the-custodian/docs/netkingdom-security-gaps.md

# NetKingdom security gaps and closure sequence

Assessment baseline: 2026-10-12; current summary reconciled 2026-10-18.
[Blueprint](netkingdom-security-blueprint.md). Dated entries below retain their original scope.
Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses
below distinguish actual defects, incomplete integration and missing verification.
No whole-estate SEC-DSM conformance or maturity level is claimed.

**18 October sequencing:** the founder authorized good-case-first delivery.
WP-80 leads with Playwright human/agent use, then everyday Forgejo. The security
gaps below remain open under [CUST-WP-0082](../workplans/CUST-WP-0082-netkingdom-security-hardening.md),
with [all original task and requirement mappings](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/hardening-handoff.json).
Their deferral does not mean they were fixed. Close-down row 25 records the scope.

## Gaps ordered for execution

| ID | Gap and current evidence | Existing owner work | Closure evidence |
| --- | --- | --- | --- |
| G01 | KEY-WP-0040 is finished: the founder accepted the authenticated preview and help-link correction on October 17. The remaining U08 factor recovery/re-enrollment/fresh-login journey is still open in USER-WP-0028-T03; its old preview blocker text is stale. Do not repeat the accepted preview. | USER-WP-0028-T03; completed KEY-WP-0040 evidence; CUST-WP-0080-T24 | Existing attended U08 procedure, real-factor recovery and fresh-sign-in acceptance; no factor change inferred from preview acceptance |
| G02 | Actual issuer-to-Forgejo callback, shared current-token client and PostgreSQL inverse/crash mechanics pass bounded source proofs. Ongoing HTTP/API/Git/SSH policy, current protected operation/inverse, all-writer exclusion, final integrated release and native first-case acceptance remain. | Existing NK-WP-0048 / RAPPS-WP-0016 tasks; CUST-WP-0080-T08/T09/T10/T14-T19/T23 | Exact accepted type/case, independent native structure, contained delivery, ongoing positive/denied/revoked access, exact current inverse and rollback |
| G03 | OpenBao service-JWT login does not grant task-scoped execution. Backend readiness guard correctly refuses protected handlers. | SECRETS-WP-0013-T01/T03; RPF-WP-0035-T12; SECRETS-WP-0008-T06; KEY-WP-0039 | Owner-reviewed entitlement; native protected effect with exact binding; sibling/actor/body/replay/expiry refusals; no ambient fallback; cleanup |
| G04 | Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery. | MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03 | Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings |
| G05 | Workload-only credential delivery and disposable sandbox denial/redaction/teardown proof are delivered. Effective authority and credential isolation of the actual interactive assignment remain unaccepted; the Custodian record grants no autopilot authority. | CUST-WP-0073-T02/T04; GLAS-WP-0012; CUST-WP-0080-T13/T27 | Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation |
| G06 | Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness. | AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records | Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion |
| G07 | Local scanner enforcement and the 166-of-167 Forge hook baseline are delivered; the external-submodule repository remains uncovered. The latest legitimate Custodian publication hits the unchanged receive deadline. Forge ea65606c publishes a bounded source correction: all 141 objects scan in 52.53 seconds, 54 distinct leaf cases pass, native rollout pending. Actual read-only inventory still finds 166 old identical hook copies. Broader HTTP/frontend/import/mirror/CI/private-response acceptance remains open. | RMGR-WP-0021; finished FORGE-WP-0006 baseline; FORGE-WP-0010-T02/T03; CUST-WP-0080-T11/T20/T28/T39/T40 | Native exact-binary correction and ordinary publication; complete declared path/production-repo denominator; private finding-to-response acceptance; explicit promotion before implementing required residual dependencies |
| G08 | Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified. | NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work | Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests |
| G09 | Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption. | CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07 | For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred |
| G10 | Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields. | CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions | Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance |
| G11 | Root recovery, independent custody and single-node resilience require scoped native proof. Old successful source preparation is insufficient. | WARDEN-WP-0027-T02; platform recovery records; RPF-WP-0015 residual | Fresh authorized scenario, off-host encrypted backup, independent recovery access, verified restore/return; honor build-mode single-holder decision |
| G12 | CI credential authority, Kubernetes delivery-copy lifecycle and at-rest protection lack complete estate coverage. The reproduced unauthenticated cross-pod Docker listener was closed on October 13; runner loopback connectivity and heartbeat remain healthy. Forge metadata shows Actions enabled on 165 repositories and zero protected-branch rules; this does not establish workflow execution or required checks. | RPF-WP-0036/0044; railiance-forge; existing CCRs; CUST-WP-0080-T03 | Pipeline writer scope and job identity, per-store namespace/path isolation, refresh/deletion semantics, consumer adoption, independently governed encryption keys |
| G13 | Producer signing, strict independently configured consumer verification and local cross-owner interoperability are delivered in source. Native package/signer/caller/policy/trust admission and coverage of every privileged PEP remain open. The earlier redirect/proxy credential-forwarding defects are repaired; source verification must not be described as native acceptance. | SECRETS-WP-0014 / FLEX-WP-0024; CUST-WP-0080-T07/T21 | Independently admitted native key/channel and consumer package, exact PEP denominator, forged/altered/unknown-key/unsigned-downgrade/expired/unavailable refusals and rotation proof |

