docs: record fleet synchronization results and scanner blockers
This commit is contained in:
codex
parent
b4dfcd7941
commit
ed93d0b21f
14 changed files with 5914 additions and 67 deletions
13
docs/changes/2026-11-01-scanner-json-digest/README.md
Normal file
13
docs/changes/2026-11-01-scanner-json-digest/README.md
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# JSON filename/SHA256 scanner candidate
|
||||
|
||||
Proposal `SYNC-SCANNER-JSON-DIGEST-20261101`, revision 1. This is a source candidate and review evidence, not a native activation receipt.
|
||||
|
||||
The existing reviewed YAML filename/digest exception rejects the equivalent JSON shape in the RApp source-pin and Custodian construction manifests. The candidate extends precisely that shape to a quoted JSON key/value, using the identical rule in both adapters. It does not allow ordinary secret keys, prefixed provider tokens, uppercase or extended-length values. Existing rule defaults, history traversal, scanner pin, time/size limits, inline-suppression refusal and fail-closed outcomes remain unchanged.
|
||||
|
||||
`source-changes.json` pins original and candidate source hashes. `scanner-json-digest.patch` includes both implementations and regression tests. `proposal.json` pins the built candidate and states verification/rollback and unapproved native status. Candidate build and ephemeral test checkouts are in `/tmp/sync-scanner-candidate`.
|
||||
|
||||
Validation: 12 local real-Gitleaks tests passed (37 unrelated tests deselected); full receiver `FORGE_TEST_GITLEAKS=... go test -count=1 ./...` passed in 150.087s. A prior Go invocation without that environment passed only scanner-independent tests and was superseded by this real-scanner run.
|
||||
|
||||
Native preparation is pending read-only inventory. Current Kubernetes identity `ops-mason-builder` cannot list nodes, deployments or pods in `forgejo`. Do not borrow the founder's admin kubeconfig. The prepared `forge-metadata-proposal.json` uses gated-executor's exact-action format for only names, UIDs and images. Its digest is `sha256:0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1`. The founder was asked to return this metadata or provide the supervised execution result. A native update needs its own exact inspected rollout proposal and supervisor approval under `docs/agent-autonomy-decision.md` and environment-orientation §4.
|
||||
|
||||
The staged scanner in repo-manager and live receiver have not been altered by this candidate. Independent clean-file commits continue under the original policy.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"action": {
|
||||
"agent_id": "custodian-agt",
|
||||
"argv": [
|
||||
"kubectl",
|
||||
"-n",
|
||||
"forgejo",
|
||||
"get",
|
||||
"deployment,pod",
|
||||
"-o",
|
||||
"custom-columns=KIND:.kind,NAME:.metadata.name,UID:.metadata.uid,DEPLOY_IMAGES:.spec.template.spec.containers[*].image,POD_IMAGES:.spec.containers[*].image"
|
||||
],
|
||||
"cwd": "/",
|
||||
"env": {},
|
||||
"profile": "kube-admin",
|
||||
"target": "kube:railiance01",
|
||||
"version": "gexec.action/v1"
|
||||
},
|
||||
"digest": "sha256:0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1"
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"proposal_id": "SYNC-FORGE-READONLY-PREFLIGHT-20261101",
|
||||
"revision": 1,
|
||||
"target": "railiance01 forgejo/forge; existing public scanner artifacts and metadata only",
|
||||
"original_script_sha256": "e41c1183dae2499e62d6762b0714cc60356152494b593a45a868938f439a5f51",
|
||||
"invocation_script_sha256": "1217346155fa2ea730153c6fbf94f7ec548840cb07fbfa3cfaa61db59fe02d3a",
|
||||
"expected_result": "selected public artifact/config/guard and node allocation receipt for exact rollout preparation",
|
||||
"verification": "checks target deployment/pod UID, node address, artifact and hook identities; returns selected metadata only",
|
||||
"rollback": "not applicable; read-only inspection, no state change",
|
||||
"cost_estimate_eur": 0,
|
||||
"risk_estimate_eur": 0,
|
||||
"estimate_basis": "bounded reads of existing metadata and public scanner binaries only; no new spend or mutation",
|
||||
"disposition": "requested founder execution; pending result; no exact approval token and no scored success"
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
"""Founder-run read-only scanner preflight; prints only selected public evidence."""
