the-custodian/docs/netkingdom-security-gaps.md

NetKingdom security gaps and closure sequence

Assessment date: 2026-10-12; activation rechecked 2026-10-13. Blueprint. Coordinator: CUST-WP-0080. Existing owner work remains authoritative. Statuses below distinguish actual defects, incomplete integration and missing verification. No whole-estate SEC-DSM conformance or maturity level is claimed.

Gaps ordered for execution

ID	Gap and current evidence	Existing owner work	Closure evidence
G01	The DN-subject validation repair is deployed and basic health/anonymous-denial checks passed; authenticated preview and attended U08 acceptance remain open.	KEY-WP-0040-T01/T02; USER-WP-0028-T03	Regression for real subject shape; value-free field diagnostics; deployed preview without mutation; attended recovery and fresh sign-in
G02	First reusable browser case lacks native structure/execution proof despite substantial local compiler and kernel work.	NK-WP-0048-T06/T07; MASON-WP-0010-T03/T04; WARDEN-WP-0044-T03/T04; KEY-WP-0038	Exact accepted type/case, independent structure observations, contained issuance/delivery, positive and denied groups, revocation and rollback receipts
G03	OpenBao service-JWT login does not grant task-scoped execution. Backend readiness guard correctly refuses protected handlers.	SECRETS-WP-0013-T01/T03; RPF-WP-0035-T12; SECRETS-WP-0008-T06; KEY-WP-0039	Owner-reviewed entitlement; native protected effect with exact binding; sibling/actor/body/replay/expiry refusals; no ambient fallback; cleanup
G04	Credential inventory is incomplete and its five metadata fields do not by themselves establish full SEC-DSM lifecycle coverage. Mason's dated survey found 49 paths; coverage is not current estate-wide discovery.	MASON-WP-0004-T03/T04; RPF-WP-0035; CUST-WP-0080-T03	Current metadata-only discovery denominator; owners/consumers/scopes; rotation and revocation procedures; unknown entries remain findings
G05	Agent effective authority and credential isolation are unproven. Glas declares no ready profile; the Custodian record grants no autopilot authority.	CUST-WP-0073-T02/T04; GLAS-WP-0012	Actual admitted agent identity, runtime read-denial and tool-effect restrictions, task expiry/cancel cleanup, no cross-task credential accumulation
G06	Native evidence delivery, source completeness and attribution remain incomplete. Independent archive custody is not source completeness.	AUDIT-WP-0013/0014/0015; RPF-WP-0035-T08; existing FLEX-WP-0031 and NK-WP-0035/0040 residual records	Admitted sender, durable outbox, native archive readback, heartbeat/reconciliation and failure recovery. Residual work requires explicit promotion
G07	The original generated-only hook accepted a disposable private-key commit. The pinned scanner is now enforced by actual configured hooks on 22 exact workstation checkouts; clean, synthetic-secret, generated-only and unavailable-scanner probes pass. The additive forge scanner is verified on 166 of 167 repositories, including 143 newly probed targets; one repository with four external submodules remains uncovered. Ordinary SSH source acceptance is verified separately; authenticated HTTP/frontend, CI and response remain open.	RMGR-WP-0021-T01/T02 source and local activation done; T03 forge/CI via FORGE-WP-0006, T04 response open; CUST-WP-0080-T03 coordinates railiance-forge ownership	Deterministic production-repo inventory; actual prevention/detection runs; scanner findings kept private; finding-to-revocation procedure
G08	Legacy root export and generation-prefix disclosure reproduced and removed in source. Bootstrap now uses a registered public recipient, explicit temporary-key resume and an encrypted handoff bound to the bundle digest. Other custody callers and native recovery acceptance remain unverified.	NK-WP-0049 T01 repaired; T02 caller reconciliation; T03 native recovery. NK-WP-0045 covers only the non-secret root-grant record; CUST-WP-0073 retains isolation/incident work	Inspect actual bootstrap callers; stop secret output reaching model/logs; owner-reviewed safe recovery procedure and tests
G09	Rotation and revocation closure are incomplete: existing exposure rotation is founder-deferred, npm migration remains open, and five-field descriptions do not prove consumer adoption.	CUST-WP-0073-T05; SECRETS-WP-0006-T06; WARDEN-WP-0037-T03; RPF-WP-0035-T07	For each relevant credential: new consumer accepted, old credential refused, copies reconciled; explicit DSM exception if still deferred
G10	Build-mode exceptions and close-down checklist do not uniformly contain DSM-EXC requirement, risk, compensating controls and review fields.	CUST-WP-0080-T03; existing security-close-down checklist and October 11 decisions	Requirement-level exception records with real approval references and revalidation; no invented approval or retroactive conformance
G11	Root recovery, independent custody and single-node resilience require scoped native proof. Old successful source preparation is insufficient.	WARDEN-WP-0027-T02; platform recovery records; RPF-WP-0015 residual	Fresh authorized scenario, off-host encrypted backup, independent recovery access, verified restore/return; honor build-mode single-holder decision
G12	CI credential authority, Kubernetes delivery-copy lifecycle and at-rest protection lack complete estate coverage. The reproduced unauthenticated cross-pod Docker listener was closed on October 13; runner loopback connectivity and heartbeat remain healthy. Forge metadata shows Actions enabled on 165 repositories and zero protected-branch rules; this does not establish workflow execution or required checks.	RPF-WP-0036/0044; railiance-forge; existing CCRs; CUST-WP-0080-T03	Pipeline writer scope and job identity, per-store namespace/path isolation, refresh/deletion semantics, consumer adoption, independently governed encryption keys
G13	PDP authenticity is separate from digest binding. FLEX-WP-0024 implements optional signatures; Secrets Engine still lacks independently anchored verification. Its reproduced redirect/proxy credential forwarding defects are now fixed in source (675 tests pass, one skipped). Native signer/consumer acceptance remains open.	SECRETS-WP-0014 T01 done; T02/T03 own trust admission, signed consumer enforcement and native verification. CUST-WP-0080-T03 tracks estate coverage	Independently trusted key or authenticated channel, configured producer, consumer verification, forged/altered/unknown-key/unsigned-downgrade refusals and key-rotation evidence

