51 lines
2.4 KiB
Diff
51 lines
2.4 KiB
Diff
--- a/workplans/RMGR-WP-0021-secret-detection-controls.md
|
|
+++ b/workplans/RMGR-WP-0021-secret-detection-controls.md
|
|
@@ -8,7 +8,7 @@
|
|
owner: codex
|
|
topic_slug: repo-manager
|
|
created: "2026-10-12"
|
|
-updated: "2026-10-12"
|
|
+updated: "2026-10-17"
|
|
flavor: implementation
|
|
depends_on: []
|
|
state_hub_workstream_id: "5aa6f84a-c682-5996-ae26-96daef670833"
|
|
@@ -149,3 +149,39 @@
|
|
execute founder-deferred rotations or treat suppressed output as remediation.
|
|
Close only after native coverage and response evidence are adequate for the
|
|
applicable DSM-DETECT requirements; retain residuals as live work records.
|
|
+
|
|
+
|
|
+## Publish measured staged-scanner batching and verify runtime routing
|
|
+
|
|
+```task
|
|
+id: RMGR-WP-0021-T05
|
|
+status: todo
|
|
+priority: medium
|
|
+```
|
|
+
|
|
+2026-10-17 prepared refinement for the local staged-object adapter. Independent
|
|
+review and a coordinator-executed generated-fixture run cover the exact source
|
|
+SHA256 `e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400`:
|
|
+42 tests, 13 exact old/new summary parity cases, immutable scanner snapshot,
|
|
+volatile-only bounded batches, watchdog and parent-loss refusal/cleanup. Warm
|
|
+p50 for 1/16/64 distinct 1 KiB blobs is 0.835/0.884/0.904 seconds, compared with
|
|
+0.702/12.065/49.172 seconds in the retained baseline. The one-blob case regressed;
|
|
+this is descriptive local fixture evidence, not aggregate workload or tail
|
|
+acceptance. Larger blobs retain the original stdin route.
|
|
+
|
|
+Publish the reviewed patch against the exact owner base, verify the configured
|
|
+shared and Custodian hooks still resolve to the admitted owner source, then run
|
|
+clean/private-key/scanner-unavailable generated alternate-index probes without
|
|
+reading or changing user source/indexes. Verify actual CLI import routing; the
|
|
+repo-local `.venv/bin/rmgr` imports owner source, but the previously advertised
|
|
+`/home/worsch/.local/bin/rmgr` is absent in the read-only observation and must not
|
|
+be described as installed operational coverage. Reconcile that exact CLI route
|
|
+before claiming CLI publication. Preserve existing hook guards and routing;
|
|
+retain rollback to the exact prior adapter bytes. Source publication and runtime
|
|
+acceptance must have separate receipts.
|
|
+
|
|
+Review packet: Custodian
|
|
+`docs/changes/netkingdom-target-2026-10-16/scanner-batch-r1/`.
|
|
+No canonical owner mutation or runtime admission has occurred in the packet.
|
|
+This task does not close T03/T04, independent receive/CI coverage, source-control
|
|
+bypass limits or whole TSA15.
|