{
  "proposal_id": "FORGE6-NATIVE-PROBE-001",
  "revision": 1,
  "pod": "forgejo-gitea-7d94988c79-8k76l",
  "pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d",
  "image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
  "image_id": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
  "directory_name": "custodian-receive-native-20261012-001",
  "executor_sha256": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
  "artifacts": [
    {
      "name": "receive-secret-scan",
      "source": "/tmp/netkingdom-forge-admission/local-probe/receive-secret-scan",
      "sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
      "mode": 493
    },
    {
      "name": "gitleaks",
      "source": "/tmp/netkingdom-forge-admission/local-probe/gitleaks",
      "sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
      "mode": 493
    },
    {
      "name": "probe.sh",
      "source": "/tmp/netkingdom-forge-admission/local-probe/probe.sh",
      "sha256": "0fcd8a582c7545bbc417310fbef9fc6eeb3e592db176cbcff7e19a58ee97963c",
      "mode": 384
    },
    {
      "name": "fixture-key",
      "source": "/tmp/netkingdom-forge-admission/local-probe/fixture-key",
      "sha256": "7f3c3a80af30e41ab13a7ce124e58b3863186a3fd68e3a9f78a274cf4de2d108",
      "mode": 384
    },
    {
      "name": "pre-receive.fixture",
      "source": "/tmp/netkingdom-forge-admission/local-probe/pre-receive.fixture",
      "sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
      "mode": 384
    }
  ],
  "existing_dispatcher": "/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive",
  "dispatcher_sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
  "lane": "blue",
  "authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
  "diff_ref": "docs/changes/CUST-WP-0080/verify_receive_native.py and probe_receive_native.sh; locally rehearsed with exact artifact hashes",
  "rollback": "Remove only the new /tmp/custodian-receive-native-20261012-001 directory after matching .probe-owner. No existing repository/hook/config changes. Executor finally performs cleanup on success/failure.",
  "abort_owner": "railiance-forge; executing custodian-codex",
  "receipt_path": "docs/evidence/2026-10-12-netkingdom-security/receive-native-probe.json",
  "expected_result": "Exact candidate binary on deployed image/Git accepts clean temporary pushes, rejects intermediate synthetic private key, discards quarantine, refuses unavailable scanner, recovers clean acceptance, retains dispatcher/additional-hook behavior; health remains passing and temporary area removed.",
  "verification_limit": "Builtin Forgejo authorization is a stub in an isolated unregistered bare repository. Does not prove installed SSH/HTTP/frontend/new-repository production enforcement.",
  "cost_estimate_eur": 0,
  "risk_estimate": "Temporary approximately 27 MiB artifact storage plus small disposable Git fixtures and brief CPU use on the existing container; no new resource allocation/spend, no real credentials or production repository/config writes. Preflight requires 256 MiB free temporary space and passing health; execution has timeout and owned-path cleanup.",
  "local_rehearsal": {
    "clean_push": true,
    "intermediate_secret_refused": true,
    "quarantine_discarded": true,
    "scanner_unavailable_refused": true,
    "clean_after_recovery": true,
    "dispatcher_preserved": true,
    "other_hook_invocations": 4,
    "builtin_authorization_stubbed": true
  },
  "promotion_evidence": false
}