G01 preview/help corrections are accepted; only actual U08 journey acceptance remains.
The refined [WP-80](../workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md)
maps all gaps to specific evidence checkpoints and distinguishes delivered source
from native/consumer acceptance. G02 and G03 require existing owner
acceptance and native custody gates; fixture success cannot remove them. G04,
G07, G08, G10, G12 and G13 require further inspection and concrete corrections under
the coordinator task, with owner records reused when coverage is established.
G05, G06, G09 and G11 retain their existing owners and governing decisions.

G01 progress on 2026-10-12: the two DN-subject regressions failed against the
original implementation. The repair passes 20 recovery tests and the full Go
suite. KeyCape commit `1344fc8` contains the recovery repair and task record.
The existing blue-lane authorization covered a code-volume-only rollout;
privacyIDEA generation 11 is Ready on `factor-recovery-01119187d90d7b76`, health
returns 200 and unauthenticated recovery returns 403. [Native receipt](evidence/2026-10-12-netkingdom-security/recovery-rollout-receipt.json).
The authenticated preview and U08 remain open. The OTP help link is prepared
locally; its image publication and live verification have not run.

G08 progress on 2026-10-12: emergency/reprint now reads no secrets and generates
only a recovery guide. Service generation no longer logs prefixes or inherits
permissive file modes. Bootstrap no longer creates/discovers a root private key;
resume requires an explicit matching temporary key before cluster calls. A fresh
encrypted bundle and operator acknowledgment replace plaintext root delivery;
historical delivery flags are preserved and cannot acknowledge a new artifact.
Disposable-key and simulated-cluster tests prove source behavior only. They skip
native apply/init helpers and do not establish live root isolation, recovery or
credential validity. NK-WP-0049 retains those gates. Existing exposure rotation
remains founder-deferred; removing output does not revoke earlier disclosures.

G08 caller follow-through: NetKingdom `4cf26a9` repairs direct custody unlock and
age helpers. Eight regressions failed before repair; all 206 repository tests now
pass. Encryption refuses private-key files; decrypt requires explicit custody and
publishes only complete private output. Hidden-input tracing, ambiguous modes,
competing inline/key-command credentials and signal success-status bugs are
covered. At that revision, rotation/admin output and direct editor/rotate/delegated callers
remained T02 findings; subsequent Make and rotation repairs are recorded below. [Scoped receipt](evidence/2026-10-12-netkingdom-security/custody-entrypoints.json).

G08 Make repair: NetKingdom `681c5b0` replaces permanent-key setup with public
recipient validation and replaces stdout decrypt with explicit matching-key,
age-only SOPS recovery into a private new file outside Git. SOPS credential
fallbacks are excluded by an isolated HOME/XDG/environment, not merely by setting
a key-file variable. Shell filename interpolation and raw tool/parser error
output are removed from this path. All 227 tests pass with the actual disposable
SOPS test binary; no production inputs were used. Existing root copies and the
other caller findings remain open. [Receipt](evidence/2026-10-12-netkingdom-security/sops-make-entrypoints.json).

G08/G09 rotation repair: NetKingdom `6ae4708` suppresses generated values and raw
child diagnostics, validates private owned service files, writes candidates
atomically and passes database SQL on stdin. Missing/ambiguous database discovery
and unattended manual LDAP updates now stop instead of falsely completing.
Break-glass uses file input/server-side apply; Make treats the selector as data.
Twenty regressions failed before repair; all 252 repository tests pass afterward.
No live credential was rotated. Native adoption/revocation, partial-state recovery,
RSA rollback and the admin-bootstrap mismatch/output remain open. The requirement
ledger now separately assesses DSM-ROT-003 as incomplete. [Receipt](evidence/2026-10-12-netkingdom-security/rotation-output.json).

