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/build-receipt.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/build-receipt.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "tree" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r1/build-receipt.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r1/build-receipt.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "tree" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r2/build-receipt.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r2/build-receipt.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "tree" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/build-receipt.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/build-receipt.json", + "line": 5, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "tree" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-install-receipt.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-producer-api-sourcecheck.json", + "line": 2, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-producer-api-sourcecheck.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-full.patch", + "line": 145, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-full.patch", + "line": 146, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-over-r2.patch", + "line": 40, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-over-r2.patch", + "line": 41, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-over-r3.patch", + "line": 9, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-over-r3.patch", + "line": 10, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/r3-preimages/docs/proposals/native-cli-admission/proposal.json", + "line": 116, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/r3-preimages/docs/proposals/native-cli-admission/proposal.json", + "line": 117, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/producer-manifest.json", + "line": 43, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/access-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/preparation.json", + "line": 27, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r1/preparation.json", + "line": 20, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r2/preparation.json", + "line": 23, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r3/preparation.json", + "line": 23, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r4/preparation.json", + "line": 24, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/preparation.json", + "line": 27, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-result-attempt2.json", + "line": 168, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-private-input-r1/evidence/chart-source-inventory-original.json", + "line": 4, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/source-inventory.json", + "line": 8, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-key-cape.json", + "line": 9, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/apps-chart-source-inventory.original.json", + "line": 4, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/key39-current-verification.original.json", + "line": 3, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/producer-race-result.json", + "line": 174, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/secrets-engine", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/public-metadata-derivation.v1.json", + "line": 200, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-ongoing-identity-r1/baseline.json", + "line": 2, + "matched_value_shape": "lowercase-hex-40", + "verified_object_copies": [ + { + "repo": "/home/worsch/key-cape", + "object_type": "commit" + } + ], + "object_identity_found": true + } + ] +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/remaining-matched-value-shapes.json b/docs/changes/2026-11-01-scanner-json-digest/remaining-matched-value-shapes.json new file mode 100644 index 00000000..e1422204 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/remaining-matched-value-shapes.json @@ -0,0 +1,39 @@ +{ + "captured_at": "2026-11-02T11:14:06.843436+00:00", + "scope": "Remaining 113 Custodian files under approved revision-5 candidate profile; inspection only, no admission or publication.", + "profile_sha256": "e8ededac85afff19ff3d20dd1e9049d206eb131772ec9aec4ac08b8b81f520e2", + "files": 113, + "findings": 310, + "rules": { + "generic-api-key": 303, + "discord-api-token": 5, + "bitbucket-client-secret": 2 + }, + "matched_value_shapes": { + "test-sentinel": 1, + "lowercase-hex-64": 253, + "lowercase-hex-40": 45, + "opaque": 7, + "uuid": 4 + }, + "no_raw_match_or_matched_values_retained": true, + "detailed_value_free_receipt": "/tmp/sync-findings-r5-value-shapes.json", + "detailed_receipt_sha256": "3df2a901b0399bcbb2d30f2254669640c922c4f2cb6b5c3f367d6b3ad741e290", + "confirmed_source_syntax_false_positive": { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/repo-manager/src/repo_manager/commands/registrar_reconcile.py", + "line": 701, + "evidence": "Parsed AST identifies a _check_primary function call with variable arguments, with no credential literal in the statement." + }, + "other_nonhex_findings": { + "fixture_token_sentinel": 1, + "fixture_dictionary_literal_fields": 2, + "patch_values_length_65_under_sha256_prefix": 3, + "markdown_match_not_adjudicated": 1 + }, + "limits": [ + "Hex and UUID shapes do not prove public-data provenance.", + "Existing signed or digest-bound archive originals must remain byte-identical.", + "No blanket hash, UUID, directory, or rule exemption is authorized by this analysis.", + "No content-bound adjudication implementation or native deployment has been performed." + ] +} diff --git a/docs/repository-sync-2026-11-01.md b/docs/repository-sync-2026-11-01.md index eb3788fb..6088d8a4 100644 --- a/docs/repository-sync-2026-11-01.md +++ b/docs/repository-sync-2026-11-01.md @@ -123,3 +123,21 @@ Exact revision5 packet `95c2724ea65ee3f4ce42b96bbb2b839b02169d62faa4c0a9a6c320cf ### Revision-5 candidate rescan of original refused files A value-free rescan of all 139 original Custodian refused file contents with the approved candidate profile found 26 clean files and 113 files retaining 310 generic-api-key findings. Containing-line shapes are 256 lower-case