G01 source repair is deployed; authenticated preview/U08 remains open. G02 and G03 require existing owner acceptance and native custody gates; fixture success cannot remove them. G04, G07, G08, G10, G12 and G13 require further inspection and concrete corrections under the coordinator task, with owner records reused when coverage is established. G05, G06, G09 and G11 retain their existing owners and governing decisions.

G01 progress on 2026-10-12: the two DN-subject regressions failed against the original implementation. The repair passes 20 recovery tests and the full Go suite. KeyCape commit 1344fc8 contains the recovery repair and task record. The existing blue-lane authorization covered a code-volume-only rollout; privacyIDEA generation 11 is Ready on factor-recovery-01119187d90d7b76, health returns 200 and unauthenticated recovery returns 403. Native receipt. The authenticated preview and U08 remain open. The OTP help link is prepared locally; its image publication and live verification have not run.

G08 progress on 2026-10-12: emergency/reprint now reads no secrets and generates only a recovery guide. Service generation no longer logs prefixes or inherits permissive file modes. Bootstrap no longer creates/discovers a root private key; resume requires an explicit matching temporary key before cluster calls. A fresh encrypted bundle and operator acknowledgment replace plaintext root delivery; historical delivery flags are preserved and cannot acknowledge a new artifact. Disposable-key and simulated-cluster tests prove source behavior only. They skip native apply/init helpers and do not establish live root isolation, recovery or credential validity. NK-WP-0049 retains those gates. Existing exposure rotation remains founder-deferred; removing output does not revoke earlier disclosures.

G08 caller follow-through: NetKingdom 4cf26a9 repairs direct custody unlock and age helpers. Eight regressions failed before repair; all 206 repository tests now pass. Encryption refuses private-key files; decrypt requires explicit custody and publishes only complete private output. Hidden-input tracing, ambiguous modes, competing inline/key-command credentials and signal success-status bugs are covered. At that revision, rotation/admin output and direct editor/rotate/delegated callers remained T02 findings; subsequent Make and rotation repairs are recorded below. Scoped receipt.

