coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
the-custodian/docs/changes/CUST-WP-0080/forge-expansion-operations.md
codex 9af8689327
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 10s
Details
security: close sync deadline fix and checkpoint scoped forge expansion
2026-10-13 16:55:37 +02:00

2.7 KiB
Raw Blame History

Exact existing-repository expansion

FORGE6-EXPAND-001 binds 143 numeric repository IDs to a private database/directory inventory digest and the current pod UID. It adds the already admitted scanner hook, preserving all generated hooks and the 23 profiles found at preflight. The one incompatible repository with four external gitlinks remains open in FORGE-WP-0006-T02 and CUST-WP-0080-T03. It is not an accepted exception.

expand_forge_profiles.py checkpoints attempted and verified IDs after each repository. Each pair of actual SSH pushes must produce the scanner's clean and blocked verdicts under a temporary veto on the exact probe ref. That ref and its quarantined synthetic commit must be absent afterward. This proves scanner execution and refusal, not ordinary clean-push acceptance on every repository.

Only aggregate counts and numeric IDs belong in committed receipts. The exact private inventory and unbound synthetic fixture are retained in ignored .private-backups/forge-expansion-20261013/ (directory 0700, files 0600), with digests in the proposal. Temporary working copies are under /tmp. These are not production credentials. Verify hashes before restoring a missing copy.

During execution, ownership hard-links live at repository roots, outside hook dispatch directories. Installation uses an exclusive temporary file and an atomic hard-link that cannot overwrite an existing destination. Automatic recovery requires the target to match its original ownership link and hash; unexpected concurrent changes refuse removal. Successful completion removes vetoes and then the inert ownership links. Four local installer/recovery tests exercise existing destinations, changed contents and identical unowned files.

On interruption, inspect the live process/session and checkpoint first. A polling timeout does not mean that the process stopped; do not start another apply. If the process has actually terminated with incomplete acceptance, retain that failed/unverified attempt and use the receipt-bound rollback:

python3 docs/changes/CUST-WP-0080/expand_forge_profiles.py \
  --proposal docs/changes/CUST-WP-0080/forge-expansion-proposal.json \
  --inventory /tmp/forge-coverage-expansion-20261013.json \
  --receipt docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json \
  --rollback

The rollback removes only exact owned additions on attempted IDs and verifies the original generated-hook inventory. Successful finalized receipt rollback uses its exact hashes after ownership-link cleanup. A changed pod or artifact requires a reviewed revision; never edit the original proposal to replay it. The abort owner is railiance-forge, with custodian-codex executing this trial.