65 lines
3.6 KiB
JSON
65 lines
3.6 KiB
JSON
{
|
|
"proposal_id": "FORGE6-NATIVE-PROBE-001",
|
|
"revision": 1,
|
|
"pod": "forgejo-gitea-7d94988c79-8k76l",
|
|
"pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d",
|
|
"image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
|
|
"image_id": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
|
|
"directory_name": "custodian-receive-native-20261012-001",
|
|
"executor_sha256": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
|
|
"artifacts": [
|
|
{
|
|
"name": "receive-secret-scan",
|
|
"source": "/tmp/netkingdom-forge-admission/local-probe/receive-secret-scan",
|
|
"sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
|
|
"mode": 493
|
|
},
|
|
{
|
|
"name": "gitleaks",
|
|
"source": "/tmp/netkingdom-forge-admission/local-probe/gitleaks",
|
|
"sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
|
"mode": 493
|
|
},
|
|
{
|
|
"name": "probe.sh",
|
|
"source": "/tmp/netkingdom-forge-admission/local-probe/probe.sh",
|
|
"sha256": "0fcd8a582c7545bbc417310fbef9fc6eeb3e592db176cbcff7e19a58ee97963c",
|
|
"mode": 384
|
|
},
|
|
{
|
|
"name": "fixture-key",
|
|
"source": "/tmp/netkingdom-forge-admission/local-probe/fixture-key",
|
|
"sha256": "7f3c3a80af30e41ab13a7ce124e58b3863186a3fd68e3a9f78a274cf4de2d108",
|
|
"mode": 384
|
|
},
|
|
{
|
|
"name": "pre-receive.fixture",
|
|
"source": "/tmp/netkingdom-forge-admission/local-probe/pre-receive.fixture",
|
|
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
|
|
"mode": 384
|
|
}
|
|
],
|
|
"existing_dispatcher": "/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive",
|
|
"dispatcher_sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef",
|
|
"lane": "blue",
|
|
"authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
|
|
"diff_ref": "docs/changes/CUST-WP-0080/verify_receive_native.py and probe_receive_native.sh; locally rehearsed with exact artifact hashes",
|
|
"rollback": "Remove only the new /tmp/custodian-receive-native-20261012-001 directory after matching .probe-owner. No existing repository/hook/config changes. Executor finally performs cleanup on success/failure.",
|
|
"abort_owner": "railiance-forge; executing custodian-codex",
|
|
"receipt_path": "docs/evidence/2026-10-12-netkingdom-security/receive-native-probe.json",
|
|
"expected_result": "Exact candidate binary on deployed image/Git accepts clean temporary pushes, rejects intermediate synthetic private key, discards quarantine, refuses unavailable scanner, recovers clean acceptance, retains dispatcher/additional-hook behavior; health remains passing and temporary area removed.",
|
|
"verification_limit": "Builtin Forgejo authorization is a stub in an isolated unregistered bare repository. Does not prove installed SSH/HTTP/frontend/new-repository production enforcement.",
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "Temporary approximately 27 MiB artifact storage plus small disposable Git fixtures and brief CPU use on the existing container; no new resource allocation/spend, no real credentials or production repository/config writes. Preflight requires 256 MiB free temporary space and passing health; execution has timeout and owned-path cleanup.",
|
|
"local_rehearsal": {
|
|
"clean_push": true,
|
|
"intermediate_secret_refused": true,
|
|
"quarantine_discarded": true,
|
|
"scanner_unavailable_refused": true,
|
|
"clean_after_recovery": true,
|
|
"dispatcher_preserved": true,
|
|
"other_hook_invocations": 4,
|
|
"builtin_authorization_stubbed": true
|
|
},
|
|
"promotion_evidence": false
|
|
}
|