G08 Make repair: NetKingdom 681c5b0 replaces permanent-key setup with public recipient validation and replaces stdout decrypt with explicit matching-key, age-only SOPS recovery into a private new file outside Git. SOPS credential fallbacks are excluded by an isolated HOME/XDG/environment, not merely by setting a key-file variable. Shell filename interpolation and raw tool/parser error output are removed from this path. All 227 tests pass with the actual disposable SOPS test binary; no production inputs were used. Existing root copies and the other caller findings remain open. Receipt.

G08/G09 rotation repair: NetKingdom 6ae4708 suppresses generated values and raw child diagnostics, validates private owned service files, writes candidates atomically and passes database SQL on stdin. Missing/ambiguous database discovery and unattended manual LDAP updates now stop instead of falsely completing. Break-glass uses file input/server-side apply; Make treats the selector as data. Twenty regressions failed before repair; all 252 repository tests pass afterward. No live credential was rotated. Native adoption/revocation, partial-state recovery, RSA rollback and the admin-bootstrap mismatch/output remain open. The requirement ledger now separately assesses DSM-ROT-003 as incomplete. Receipt.

G08 admin-bootstrap repair (19a1c75) removes automatic legacy Keycloak trigger-account, policy and Secret creation from the current KeyCape profile. Private input is parsed without shell evaluation and sent over kubectl stdin. Existing passwords are verified without reset; new rows use insert-only transactional writes. Unexpected policies, external admin realms and account/policy conflicts refuse. The upstream 3.12.2 source corrected an earlier hypothesis: its old admin add path can reset a password, so an “already exists” text check was not idempotence. Actual privacyIDEA 3.12.2/SQLite tests prove retry stability, mismatch/refusal and rollback behavior; the full suite passes 288 tests plus 29 subtests. Deployed-image/PostgreSQL/MFA acceptance, legacy-object revocation and the separate privileged KeyCape token path remain open. Receipt.

G07 inherited-control inspection found all 21 review repositories using the same generated-only pre-commit guard; Custodian has a separate equivalent local hook. A synthetic private key committed successfully through the actual inherited hook. Repo Manager 77fc4c9 supplies a pinned Gitleaks staged-object adapter that rejects a synthetic key without logging findings, checks partial/alternate indexes and git commit --only, and refuses missing/failed tools or unsupported inputs. All 249 owner tests pass. Subsequent reviewed activation composed the shared and Custodian local hooks with this scanner. All 22 exact checkouts passed actual-hook clean/secret/generated-only/scanner-failure probes using temporary indexes and objects. The executable mode, other hooks and routing were preserved; unreviewed checkout behavior was unchanged. Eleven activation/rollback/guard tests passed. RMGR-WP-0021-T02 is done; independent forge/CI coverage and private response acceptance remain open. Activation receipt. All four DSM-DETECT requirements now have incomplete assessments rather than unverified placeholders. Receipt and exact hook inventory.

G07 server baseline before activation: the 22 reviewed repositories on railiance01 had only upstream-generated receive hooks, verified by matching all observed hashes to Forgejo v11.0.3 templates. At that observation no custom scanner hook was installed. The subsequent metadata reconciliation matches 165 database repositories to 165 directories. All have Actions enabled and none has a protected-branch rule. The 143 outside the initial reviewed scope remain uncovered, not exempt; enabled Actions does not prove executed or required checks. Production admission remains incomplete. Metadata reconciliation. Read-only inventory.

G07 introduced-history source: FORGE-WP-0006 adds a standalone forge-owned receive adapter, separate from repository-controlled workflows and the local index scanner. Thirty-three leaf cases pass with actual disposable pushes; clean pushes are accepted and intermediate/merge/message/tag secrets rejected. Resource/tool/traversal failures refuse; aggregate bytes are checked before payload scanning. No production hook is activated by this source work. Exact-binary/runtime admission, full inventory and forge frontend/transport acceptance remain open. Source and protocol receipt.

G07 activation and fresh recheck: the October 12 activation receipt records the installed exact profile on 22 repositories. Actual SSH probes yielded clean/blocked scanner results; the temporary independent veto prevented fixture publication, then was removed. The October 13 read-only recheck confirms all expected hook hashes, preserved original hooks, executable exact binaries and healthy service. Ordinary clean acceptance and HTTP/frontend, restart/regeneration/new-repository coverage remain open, as do the other 143 repositories and finding-to-response acceptance. This supersedes the pre-activation state above without claiming complete forge or DSM-DETECT closure.