|
||||
import subprocess,json,hashlib,pathlib,sys
|
||||
NS='forgejo';NAME='forge';POD='forge-79c7fb84db-k5wtm'
|
||||
EXPECTED_UID='1faefb26-cccd-4d0e-b509-70a7eb0b4f4d'
|
||||
POD_UID='2c9f911a-403e-4183-a027-2b8d48742348'
|
||||
BASE='/data/security/receive-secret-scan/20261027-b735d052a49f'
|
||||
ADAPTER='b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2'
|
||||
SCANNER='88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509'
|
||||
def k(*args):
|
||||
q=subprocess.run(['kubectl',*args],capture_output=True,timeout=60)
|
||||
if q.returncode:raise RuntimeError('read-only-command-failed; raw diagnostics withheld')
|
||||
return q.stdout
|
||||
|
||||
def main():
|
||||
d=json.loads(k('-n',NS,'get','deployment',NAME,'-o','json'))
|
||||
if d['metadata']['uid']!=EXPECTED_UID:raise RuntimeError('deployment-identity-drift')
|
||||
uid=k('-n',NS,'get','pod',POD,'-o','jsonpath={.metadata.uid}').decode()
|
||||
if uid!=POD_UID:raise RuntimeError('pod-identity-drift')
|
||||
spec=d['spec']['template']['spec'];inits=spec.get('initContainers',[])
|
||||
candidates=[c['name'] for c in spec['containers'] if c.get('image')=='code.forgejo.org/forgejo/forgejo:11.0.3-rootless']
|
||||
if len(candidates)!=1:raise RuntimeError('forge-container-ambiguous')
|
||||
container=candidates[0]
|
||||
guards=[(i,x) for i,x in enumerate(inits) if x['name']=='verify-secret-scanner']
|
||||
if len(guards)!=1:raise RuntimeError('scanner-guard-ambiguous')
|
||||
index,guard=guards[0]
|
||||
volumes=spec.get('volumes',[]);selected=[(i,x) for i,x in enumerate(volumes) if x['name']=='secret-scan-template']
|
||||
if len(selected)!=1:raise RuntimeError('scanner-volume-ambiguous')
|
||||
vindex,volume=selected[0];cmname=volume['configMap']['name']
|
||||
if cmname!='forgejo-secret-template-d1df801be39f':raise RuntimeError('template-configmap-drift')
|
||||
# This exact public ConfigMap contains only the receiver hook, per owner source.
|
||||
hook=k('-n',NS,'get','configmap',cmname,'-o','jsonpath={.data.hook}')
|
||||
expected=('#!/bin/sh\nset +vx\nset -eu\nexec '+BASE+'/receive-secret-scan --scanner '+BASE+'/gitleaks\n').encode()
|
||||
if hook!=expected:raise RuntimeError('mounted-hook-source-drift')
|
||||
metadata=k('-n',NS,'exec',POD,'-c',container,'--','sh','-c',
|
||||
'set -eu; test -f "$1" && test ! -L "$1"; test -f "$2" && test ! -L "$2"; sha256sum "$1" "$2"',
|
||||
'sh',BASE+'/receive-secret-scan',BASE+'/gitleaks').decode().splitlines()
|
||||
hashes=[s.split()[0] for s in metadata]
|
||||
if hashes!=[ADAPTER,SCANNER]:raise RuntimeError('installed-scanner-artifact-drift')
|
||||
nodes=json.loads(k('get','nodes','-o','json'))['items']
|
||||
if len(nodes)!=1 or not any(a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses']):raise RuntimeError('node-target-drift')
|
||||
description=k('describe','node',nodes[0]['metadata']['name']).decode()
|
||||
allocation=description.split('Allocated resources:',1)[1].split('Events:',1)[0].strip() if 'Allocated resources:' in description else None
|
||||
if allocation is None:raise RuntimeError('node-headroom-unavailable')
|
||||
receipt=dict(read_only=True,deployment_uid=EXPECTED_UID,pod=POD,pod_uid=POD_UID,
|
||||
deployment_name=NAME,container=container,node_uid=nodes[0]['metadata']['uid'],node_name=nodes[0]['metadata']['name'],
|
||||
guard_index=index,guard_command=guard.get('command'),guard_args=guard.get('args'),volume_index=vindex,
|
||||
volume=volume,strategy=d['spec'].get('strategy'),resources=[dict(name=c['name'],resources=c.get('resources')) for c in spec['containers']],
|
||||
old_configmap=cmname,old_hook_sha256=hashlib.sha256(hook).hexdigest(),old_adapter_sha256=ADAPTER,scanner_sha256=SCANNER,
|
||||
allocated_resources=allocation)
|
||||
pathlib.Path('/tmp/forge-scanner-preflight-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
