{
  "proposal_id": "FORGE6-EXPAND-001",
  "revision": 1,
  "pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
  "inventory_sha256": "8ec5bd3b06dba517d86b276d301d9bbcbf6ad9f706c422469f553f420aca4057",
  "target_ids": [
    1,
    6,
    7,
    8,
    10,
    11,
    12,
    13,
    14,
    15,
    17,
    18,
    19,
    20,
    21,
    22,
    23,
    24,
    25,
    27,
    28,
    29,
    30,
    31,
    32,
    33,
    34,
    35,
    36,
    37,
    38,
    39,
    40,
    41,
    43,
    44,
    45,
    46,
    47,
    48,
    49,
    50,
    51,
    52,
    53,
    54,
    56,
    57,
    58,
    59,
    61,
    62,
    63,
    64,
    65,
    66,
    68,
    69,
    70,
    72,
    73,
    74,
    75,
    78,
    79,
    80,
    81,
    82,
    83,
    84,
    85,
    86,
    87,
    88,
    89,
    90,
    91,
    94,
    95,
    96,
    97,
    98,
    99,
    100,
    101,
    103,
    104,
    105,
    106,
    107,
    109,
    110,
    112,
    114,
    115,
    116,
    117,
    118,
    119,
    120,
    121,
    122,
    123,
    125,
    126,
    127,
    128,
    130,
    132,
    133,
    134,
    135,
    136,
    140,
    141,
    142,
    143,
    145,
    146,
    147,
    148,
    149,
    150,
    151,
    152,
    153,
    154,
    155,
    156,
    158,
    159,
    160,
    161,
    162,
    163,
    164,
    165,
    166,
    167,
    168,
    169,
    170,
    171
  ],
  "target_count": 143,
  "excluded_head_gitlink_ids": [
    55
  ],
  "veto_name": "zz-custodian-expansion-veto",
  "veto_sha256": "f4b6710277af845b6c68ee45ba23720f33cc34c731238a9135e277da7ac6bb39",
  "probe_ref": "refs/heads/custodian-g07-probe-20261013-expansion",
  "fixture_key": "/tmp/forge-expansion-synthetic-20261013",
  "fixture_sha256": "8d4f4fcc8c602572bd68b02c79243a9e178187a29013d900ce25842e88634564",
  "executor_hashes": {
    "expand_forge_profiles.py": "15d111cc5a8897fff992f304c6b72ebbbe8e758b2fc3d949a0df8ac0d09848c0",
    "activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789",
    "activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3",
    "verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
    "receive-profile-hook": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b",
    "receive-probe-veto-expansion": "f4b6710277af845b6c68ee45ba23720f33cc34c731238a9135e277da7ac6bb39"
  },
  "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
  "diff_ref": "Existing admitted receive-profile-hook added to143exact builtin-only repositories. Exact inventory and default-HEAD compatibility preflight; no generated hook replacement.",
  "rollback": "Same executor --rollback with exact proposal, private inventory and apply receipt. Removes only exact installed hook/veto hashes on attempted IDs; automatic recovery additionally requires original ownership hard-links. Preserve all preexisting generated hooks. Unknown concurrent changes abort removal, retain unverified outcome for abort owner.",
  "abort_owner": "railiance-forge; executor custodian-codex",
  "receipt_path": "docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json",
  "expected_result": "All143native targets have exact original generated hooks plus admitted profile. Each actual SSH clean and synthetic secret probe emits correct scanner result under a ref-specific veto; no probe refs/quarantined commits remain; vetoes and inert ownership links removed. Existing23profiles untouched. One incompatible gitlink repository remains explicit work, not an exemption.",
  "cost_estimate_eur": 0,
  "risk_estimate": "Additive reversible hook configuration, no rollout/new resources or identity/policy scope expansion. Probe traffic is serialized and scoped to a temporary ref; veto leaves normal refs unaffected. Unsupported or secret-bearing writes may refuse by design. Limits and initial-history/import coverage remain explicit. Abort on precondition or acceptance failure and roll back attempted cohort; no actual credential content used.",
  "verification_limit": "Default-HEAD compatibility is not all-history scanning; clean scanner verdict under veto is not ordinary accepted source push. Current identities used for SSH only. Production HTTP/SSO/frontend, gitlink compatibility, imports/CI/response remain open.",
  "promotion_evidence": false
}