G07 follow-through on October 13: ordinary source pushes to Custodian eb93eee and railiance-forge d2d87ca were accepted and remote heads verified (receipt). The exact deployed Forgejo image also passes isolated HTTP clean/secret/quarantine, content API and merge-message detection, clean merge, regeneration, template inheritance, restart and subsequent refusal checks. The default new-repository hook omission is reproduced; a Git-template candidate remedies it in isolation. Lifecycle receipts and source hashes retain all failed preparation attempts and distinguish these tests from deployed PostgreSQL/SSO/ingress and Kubernetes acceptance. Import/mirror clone/fetch paths bypass receive-pack. Remaining repository and response coverage is now also on close-down checklist row 21. At that test stage the template had not been deployed; subsequent rollout and recovery are recorded below.

G07 template deployed on October 13: source railiance-apps 390a30a and exact FORGE6-TEMPLATE-LIFECYCLE-001 reached generation 12 Ready using a conditional additive patch. Read-only file mounts avoid copying ConfigMap symlinks into Git hooks. Actual Forgejo Git configuration now selects the template; native Git init inherited the exact executable hook and malformed input refused. Original 22 profiles and binaries remain exact. Deployment receipt. Thirty isolated configuration/lifecycle/rollback checks and six patch regressions passed; explicit-default rollback is documented in the linked proposal. Fresh inventory now has 166 repositories, with 22 installed and 144 builtin-only hook inventories. No unknown custom hooks were found. Production API/SSO/frontend acceptance, existing-repository expansion and imported/mirrored content/CI/response coverage remain open; inherited hooks do not scan fetch or historical content.

G07 custody recovery on October 13: the generation-12 rollout later failed ordinary source acceptance because scanner permissions were 0775. The earlier health, hash and malformed-input checks did not prove scanner usability. The exact trial is retained as failed. Revisions 2–4 restored 0755 and deployed a hash/owner-checked startup guard in owner source 50b66c4. Two actual Kubernetes replacements (generations 13 and 14) completed the guard and passed inherited native clean acceptance, intermediate-secret refusal, quarantine removal and clean recovery. Six isolated custody cases also pass. Recovery evidence supersedes the initial acceptance claim without discarding its original receipt. The temporary native probes exclude builtin authorization; ordinary source pushes supply separate SSH evidence. G07 and all wider coverage requirements remain open.

2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref veto. The independent final read-only audit reconciles 167 repositories: 166 admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All 23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership markers remain. Each rejected synthetic commit was absent after its probe. Repository 55 has four external submodules and remains required compatibility work. Ordinary source acceptance is distinct from vetoed scanner checks. Production HTTP/API/frontend acceptance remains unverified: the protected API credential route failed before child handoff and the metadata-only capability check denied access. Prepare one complete acceptance command for the existing attended login window. CI, import/mirror, historical/LFS/log/artifact detection and private response gates remain open; this is no whole-estate closure. Evidence: Custodian docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json and forge-api-route-readiness.json.

2026-10-13 G12 runner boundary repaired: actual unauthenticated Docker ping from another pod reproduced the wildcard listener defect. Exact revision 2 of FORGE6-RUNNER-LOOPBACK-001 deployed source railiance-apps 706461b, pinning the same running images and restricting Docker to loopback with local exec readiness. The conditional server dry-run and three patch tests pass. Generation 4 is Ready; loopback ping succeeds, other-pod ping refuses and the socket table contains only 127.0.0.1:2375. Zero running/queued jobs were observed before/at apply and after; resource requests and Recreate strategy are unchanged (node CPU requests 86%). Fresh runner heartbeat is one second old. The original revision-1 preflight is retained; revision 2 corrects rollback verification for the observed dual-stack wildcard. Receipt: docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json. This closes the reproduced listener exposure only. Host jobs still share the privileged runner boundary; workflow authority, required detection checks and job-scoped credentials remain open in FORGE-WP-0006-T03 / RMGR-WP-0021-T03/T04.

SEC DSM requirement coverage

Each numbered requirement in these families is in scope for assessment. The family mapping is a navigation index, not a finding that every requirement is met. The accompanying requirement ledger enumerates individual IDs from the exact canon source. No unverified requirement is counted as conformant.

