46 lines
2.7 KiB
Markdown
46 lines
2.7 KiB
Markdown
# Exact existing-repository expansion
|
|
|
|
FORGE6-EXPAND-001 binds 143 numeric repository IDs to a private database/directory
|
|
inventory digest and the current pod UID. It adds the already admitted scanner
|
|
hook, preserving all generated hooks and the 23 profiles found at preflight.
|
|
The one incompatible repository with four external gitlinks remains open in
|
|
FORGE-WP-0006-T02 and CUST-WP-0080-T03. It is not an accepted exception.
|
|
|
|
`expand_forge_profiles.py` checkpoints attempted and verified IDs after each
|
|
repository. Each pair of actual SSH pushes must produce the scanner's clean and
|
|
blocked verdicts under a temporary veto on the exact probe ref. That ref and its
|
|
quarantined synthetic commit must be absent afterward. This proves scanner
|
|
execution and refusal, not ordinary clean-push acceptance on every repository.
|
|
|
|
Only aggregate counts and numeric IDs belong in committed receipts. The exact
|
|
private inventory and unbound synthetic fixture are retained in ignored
|
|
`.private-backups/forge-expansion-20261013/` (directory 0700, files 0600), with
|
|
digests in the proposal. Temporary working copies are under `/tmp`. These are
|
|
not production credentials. Verify hashes before restoring a missing copy.
|
|
|
|
During execution, ownership hard-links live at repository roots, outside hook
|
|
dispatch directories. Installation uses an exclusive temporary file and an
|
|
atomic hard-link that cannot overwrite an existing destination. Automatic
|
|
recovery requires the target to match its original ownership link and hash;
|
|
unexpected concurrent changes refuse removal. Successful completion removes
|
|
vetoes and then the inert ownership links. Four local installer/recovery tests
|
|
exercise existing destinations, changed contents and identical unowned files.
|
|
|
|
On interruption, inspect the live process/session and checkpoint first. A polling
|
|
timeout does not mean that the process stopped; do not start another apply.
|
|
If the process has actually terminated with incomplete acceptance, retain that
|
|
failed/unverified attempt and use the receipt-bound rollback:
|
|
|
|
```sh
|
|
python3 docs/changes/CUST-WP-0080/expand_forge_profiles.py \
|
|
--proposal docs/changes/CUST-WP-0080/forge-expansion-proposal.json \
|
|
--inventory /tmp/forge-coverage-expansion-20261013.json \
|
|
--receipt docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json \
|
|
--rollback
|
|
```
|
|
|
|
The rollback removes only exact owned additions on attempted IDs and verifies
|
|
the original generated-hook inventory. Successful finalized receipt rollback
|
|
uses its exact hashes after ownership-link cleanup. A changed pod or artifact
|
|
requires a reviewed revision; never edit the original proposal to replay it.
|
|
The abort owner is railiance-forge, with custodian-codex executing this trial.
|