| .. | ||
| native-r2 | ||
| consistency-confirmation.json | ||
| consistency-receipt.json | ||
| final-tip-verification.json | ||
| forge-metadata-proposal.json | ||
| native-approval-pending.json | ||
| native-preflight-proposal.json | ||
| native-preflight.py | ||
| projected-tasks.json | ||
| proposal.json | ||
| rapp-blocked-object-candidate-check.json | ||
| read-only-preflight-outcome.json | ||
| read-only-preflight-proposal.json | ||
| read-only-preflight.py | ||
| README.md | ||
| remaining-findings.json | ||
| scanner-json-digest.patch | ||
| smtp-return-file-checks.json | ||
| smtp-return-finding.json | ||
| social-consistency-receipt.json | ||
| social-source-checkpoint.json | ||
| source-changes.json | ||
| sync-closeout-receipt.json | ||
JSON filename/SHA256 scanner candidate
Proposal SYNC-SCANNER-JSON-DIGEST-20261101, revision 1. This is a source candidate and review evidence, not a native activation receipt.
The existing reviewed YAML filename/digest exception rejects the equivalent JSON shape in the RApp source-pin and Custodian construction manifests. The candidate extends precisely that shape to a quoted JSON key/value, using the identical rule in both adapters. It does not allow ordinary secret keys, prefixed provider tokens, uppercase or extended-length values. Existing rule defaults, history traversal, scanner pin, time/size limits, inline-suppression refusal and fail-closed outcomes remain unchanged.
source-changes.json pins original and candidate source hashes. scanner-json-digest.patch includes both implementations and regression tests. proposal.json pins the built candidate and states verification/rollback and unapproved native status. Candidate build and ephemeral test checkouts are in /tmp/sync-scanner-candidate.
Validation: 12 local real-Gitleaks tests passed (37 unrelated tests deselected); full receiver FORGE_TEST_GITLEAKS=... go test -count=1 ./... passed in 150.087s. A prior Go invocation without that environment passed only scanner-independent tests and was superseded by this real-scanner run.
The founder returned the read-only artifact/config/guard/headroom receipt on 2026-11-02. It verifies the expected deployment, pod, node, old adapter, hook and pinned Gitleaks. CPU requests are 68%, memory requests 76%, and Forgejo uses Recreate. The original failed/refined metadata attempts remain recorded; the successful read-only execution grants no mutation authority.
The exact native preparation is now revision 2, under the same proposal ID; revision 1 remains unchanged. Approval packet SHA256: d22b1f555af96c203b7d68efd25e80815ce18ca4e3bf0dd3ab96b6f699d50237. It includes guarded stage/rollout/rollback, both scanner source changes and Apps source followthrough. Thirteen isolated filesystem/real receive cases and five controller tests passed. The initial missing temporary dispatcher fixture was retained as an unverified preparation attempt and replaced with an explicit offline fixture; native probes separately copy the live dispatcher. Live server dry-run, diff, probes and activation remain mandatory execution checks and have not run yet.
Native activation awaits exact founder approval under docs/agent-autonomy-decision.md ("The supervisor approves that proposal or performs it through the privileged execution path."). The agent must not borrow the founder admin kubeconfig. The prepared founder launcher is /tmp/forge-scanner-rollout.sh. Its sealed runner refuses unknown initial identity/guard/hook/source state and any packet drift.
The staged scanner in repo-manager and live receiver have not been altered by this candidate. Independent clean-file commits continue under the original policy.