Family	Architectural treatment	Gaps / proof still required
TRANS, ARCH	Highest practical identity path; one authority; static exceptions; outage behavior	G03, G04, G10, G12
DX	Known case templates, routing, developer separation, value-free diagnosis	G01, G02, G05, G08
ID, AUTH	Unique identity and independently bound authorization; tenant/environment isolation and authentic PDP responses	G02, G03, G05, G12, G13
ISSUE	Bounded per-execution capability and protected producer authority	G02, G03, G05
STORE	OpenBao runtime custody; independently protected bootstrap/backup keys; minimized copies	G04, G08, G11, G12
DELIV	Direct/ephemeral where practical, ESO only for compatibility, no scope broadening	G02, G03, G12
ROT, REV	Issue → distribute → adopt → validate → revoke; disclosure is not fixed by deleting text	G04, G09
DETECT	Repository/pipeline detection and response	G07
CI	Job identity, pipeline-change authority, masking only as defense in depth	G07, G12
K8S	Projected bounded identity, exact namespace/path policy, explicit ESO lifecycle	G12
KEY	Protect roots/signers, prefer operations over key export, justify compatibility	G08, G11, G12
HUM	Contained attended path and attributable recovery; no normal human secret transport	G01, G03, G08, G11
AGENT	Distinguishable bounded identity, deterministic gates, tools included in authority	G03, G05
AUDIT	Source atomicity, independent custody, sanitized telemetry and attribution	G06
ROOT	Enumerated independent roots and periodically tested recovery	G08, G11
INV	Owner inventory plus discovery, explicit unknowns and orphans	G04
EXC	Real approval, scope, reason, risk, controls and review/elimination trigger	G09, G10
AP	Anti-pattern catalog used to challenge all paths, not treated as new controls	G03–G12
CORE	Minimum viable profile before any full conformance claim; prioritize exposure	G04, G05, G07, G09, G10, G12

Unnumbered normative obligations also apply: section 29 requires honest metric coverage, sections 38–39 restrict conformance/maturity claims, and the section 37 decision procedure records why any proposed credential must exist. Product mapping tables and reference architectures are guidance, not proof of deployed product capability.

Efficient workplan

1. Finish G01 source repair and targeted tests against the real identity contract. Prepare its reviewed rollout and preview; batch the real-factor U08 action in the existing attended window.
2. Progress the existing Forgejo case through G02 in dependency order: exact type and case acceptance → native structure receipt → contained follow-through → independent positive/negative/cleanup proof. Do not reopen finished producers.
3. Complete G03 using the existing execution-contract and platform-entitlement plans. Reuse wrapped delivery as a primitive; do not equate it with admission.
4. In parallel with owner returns, reconcile metadata inventory and exceptions, inspect legacy bootstrap output and establish actual scanning coverage. Use facts already in CCRs and owner procedures; never read credential values to improve documentation.
5. Complete the existing native agent, audit, rotation and recovery acceptance gates. Keep explicitly deferred/residual work visible and seek promotion only where needed to meet the objective; do not implement it by relabeling.
6. Re-run a requirement-by-requirement completion audit. Source checks prove only source behavior. A missing native receipt or incomplete exception leaves the corresponding gap open and the overall goal unfinished.

Architecture review disposition

The blueprint was inspected against the accepted layer model, SEC-DSM hierarchy, source implementations, owner task gates and build-mode decisions. It now distinguishes login from entitlement, native identity from brokerage, structure from execution, archive integrity from completeness, offline engines from live services, and role definitions from access grants. These changes close ambiguity in the blueprint; they do not close the implementation gaps above.

No independent owner assent is claimed for this assessment. Required owner reviews remain in the existing plans. Completion means verified closure of these findings and all applicable requirements, not merely publication of this plan.

Individual requirement ledger: 116 numbered entries, including 20 anti-pattern references, 12 requirements assessed incomplete with scoped evidence, and 84 otherwise unverified entries. The ledger records what each repair proves and what is missing; no requirement is marked conformant. Source inventory records 21 repository revisions and their open workplans at initial inspection. The scanner configuration inventory records exactly which tracked configuration files were inspected. It contains no credential values or scanner findings and does not claim complete detection coverage.