24 lines
No EOL
1.6 KiB
JSON
24 lines
No EOL
1.6 KiB
JSON
{
|
|
"proposal_id": "SYNC-SCANNER-JSON-DIGEST-20261101",
|
|
"revision": 1,
|
|
"scope": "equivalent JSON serialization of the already-accepted filename-to-exact-lowercase-SHA256 shape; local and receiver profiles identical",
|
|
"candidate_binary_sha256": "d7dbd0ef57312ab9507874bb5fd67c49bef637b6d7dee121e526227307af4bf0",
|
|
"source_change_manifest_sha256": "20e7ded830d575006969db85bda144b179bb886e44ba92947d4790d110131cf0",
|
|
"tests": {
|
|
"local": "12 passed, 37 deselected; pinned real Gitleaks",
|
|
"receiver": "go test -count=1 ./... with pinned real Gitleaks; passed in 150.087s"
|
|
},
|
|
"expected_result": "RApp source-pin and JSON SHA256 manifests pass; actual keys and bare digest secret assignments remain blocked",
|
|
"verification": "same pinned scanner, full receiver suite, negative secret tests, actual blocked blob classified by candidate, native dry-run and receiver rejection/clean probes before any activation",
|
|
"rollback": "restore exact original source revision and prior approved receiver artifact/config; retain failed receipts",
|
|
"cost_estimate_eur": {
|
|
"additional_service_commitment": 0,
|
|
"execution": "existing local compute; native preflight pending"
|
|
},
|
|
"risk_estimate_eur": {
|
|
"status": "requires supervisor valuation before native rollout",
|
|
"scope": "security-profile exception; preserve original narrow filename-extension/lowercase-64-hex constraint, all history traversal and all other detection rules"
|
|
},
|
|
"authority": "not approved; source candidate only, live inventory refused by current ops-mason-builder Kubernetes identity",
|
|
"native_preflight": "required; no privileged changes executed"
|
|
} |