# Keep long public shell commands in the local receipt; return concise checks.
|
||||
print(json.dumps({k:receipt[k] for k in ['read_only','deployment_name','deployment_uid','pod_uid','node_uid','old_configmap','old_adapter_sha256','strategy','allocated_resources']},indent=2))
|
||||
print('receipt: /tmp/forge-scanner-preflight-receipt.json')
|
||||
try:main()
|
||||
except Exception as exc:
|
||||
print('preflight refused:',str(exc) if isinstance(exc,RuntimeError) else type(exc).__name__)
|
||||
sys.exit(1)
|
||||
24
docs/changes/2026-11-01-scanner-json-digest/proposal.json
Normal file
24
docs/changes/2026-11-01-scanner-json-digest/proposal.json
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"proposal_id": "SYNC-SCANNER-JSON-DIGEST-20261101",
|
||||
"revision": 1,
|
||||
"scope": "equivalent JSON serialization of the already-accepted filename-to-exact-lowercase-SHA256 shape; local and receiver profiles identical",
|
||||
"candidate_binary_sha256": "d7dbd0ef57312ab9507874bb5fd67c49bef637b6d7dee121e526227307af4bf0",
|
||||
"source_change_manifest_sha256": "20e7ded830d575006969db85bda144b179bb886e44ba92947d4790d110131cf0",
|
||||
"tests": {
|
||||
"local": "12 passed, 37 deselected; pinned real Gitleaks",
|
||||
"receiver": "go test -count=1 ./... with pinned real Gitleaks; passed in 150.087s"
|
||||
},
|
||||
"expected_result": "RApp source-pin and JSON SHA256 manifests pass; actual keys and bare digest secret assignments remain blocked",
|
||||
"verification": "same pinned scanner, full receiver suite, negative secret tests, actual blocked blob classified by candidate, native dry-run and receiver rejection/clean probes before any activation",
|
||||
"rollback": "restore exact original source revision and prior approved receiver artifact/config; retain failed receipts",
|
||||
"cost_estimate_eur": {
|
||||
"additional_service_commitment": 0,
|
||||
"execution": "existing local compute; native preflight pending"
|
||||
},
|
||||
"risk_estimate_eur": {
|
||||
"status": "requires supervisor valuation before native rollout",
|
||||
"scope": "security-profile exception; preserve original narrow filename-extension/lowercase-64-hex constraint, all history traversal and all other detection rules"
|
||||
},
|
||||
"authority": "not approved; source candidate only, live inventory refused by current ops-mason-builder Kubernetes identity",
|
||||
"native_preflight": "required; no privileged changes executed"
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"object_id": "e844bada043f4169c49f3e9dbe7218cf2cf486d3",
|
||||
"path": "source-pin.json",
|
||||
"candidate_exit_code": 0,
|
||||
"candidate_config_sha256": "e8ededac85afff19ff3d20dd1e9049d206eb131772ec9aec4ac08b8b81f520e2",
|
||||
"raw_content_or_findings_emitted": false
|
||||
}
|
||||
5340
docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json
Normal file
5340
docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,60 @@
|
|||
--- /home/worsch/repo-manager/src/repo_manager/secret_scan.py
|
||||
+++ /home/worsch/repo-manager/src/repo_manager/secret_scan.py
|
||||
@@ -55,7 +55,7 @@
|
||||
description = "Filename key whose value is a lowercase 64-hex content digest"
|
||||
targetRules = ["generic-api-key"]
|
||||
regexTarget = "match"
|
||||
-regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \t]+[a-f0-9]{64}$']
|
||||
+regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \t]+[a-f0-9]{64}|":[ \t]+"[a-f0-9]{64}")$']
|
||||
"""
|
||||
|
||||
|
||||
--- /home/worsch/repo-manager/tests/test_secret_scan.py
|
||||
+++ /home/worsch/repo-manager/tests/test_secret_scan.py
|
||||
@@ -479,3 +479,21 @@
|
||||
if process.poll() is None:
|