G08 admin-bootstrap repair (`19a1c75`) removes automatic legacy Keycloak trigger-account,
policy and Secret creation from the current KeyCape profile. Private input is
parsed without shell evaluation and sent over kubectl stdin. Existing passwords
are verified without reset; new rows use insert-only transactional writes.
Unexpected policies, external admin realms and account/policy conflicts refuse.
The upstream 3.12.2 source corrected an earlier hypothesis: its old `admin add`
path can reset a password, so an “already exists” text check was not idempotence.
Actual privacyIDEA 3.12.2/SQLite tests prove retry stability, mismatch/refusal and
rollback behavior; the full suite passes 288 tests plus 29 subtests. Deployed-image/PostgreSQL/MFA acceptance, legacy-object
revocation and the separate privileged KeyCape token path remain open. [Receipt](evidence/2026-10-12-netkingdom-security/admin-bootstrap.json).

G07 inherited-control inspection found all 21 review repositories using the same
generated-only pre-commit guard; Custodian has a separate equivalent local hook.
A synthetic private key committed successfully through the actual inherited hook.
Repo Manager `77fc4c9` supplies a pinned Gitleaks staged-object adapter that rejects a
synthetic key without logging findings, checks partial/alternate indexes and
`git commit --only`, and refuses missing/failed tools or unsupported inputs.
All 249 owner tests pass. Subsequent reviewed activation composed the shared and
Custodian local hooks with this scanner. All 22 exact checkouts passed actual-hook
clean/secret/generated-only/scanner-failure probes using temporary indexes and
objects. The executable mode, other hooks and routing were preserved; unreviewed
checkout behavior was unchanged. Eleven activation/rollback/guard tests passed.
RMGR-WP-0021-T02 is done; independent forge/CI coverage and private response
acceptance remain open. [Activation receipt](evidence/2026-10-12-netkingdom-security/secret-hook-activation.json).
All four DSM-DETECT requirements now have incomplete assessments rather than
unverified placeholders. [Receipt and exact hook inventory](evidence/2026-10-12-netkingdom-security/secret-detection.json).

G07 server baseline before activation: the 22 reviewed repositories on railiance01 had only
upstream-generated receive hooks, verified by matching all observed hashes to
[Forgejo v11.0.3 templates](https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go).
At that observation no custom scanner hook was installed. The subsequent metadata reconciliation matches 165 database repositories to 165
directories. All have Actions enabled and none has a protected-branch rule. The
143 outside the initial reviewed scope remain uncovered, not exempt; enabled
Actions does not prove executed or required checks. Production admission remains
incomplete. [Metadata reconciliation](evidence/2026-10-12-netkingdom-security/forge-repository-inventory.json).
[Read-only inventory](evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json).

G07 introduced-history source: FORGE-WP-0006 adds a standalone forge-owned
receive adapter, separate from repository-controlled workflows and the local
index scanner. Thirty-three leaf cases pass with actual disposable pushes;
clean pushes are accepted and intermediate/merge/message/tag secrets rejected.
Resource/tool/traversal failures refuse; aggregate bytes are checked before
payload scanning. No production hook is activated by this source work.
Exact-binary/runtime admission, full inventory and forge frontend/transport
acceptance remain open. [Source and protocol receipt](evidence/2026-10-12-netkingdom-security/receive-secret-detection.json).

G07 activation and fresh recheck: the October 12
[activation receipt](evidence/2026-10-12-netkingdom-security/receive-hook-activation.json)
records the installed exact profile on 22 repositories. Actual SSH probes yielded
clean/blocked scanner results; the temporary independent veto prevented fixture
publication, then was removed. The October 13
[read-only recheck](evidence/2026-10-13-netkingdom-security/receive-profile-recheck.json)
confirms all expected hook hashes, preserved original hooks, executable exact
binaries and healthy service. Ordinary clean acceptance and HTTP/frontend,
restart/regeneration/new-repository coverage remain open, as do the other 143
repositories and finding-to-response acceptance. This supersedes the pre-activation
state above without claiming complete forge or DSM-DETECT closure.

