security: preserve verified Forgejo scanner activation and reconcile recovery

docs/changes/CUST-WP-0080/receive-hook-proposal.json

@@ -0,0 +1,92 @@
+{
+  "pod": "forgejo-gitea-7d94988c79-8k76l",
+  "pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d",
+  "image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
+  "image_id": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
+  "existing_dispatcher": "/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive",
+  "dispatcher_sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
+  "proposal_id": "FORGE6-RECEIVE-ACTIVATION-001",
+  "revision": 1,
+  "directory_name": "custodian-receive-native-activation-20261012-001",
+  "executor_sha256": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3",
+  "native_helper_sha256": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
+  "repositories": [
+    "access-engine",
+    "approval-engine",
+    "audit-core",
+    "gate-house",
+    "glas-harness",
+    "key-cape",
+    "kings-guard",
+    "maturity-engine",
+    "net-kingdom",
+    "ops-mason",
+    "ops-warden",
+    "policy-nexus",
+    "railiance-forge",
+    "railiance-platform",
+    "repo-manager",
+    "role-engine",
+    "secrets-engine",
+    "security-canon",
+    "tenant-engine",
+    "the-custodian",
+    "user-engine",
+    "zone-engine"
+  ],
+  "existing_hook_hashes": {
+    "proc-receive.d/gitea": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "post-receive.d/gitea": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5",
+    "pre-receive": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
+    "proc-receive": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748",
+    "update": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6",
+    "update.d/gitea": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f",
+    "post-receive": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
+    "pre-receive.d/gitea": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
+  },
+  "hook_name": "10-custodian-secret-scan",
+  "veto_name": "99-custodian-g07-probe-veto",
+  "hook_sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b",
+  "veto_sha256": "a1c4b14f405fe687f32a36158d70fef8d6602cd0df0dad17a58edf48e67bc47b",
+  "version_directory": "/data/security/receive-secret-scan/20261012-57a0642b6251",
+  "probe_ref": "refs/heads/custodian-g07-probe-20261012-001",
+  "fixture_key": "/tmp/netkingdom-forge-admission/local-probe/fixture-key",
+  "fixture_sha256": "7f3c3a80af30e41ab13a7ce124e58b3863186a3fd68e3a9f78a274cf4de2d108",
+  "artifacts": [
+    {
+      "name": "receive-secret-scan",
+      "source": "/tmp/netkingdom-forge-admission/local-probe/receive-secret-scan",
+      "sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
+      "mode": 493
+    },
+    {
+      "name": "gitleaks",
+      "source": "/tmp/netkingdom-forge-admission/local-probe/gitleaks",
+      "sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+      "mode": 493
+    },
+    {
+      "name": "profile-hook",
+      "source": "/home/worsch/the-custodian/docs/changes/CUST-WP-0080/receive-profile-hook",
+      "sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b",
+      "mode": 493
+    },
+    {
+      "name": "probe-veto",
+      "source": "/home/worsch/the-custodian/docs/changes/CUST-WP-0080/receive-probe-veto",
+      "sha256": "a1c4b14f405fe687f32a36158d70fef8d6602cd0df0dad17a58edf48e67bc47b",
+      "mode": 493
+    }
+  ],
+  "lane": "blue",
+  "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
+  "diff_ref": "docs/changes/CUST-WP-0080/activate_receive_hooks.py; receive-profile-hook; receive-probe-veto; exact hashes in this proposal",
+  "rollback": "Run the same executor with this proposal and --rollback. Removes only the two additive files after exact hash verification; verifies original eight-file inventory on all 22 repositories. Durable admitted binaries remain inert. Automatic rollback on failed activation verification.",
+  "abort_owner": "railiance-forge; executing custodian-codex",
+  "receipt_path": "docs/evidence/2026-10-12-netkingdom-security/receive-hook-activation.json",
+  "expected_result": "22 existing upstream dispatchers gain independent pinned secret scanner; SSH clean/blocked results observed under independently tested temporary veto, rejected probe refs and quarantines absent, veto removed, existing hooks preserved and health passing. Subsequent authorized ordinary source push separately proves clean acceptance.",
+  "cost_estimate_eur": 0,
+  "risk_estimate": "Existing infrastructure, approximately 27 MiB durable storage and transient transfer copy, sequential small probes. Possible false refusals or bounded push latency on 22 repositories until rollback. No new spend/resources or credential scope; no restart. Temporary exact-ref veto prevents synthetic fixture publication. Scanner bounds: 90 seconds, 2000 objects, 8 MiB each, 64 MiB aggregate; larger pushes require reviewed remediation rather than bypass.",
+  "verification_limit": "Initial reviewed 22 of 165 repositories only; HTTP/frontend/new-repository/restart/reconciliation and response workflow remain open. No historic content scan, live credential, or synthetic public ref publication authorized.",
+  "promotion_evidence": false
+}