||||
process.kill(); process.wait(timeout=5)
|
||||
process.stdout.close()
|
||||
+
|
||||
+
|
||||
+@pytest.mark.parametrize("key", ["values/secrets-engine.yaml", "docs/runtime-externalsecret.r1.yaml"])
|
||||
+def test_json_filename_digest_is_allowed(binary, repo, key):
|
||||
+ digest = os.urandom(32).hex()
|
||||
+ stage(repo, json.dumps({key: digest}).encode(), "source-pin.json")
|
||||
+ assert secret_scan.scan_staged(repo, binary)["status"] == "clean"
|
||||
+
|
||||
+
|
||||
+@pytest.mark.parametrize("content", [
|
||||
+ lambda digest: json.dumps({"secret": digest}),
|
||||
+ lambda digest: json.dumps({"values/secrets-engine.yaml": "glpat-" + digest}),
|
||||
+ lambda digest: json.dumps({"values/secrets-engine.yaml": digest + "a"}),
|
||||
+ lambda digest: json.dumps({"values/secrets-engine.yaml": digest.upper()}),
|
||||
+])
|
||||
+def test_json_digest_exception_does_not_allow_secret_shapes(binary, repo, content):
|
||||
+ stage(repo, content(os.urandom(32).hex()).encode(), "manifest.json")
|
||||
+ assert secret_scan.scan_staged(repo, binary)["status"] == "blocked"
|
||||
--- /home/worsch/railiance-forge/tools/receive-secret-scan/main.go
|
||||
+++ /home/worsch/railiance-forge/tools/receive-secret-scan/main.go
|
||||
@@ -36,7 +36,7 @@
|
||||
description = "Filename key whose value is a lowercase 64-hex content digest"
|
||||
targetRules = ["generic-api-key"]
|
||||
regexTarget = "match"
|
||||
-regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \t]+[a-f0-9]{64}$']
|
||||
+regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \t]+[a-f0-9]{64}|":[ \t]+"[a-f0-9]{64}")$']
|
||||
`
|
||||
const maxInput = 512 * 1024
|
||||
const maxObject = 8 * 1024 * 1024
|
||||
--- /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go
|
||||
+++ /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go
|
||||
@@ -188,6 +188,11 @@
|
||||
{"inline-suppression", append([]byte("# gitleaks:allow\n"), privateKey...), true},
|
||||
{"filename-digest", []byte(" cards/access.md: " + digest + "\n"), false},
|
||||
{"bare-keyword-digest", []byte("access: " + digest + "\n"), true},
|
||||
+ {"json-filename-digest", []byte("{\"values/secrets-engine.yaml\": \"" + digest + "\"}\n"), false},
|
||||
+ {"json-bare-secret-digest", []byte("{\"secret\": \"" + digest + "\"}\n"), true},
|
||||
+ {"json-filename-token", []byte("{\"values/secrets-engine.yaml\": \"" + string(canary) + "\"}\n"), true},
|
||||
+ {"json-filename-long-digest", []byte("{\"values/secrets-engine.yaml\": \"" + digest + "a\"}\n"), true},
|
||||
+ {"json-filename-uppercase-digest", []byte("{\"values/secrets-engine.yaml\": \"" + strings.ToUpper(digest) + "\"}\n"), true},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
stdin, e := scan(context.Background(), f, config, tc.input)
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
[
|
||||
{
|
||||
"target": "/home/worsch/repo-manager/src/repo_manager/secret_scan.py",
|
||||
"original_sha256": "12d0e1b10c4d613401e33bfdb4012c6cb3e3719b6b1480f8d3ae2f7a27aeb73f",
|
||||
"candidate_sha256": "740f64dc1e8421669e6f84fccadef50fcd3d9a802df07f62c6718f917ba55fa9",
|
||||
"patch": "--- /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n+++ /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n@@ -55,7 +55,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n \"\"\"\n \n \n"
|
||||
},
|
||||
{
|
||||
"target": "/home/worsch/repo-manager/tests/test_secret_scan.py",
|
||||
"original_sha256": "5560f57163dc2189d189cce1c7b772ebf1adc8f8a84d388b2b42b546c10cc1c8",
|
||||
"candidate_sha256": "2e6d53651ca18e787487cd961efcddc7f483637c63e6e10df399a6d4fcdae962",
|
||||