G07 follow-through on October 13: ordinary source pushes to Custodian `eb93eee`
and railiance-forge `d2d87ca` were accepted and remote heads verified
([receipt](evidence/2026-10-13-netkingdom-security/receive-clean-push.json)).
The exact deployed Forgejo image also passes isolated HTTP clean/secret/quarantine,
content API and merge-message detection, clean merge, regeneration, template
inheritance, restart and subsequent refusal checks. The default new-repository
hook omission is reproduced; a Git-template candidate remedies it in isolation.
[Lifecycle receipts and source hashes](evidence/2026-10-13-netkingdom-security/forge-lifecycle-summary.json)
retain all failed preparation attempts and distinguish these tests from deployed
PostgreSQL/SSO/ingress and Kubernetes acceptance. Import/mirror clone/fetch paths
bypass receive-pack. Remaining repository and response coverage is now also on
close-down checklist row 21. At that test stage the template had not been deployed; subsequent rollout and recovery are recorded below.

G07 template deployed on October 13: source railiance-apps `390a30a` and exact
FORGE6-TEMPLATE-LIFECYCLE-001 reached generation 12 Ready using a conditional
additive patch. Read-only file mounts avoid copying ConfigMap symlinks into Git
hooks. Actual Forgejo Git configuration now selects the template; native Git init
inherited the exact executable hook and malformed input refused. Original 22
profiles and binaries remain exact. [Deployment receipt](evidence/2026-10-13-netkingdom-security/forge-template-activation.json).
Thirty isolated configuration/lifecycle/rollback checks and six patch regressions
passed; explicit-default rollback is documented in the linked proposal.
[Fresh inventory](evidence/2026-10-13-netkingdom-security/forge-inventory-refresh.json)
now has 166 repositories, with [22 installed and 144 builtin-only hook inventories](evidence/2026-10-13-netkingdom-security/forge-hook-coverage-refresh.json).
No unknown custom hooks were found. Production API/SSO/frontend acceptance,
existing-repository expansion and imported/mirrored content/CI/response coverage
remain open; inherited hooks do not scan fetch or historical content.

G07 custody recovery on October 13: the generation-12 rollout later failed ordinary
source acceptance because scanner permissions were 0775. The earlier health,
hash and malformed-input checks did not prove scanner usability. The exact trial
is retained as failed. Revisions 2–4 restored 0755 and deployed a hash/owner-checked
startup guard in owner source `50b66c4`. Two actual Kubernetes replacements
(generations 13 and 14) completed the guard and passed inherited native clean
acceptance, intermediate-secret refusal, quarantine removal and clean recovery.
Six isolated custody cases also pass. [Recovery evidence](evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json)
supersedes the initial acceptance claim without discarding its original receipt.
The temporary native probes exclude builtin authorization; ordinary source pushes
supply separate SSH evidence. G07 and all wider coverage requirements remain open.

2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after
all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref
veto. The independent final read-only audit reconciles 167 repositories: 166
admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All
23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership
markers remain. Each rejected synthetic commit was absent after its probe.
Repository 55 has four external submodules and remains required compatibility
work. Ordinary source acceptance is distinct from vetoed scanner checks.
Production HTTP/API/frontend acceptance remains unverified: the protected API
credential route failed before child handoff and the metadata-only capability
check denied access. Prepare one complete acceptance command for the existing
attended login window. CI, import/mirror, historical/LFS/log/artifact detection
and private response gates remain open; this is no whole-estate closure.
Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
and `forge-api-route-readiness.json`.

2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping
from another pod reproduced the wildcard listener defect. Exact revision 2 of
FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps `706461b`, pinning the
same running images and restricting Docker to loopback with local exec readiness.
The conditional server dry-run and three patch tests pass. Generation 4 is Ready;
loopback ping succeeds, other-pod ping refuses and the socket table contains only
127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after;
resource requests and Recreate strategy are unchanged (node CPU requests 86%).
Fresh runner heartbeat is one second old. The original revision-1 preflight is
retained; revision 2 corrects rollback verification for the observed dual-stack
wildcard. Receipt: `docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`.
This closes the reproduced listener exposure only. Host jobs still share the
privileged runner boundary; workflow authority, required detection checks and
job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.

## SEC DSM requirement coverage

Each numbered requirement in these families is in scope for assessment. The
family mapping is a navigation index, not a finding that every requirement is met.
The accompanying requirement ledger enumerates individual IDs from the exact
canon source. No unverified requirement is counted as conformant.

| Family | Architectural treatment | Gaps / proof still required |
| --- | --- | --- |
| TRANS, ARCH | Highest practical identity path; one authority; static exceptions; outage behavior | G03, G04, G10, G12 |
| DX | Known case templates, routing, developer separation, value-free diagnosis | G01, G02, G05, G08 |
| ID, AUTH | Unique identity and independently bound authorization; tenant/environment isolation and authentic PDP responses | G02, G03, G05, G12, G13 |
| ISSUE | Bounded per-execution capability and protected producer authority | G02, G03, G05 |
| STORE | OpenBao runtime custody; independently protected bootstrap/backup keys; minimized copies | G04, G08, G11, G12 |
| DELIV | Direct/ephemeral where practical, ESO only for compatibility, no scope broadening | G02, G03, G12 |
| ROT, REV | Issue → distribute → adopt → validate → revoke; disclosure is not fixed by deleting text | G04, G09 |
| DETECT | Repository/pipeline detection and response | G07 |
| CI | Job identity, pipeline-change authority, masking only as defense in depth | G07, G12 |
| K8S | Projected bounded identity, exact namespace/path policy, explicit ESO lifecycle | G12 |
| KEY | Protect roots/signers, prefer operations over key export, justify compatibility | G08, G11, G12 |
| HUM | Contained attended path and attributable recovery; no normal human secret transport | G01, G03, G08, G11 |
| AGENT | Distinguishable bounded identity, deterministic gates, tools included in authority | G03, G05 |
| AUDIT | Source atomicity, independent custody, sanitized telemetry and attribution | G06 |
| ROOT | Enumerated independent roots and periodically tested recovery | G08, G11 |
| INV | Owner inventory plus discovery, explicit unknowns and orphans | G04 |
| EXC | Real approval, scope, reason, risk, controls and review/elimination trigger | G09, G10 |
| AP | Anti-pattern catalog used to challenge all paths, not treated as new controls | G03–G12 |
| CORE | Minimum viable profile before any full conformance claim; prioritize exposure | G04, G05, G07, G09, G10, G12 |

Unnumbered normative obligations also apply: section 29 requires honest metric
coverage, sections 38–39 restrict conformance/maturity claims, and the section 37
decision procedure records why any proposed credential must exist. Product
mapping tables and reference architectures are guidance, not proof of deployed
product capability.

## Efficient workplan

1. Finish G01 source repair and targeted tests against the real identity contract.
   Prepare its reviewed rollout and preview; batch the real-factor U08 action in
   the existing attended window.
2. Progress the existing Forgejo case through G02 in dependency order: exact type
   and case acceptance → native structure receipt → contained follow-through →
   independent positive/negative/cleanup proof. Do not reopen finished producers.
3. Complete G03 using the existing execution-contract and platform-entitlement
   plans. Reuse wrapped delivery as a primitive; do not equate it with admission.
4. In parallel with owner returns, reconcile metadata inventory and exceptions,
   inspect legacy bootstrap output and establish actual scanning coverage. Use
   facts already in CCRs and owner procedures; never read credential values to
   improve documentation.
5. Complete the existing native agent, audit, rotation and recovery acceptance
   gates. Keep explicitly deferred/residual work visible and seek promotion only
   where needed to meet the objective; do not implement it by relabeling.
6. Re-run a requirement-by-requirement completion audit. Source checks prove only
   source behavior. A missing native receipt or incomplete exception leaves the
   corresponding gap open and the overall goal unfinished.

## Architecture review disposition

The blueprint was inspected against the accepted layer model, SEC-DSM hierarchy,
source implementations, owner task gates and build-mode decisions. It now
distinguishes login from entitlement, native identity from brokerage, structure
from execution, archive integrity from completeness, offline engines from live
services, and role definitions from access grants. These changes close ambiguity
in the blueprint; they do not close the implementation gaps above.

No independent owner assent is claimed for this assessment. Required owner
reviews remain in the existing plans. Completion means verified closure of these
findings and all applicable requirements, not merely publication of this plan.

Individual requirement ledger: [116 numbered entries](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json),
including 20 anti-pattern references, 12 requirements assessed incomplete with
scoped evidence, and 84 otherwise unverified entries. The ledger records
what each repair proves and what is missing; no requirement is marked conformant. [Source inventory](evidence/2026-10-12-netkingdom-security/source-inventory.json)
records 21 repository revisions and their open workplans at initial inspection.
The [scanner configuration inventory](evidence/2026-10-12-netkingdom-security/scanner-wiring-inventory.json)
records exactly which tracked configuration files were inspected. It contains no
credential values or scanner findings and does not claim complete detection coverage.