SHA256 contexts, 45 lower-case SHA1 contexts, four UUID contexts, four other contexts and one sentinel context. These are line shapes, not public-data adjudications. Native revision-5 activation and paired owner-source application remain pending; no refused file was staged or published on the basis of this candidate-only result. The sanitized counts, exact clean path list and detailed receipt digest are in `docs/changes/2026-11-01-scanner-json-digest/candidate-r5-refused-files-rescan.json`. + +### Remaining classes after inspecting actual matched values + +The candidate-only report previously described containing lines. A second inspection kept unredacted scanner reports only in anonymous memory, extracted structural features, and discarded the values. The remaining 310 findings are all `generic-api-key`: 253 matched values are exactly lowercase hexadecimal SHA256 length, 45 are SHA1 length, four are UUIDs, one contains a test sentinel, and seven have other forms. Three of the latter have length65 in patch SHA256 assignments; two occur in test dictionary literals; one is documentation; one is executable source syntax. AST inspection confirms the last is a `_check_primary` call with variable arguments and no credential literal. This strengthens the syntax false-positive diagnosis without adjudicating every hash, fixture or documentation value. Value-free evidence is in `remaining-matched-value-shapes.json` beside the scanner proposal. + +Suggested shared remedy: add reviewed, content-bound adjudication to both scanner adapters. A trusted policy outside repository-controlled configuration should identify the exact blob SHA256, detector rule, finding range and review reason. Every finding must be scanned and individually covered; other findings still refuse the blob. Changing the blob, appending a secret, adding an unreviewed finding or modifying its range must invalidate admission. Private-key and provider-specific rules remain ineligible. The same reviewed policy and failure behavior must be tested in both adapters and the actual Forgejo dispatcher, including old reachable commits. This is a concrete proposal for the remaining class, not an implemented exemption or authority to publish its findings. Generalized suppression of hexadecimal values, UUIDs, keyword names, archive directories or entire rules would lack the necessary content binding. + +For future synthetic test data, generate disposable credentials at runtime and assert redaction using generated values. Preserve historical digest-bound files instead of editing their fixtures or reformatting receipts to evade detection. For future provenance, distinguish typed public artifact identifiers from credential material and retain the object that proves each identifier. These prevention measures complement a reviewed legacy admission mechanism; they do not remove complete introduced-object/history scanning. + +The State Hub's ten remaining weekly JSON captures are independently blocked by `scripts/check_generated_only_commit.py`: any path under an `evidence` component is classified generated, so an evidence-only commit is refused before the secret scanner. The capture script records time-bounded observations from `/legacy-meter/weekly-review`, which cannot be reconstructed from source alone. Suggested correction: distinguish immutable operational observations from reproducible indexes in a shared artifact contract, and either admit validated append-only observations or publish them to the established evidence store with durable source references. Do not add filler source changes or bypass the guard simply to bundle these captures. No change to the guard is made here. + +A fresh inventory check also found a Hall of Helix session metadata edit and a local Vim recovery file. The metadata passed `make check` (340 seats), was committed as `104120bcccc3fce833305f55f13abd25d689e5a0`, accepted by the normal receiver, and verified equal to remote main. Mail Address Semantics' `.README.md.swp` was identified by its Vim file signature, preserved byte-for-byte and excluded only in that checkout's local `info/exclude`; no recovery data was deleted or published. + +All 45 SHA1-length matches were checked against local Git object databases without printing the values. They comprise ten distinct values, and every one resolves to a Git object. The per-finding object-type/repository evidence is preserved in `remaining-git-object-identities.json`. This proves the values serve as Git identities; it does not authorize every containing blob or its other findings. + +The latest remote check observed two new synchronization gaps: Freedom Intelligence was one remote commit behind, and ops-mason had one unpublished custody-description commit. The clean Freedom Intelligence checkout was fast-forwarded to `8134864cb8bb186b87f490042a37ce8b30d1f4ca`. Ops-mason's full changed manifest passed the pinned scanner, and its existing metadata-only commit `4fcd8cd7fdb920069673c27e381b9b24af6449fa` passed the normal receiver and is verified equal to remote main. The ignored external OnCo checkout is behind its upstream main but has zero commits absent from remote refs; its files and checkout revision were preserved. This does not claim its checkout matches the separately declared reviewed baseline pin. + +Coulomb Social main is now published at `e2b9355f11ef313a69dce500e9a70b45c9af772c` by another session. That session preserved the original four unpublished commits at local branch `archive/csoc-t02-before-public-uid-correction-20261102` (tip `871e0b11f71019c373750749d71a0643dcdb848e`). The current all-branch containment audit therefore retains four held historical branches, plus RApp flex-auth-secrets-engine main. It must not treat the corrected Social main as publication of that archive. Evidence: `/tmp/fleet-unpublished-branches-current-20261102.json`; the other held branches remain the User Engine pre-envstrip backup, Social's older progress branch and Apps' custody preparation branch. diff --git a/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md index 5b06bc1e..14315d03 100644 --- a/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md +++ b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md @@ -49,7 +49,7 @@ priority: high state_hub_task_id: "a09478f1-59c3-589d-ac7a-5439cc79af09" ``` -Generated-only gates, local/remote scanner deadlines and false positives are independently identified. A paired JSON filename/SHA256 profile correction passes 12 local real-scanner tests and the full receiver real-scanner suite, and clears the exact RApp blocked blob. Candidate sources, exact digests, tests and negative coverage are in `docs/changes/2026-11-01-scanner-json-digest/`. It does not adjudicate every other provenance/UUID/fixture finding. Inspect all remaining failed blobs without printing credential values and keep exact originals. Repaired all 17 managed cache routes: 15 matched their current primary name; issue-facade → issue-core and repo-registry → repo-scoping were proven through Git ancestry. Fetches succeeded and every pinned cache HEAD has zero unpublished commits. No cached worktree content or pins were changed. Adopted the staged-source index generator in approval-engine, informed-decision and state-hub; regeneration, check, normal commits and pushes passed. +Generated-only gates, local/remote scanner deadlines and false positives are independently identified. A paired JSON filename/SHA256 profile correction passes 12 local real-scanner tests and the full receiver real-scanner suite, and clears the exact RApp blocked blob. Candidate sources, exact digests, tests and negative coverage are in `docs/changes/2026-11-01-scanner-json-digest/`. It does not adjudicate every other provenance/UUID/fixture finding. Inspect all remaining failed blobs without printing credential values and keep exact originals. Candidate-only rescan of all139 original Custodian refusals clears26;113 retain310 generic-api-key findings. Actual matched-value analysis separates253 SHA256-length values,45 SHA1-length values,four UUIDs,one test sentinel and seven other matches. All45 SHA1 matches resolve to ten distinct existing Git objects; one other finding is proven source-call syntax by AST inspection. Shapes alone do not approve the other values. Value-free evidence and a shared content-bound adjudication proposal are recorded beside the scanner plan and in the audit. The generated-only guard independently rejects all ten State Hub observation captures by their evidence-directory location; the audit proposes separating durable observations from derived indexes, without bypassing the guard. Repaired all 17 managed cache routes: 15 matched their current primary name; issue-facade → issue-core and repo-registry → repo-scoping were proven through Git ancestry. Fetches succeeded and every pinned cache HEAD has zero unpublished commits. No cached worktree content or pins were changed. Adopted the staged-source index generator in approval-engine, informed-decision and state-hub; regeneration, check, normal commits and pushes passed. ## Obtain native preflight and execute an exactly approved receiver correction @@ -115,7 +115,7 @@ priority: medium state_hub_task_id: "39ef8dbd-09fb-5b25-a2f4-e035c6fa4484" ``` -The all-ref audit found seven non-current branches with commits absent from remote refs. Four are now published under their existing names without rewriting or merging main: executor-sandbox local-smoke-2026-07, reef-railiance backup-pre-main-reset, rein-aharness assembly-webfetcher-v0.2.0, and Custodian cust-wp-0081-original-unpublished. Normal receiver acceptance and exact remote-tip checks passed. Three histories retain scanner refusals: RApp user-engine's pre-envstrip backup contains captured GPG_KEY fingerprint entries; Apps custody preparation has a JSON SHA256-manifest false positive; coulomb-social's unpublished progress branch hits generic-api-key on documentation prose at docs/usecases/platform-communication.md line 41. The exact introduced blob failed even though commit-diff inspection was clean, showing why diff-only scanning is insufficient. Original historical branches remain intact; do not bypass the receiver or call a raw fingerprint a private key. Propose narrowly scoped, content-bound adjudication for these classes and preserve the complete scanner scope. Receipts: `/tmp/unpublished-branch-inspection-results.json`, `/tmp/extra-branch-push-results.json`, `/tmp/csoc-unpublished-object-inspection.json`. The current mail-address-semantics tip was also rechecked and its push found the remote already up to date. +The all-ref audit found seven non-current branches with commits absent from remote refs. Four are now published under their existing names without rewriting or merging main: executor-sandbox local-smoke-2026-07, reef-railiance backup-pre-main-reset, rein-aharness assembly-webfetcher-v0.2.0, and Custodian cust-wp-0081-original-unpublished. Normal receiver acceptance and exact remote-tip checks passed. The initial three histories retain scanner refusals: RApp user-engine's pre-envstrip backup contains captured GPG_KEY fingerprint entries; Apps custody preparation has a JSON SHA256-manifest false positive; coulomb-social's unpublished progress branch hits generic-api-key on documentation prose at docs/usecases/platform-communication.md line 41. The exact introduced blob failed even though commit-diff inspection was clean, showing why diff-only scanning is insufficient. Original historical branches remain intact; do not bypass the receiver or call a raw fingerprint a private key. Propose narrowly scoped, content-bound adjudication for these classes and preserve the complete scanner scope. Receipts: `/tmp/unpublished-branch-inspection-results.json`, `/tmp/extra-branch-push-results.json`, `/tmp/csoc-unpublished-object-inspection.json`. The current mail-address-semantics tip was also rechecked and its push found the remote already up to date. A fresh all-ref audit on November2 also finds Social archive/csoc-t02-before-public-uid-correction-20261102, preserving original tip871e0b11f71019c373750749d71a0643dcdb848e and its four blocked commits after another session published a corrected main. Four historical branches therefore remain held, plus the RApp main; corrected main publication does not dispose of those original commits. ## Publish the archive files that pass the existing policy