"patch": "--- /home/worsch/repo-manager/tests/test_secret_scan.py\n+++ /home/worsch/repo-manager/tests/test_secret_scan.py\n@@ -479,3 +479,21 @@\n if process.poll() is None:\n process.kill(); process.wait(timeout=5)\n process.stdout.close()\n+\n+\n+@pytest.mark.parametrize(\"key\", [\"values/secrets-engine.yaml\", \"docs/runtime-externalsecret.r1.yaml\"])\n+def test_json_filename_digest_is_allowed(binary, repo, key):\n+ digest = os.urandom(32).hex()\n+ stage(repo, json.dumps({key: digest}).encode(), \"source-pin.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"clean\"\n+\n+\n+@pytest.mark.parametrize(\"content\", [\n+ lambda digest: json.dumps({\"secret\": digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": \"glpat-\" + digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest + \"a\"}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest.upper()}),\n+])\n+def test_json_digest_exception_does_not_allow_secret_shapes(binary, repo, content):\n+ stage(repo, content(os.urandom(32).hex()).encode(), \"manifest.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"blocked\"\n"
|
||||
},
|
||||
{
|
||||
"target": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go",
|
||||
"original_sha256": "a9835dfc830bde5091354debf26ae40c37fab5fdc2c1b0e483774dda0b93521a",
|
||||
"candidate_sha256": "4eb494b30b845e090332d3c20070ff417c2114a479823a6097cfe0292ee18aac",
|
||||
"patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n@@ -36,7 +36,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n `\n const maxInput = 512 * 1024\n const maxObject = 8 * 1024 * 1024\n"
|
||||
},
|
||||
{
|
||||
"target": "/home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go",
|
||||
"original_sha256": "4ef5669786c49cadc9e8985d77c215e34effd3e4aabeb5387cafbe51e5e89e17",
|
||||
"candidate_sha256": "d94d7812a74b1cb7ff53ee9a3e137d8b524d96f4dca813ca52a9f84f800323b9",
|
||||
"patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n@@ -188,6 +188,11 @@\n \t\t{\"inline-suppression\", append([]byte(\"# gitleaks:allow\\n\"), privateKey...), true},\n \t\t{\"filename-digest\", []byte(\" cards/access.md: \" + digest + \"\\n\"), false},\n \t\t{\"bare-keyword-digest\", []byte(\"access: \" + digest + \"\\n\"), true},\n+\t\t{\"json-filename-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"\\\"}\\n\"), false},\n+\t\t{\"json-bare-secret-digest\", []byte(\"{\\\"secret\\\": \\\"\" + digest + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-token\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + string(canary) + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-long-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"a\\\"}\\n\"), true},\n+\t\t{\"json-filename-uppercase-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + strings.ToUpper(digest) + \"\\\"}\\n\"), true},\n \t} {\n \t\tt.Run(tc.name, func(t *testing.T) {\n \t\t\tstdin, e := scan(context.Background(), f, config, tc.input)\n"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,168 @@
|
|||
{
|
||||
"observed_at": "2026-11-01T22:48:39.801004+00:00",
|
||||
"scope": {
|
||||
"total_checkouts": 210,
|
||||
"primary": 169,
|
||||
"linked_worktrees": 18,
|
||||
"managed_clones": 17,
|
||||
"nested_dependencies": 2,
|
||||
"tool_checkouts": 3,
|
||||
"retired_local_archive": 1
|
||||
},
|
||||
"custodian_file_batches": {
|
||||
"initial_committed_paths": 232,
|
||||
"retry_committed_paths": 3553,
|
||||
"retry_terminal": true,
|
||||
"retry_attempts": 102,
|
||||
"rejected_paths": 139,
|
||||
"finding_rules": {
|
||||
"generic-api-key": 866,
|
||||
"discord-api-token": 5,
|
||||
"bitbucket-client-secret": 2
|
||||
},
|
||||
"line_context_shapes": {
|
||||
"line-contains-sentinel-text": 1,
|
||||
"line-contains-lowercase-hex-64": 819,
|
||||
"line-contains-lowercase-hex-40": 45,
|
||||
"other-context": 4,
|
||||
"line-contains-UUID": 4
|
||||
},
|
||||
"scope_limit": "counts describe file operations in the archived corpus and its audit, not unique Git blobs or proof of credential validity"
|
||||
},
|
||||
"brief_fixes": [
|
||||
{
|
||||
"repo": "/home/worsch/approval-engine",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/hub-core",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/rapp-openbao",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/rapp-user-engine",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/pqrst-practice",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/intelligence-radar",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/agentic-resources",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/assembly-economics",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/whitehat-security",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/inbound-library",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/rail-knative",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/disaster-control",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/rapp-issue-core",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/informed-decision",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/whynot-design",
|
||||
"commit_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/frontend-patterns",
|
||||
"commit_code": 0
|
||||
}
|
||||
],
|
||||
"staged_generator_adoptions": [
|
||||
{
|
||||
"repo": "approval-engine",
|
||||
"generation_code": 0,
|
||||
"check_code": 0,
|
||||
"commit_code": 0,
|
||||
"push_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"generation_code": 0,
|
||||
"check_code": 0,
|
||||
"commit_code": 0,
|
||||
"push_code": 0
|
||||
},
|
||||
{
|
||||
"repo": "state-hub",
|
||||
"generation_code": 0,
|
||||
"check_code": 0,
|
||||
"commit_code": 0,
|
||||
"push_code": 0
|
||||
}
|
||||
],
|
||||
"cache_routes_repaired": 17,
|
||||
"extra_branch_pushes": [
|
||||
{
|
||||
"repo": "/home/worsch/executor-sandbox",
|
||||
"ref": "refs/heads/local-smoke-2026-07",
|
||||
"code": 0,
|
||||
"verified_equal": true
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/reef-railiance",
|
||||
"ref": "refs/heads/backup-pre-main-reset",
|
||||
"code": 0,
|
||||
"verified_equal": true
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/coulomb-social",
|
||||
"ref": "refs/heads/csoc-unpublished-progress-20261027",
|
||||
"code": 1,
|
||||
"verified_equal": null
|
||||
},
|
||||
{
|
||||
"repo": "/home/worsch/rein-aharness",
|
||||
"ref": "refs/heads/assembly-webfetcher-v0.2.0",
|
||||
"code": 0,
|
||||
"verified_equal": true
|
||||
}
|
||||
],
|
||||
"additional_root_history": {
|
||||
"ref": "refs/heads/cust-wp-0081-original-unpublished",
|
||||
"verified_head": "ea57268a6eae4de8313113e5b1f98c7d7b657999"
|
||||
},
|
||||
"intelligence_radar": {
|
||||
"head": "508daf6a9acfec9e5bde32b79dc994c259ede6c8",
|
||||
"remote_equal_verified": true,
|
||||
"temporary_refs_removed_verified": true,
|
||||
"introduced_large_blobs_scanned_before_final_push": 95
|
||||
},
|
||||
"tests": {
|
||||
"warden_case_sheet": "10 passed",
|
||||
"forge_resources": "1 unittest passed",
|
||||
"local_json_profile": "12 passed, 37 deselected",
|
||||
"receiver_json_profile": "full pinned real-Gitleaks suite passed in 150.087 seconds",
|
||||
"smtp_launcher": "21 passed"
|
||||
},
|
||||
"native_policy_changed": false,
|
||||
"native_preflight_receipt_available": false,
|
||||
"goal_complete": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue