63 lines
4.7 KiB
JSON
63 lines
4.7 KiB
JSON
{
|
|
"archival_format": "json-checksum-map-entries-v1",
|
|
"original_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36",
|
|
"converted_map_field": "owner_source_hashes",
|
|
"reason": "Public non-secret ConfigMap source checksum was classified as generic-api-key when its filename was used as a JSON property name. Structured path/sha256 entries preserve exact historical reconstruction without detector exceptions.",
|
|
"document": {
|
|
"proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001",
|
|
"revision": 1,
|
|
"prepared_at": "2026-10-13T11:56:51.534869+00:00",
|
|
"deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
|
"original_template_sha256": "18855f7b4c78f79117884684e44550406c72fc7be08c0b8e61ec16cfcb855746",
|
|
"original_generation": 11,
|
|
"executor_hashes": {
|
|
"activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789",
|
|
"verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
|
|
"activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3",
|
|
"receive-hook-proposal.json": "9c8ea3b7fbe16a997359432af7bcf09f429881fd23cc567188c21129e80ccf8d"
|
|
},
|
|
"owner_source_hashes": [
|
|
{
|
|
"path": "/home/worsch/railiance-apps/helm/forgejo-values.yaml",
|
|
"sha256": "e97aa62fe767f4dc55f2c68c7ae1b69e61e632826a8ba3ccb4ffaca6e302174c"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-apps/Makefile",
|
|
"sha256": "6bd20555631eb4c22e0729779d6c24d6888a4e6d555ab1f03083697016d42b15"
|
|
},
|
|
{
|
|
"path": "/home/worsch/railiance-apps/manifests/forgejo-secret-scan-template.yaml",
|
|
"sha256": "8fad71aff5a25d8e31289072b9c06c6ec74ac74fedafc54dde7177bfe187c96a"
|
|
}
|
|
],
|
|
"configmap": {
|
|
"apiVersion": "v1",
|
|
"kind": "ConfigMap",
|
|
"metadata": {
|
|
"name": "forgejo-secret-template-b1d7cf8cd13f",
|
|
"namespace": "forgejo",
|
|
"labels": {
|
|
"app.kubernetes.io/part-of": "forgejo",
|
|
"custodian.coulomb.social/workplan": "FORGE-WP-0006"
|
|
}
|
|
},
|
|
"immutable": true,
|
|
"data": {
|
|
"hook": "#!/bin/sh\nset +vx\nset -eu\nexec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan --scanner /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n"
|
|
}
|
|
},
|
|
"isolated_receipt": "docs/evidence/2026-10-13-netkingdom-security/forge-template-isolated.json",
|
|
"lane": "blue",
|
|
"authorization_ref": "canon/standards/build-mode-change-authorization_v0.1.md",
|
|
"diff_ref": "owner source patch; docs/evidence/2026-10-13-netkingdom-security/forge-template-source-render.json; exact additive JSON Patch in server dry-run receipt",
|
|
"rollback": "Same executor --rollback with original proposal. Removes only exact added mounts and volume, replaces added init setting with /usr/share/git-core/templates, waits for healthy replacement and verifies original 22 hooks/binaries. Keeps immutable ConfigMap inert and any already inherited repository hooks. If rollback used, reconcile owner source to explicit default selection before another Helm deploy. Automatic recovery only when current deployment template exactly matches the attempted change; unknown concurrent changes require abort-owner review.",
|
|
"abort_owner": "railiance-forge; executing custodian-codex; release source railiance-apps",
|
|
"receipt_path": "docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json",
|
|
"target": "railiance01 namespace forgejo: Deployment forgejo-gitea and immutable ConfigMap forgejo-secret-template-b1d7cf8cd13f",
|
|
"expected_result": "Same image and artifact hashes, Recreate replacement Ready, template selected in actual Forgejo global Git configuration, regular/executable inherited hook in temporary native Git repository, existing 22 hook inventories unchanged, health passing. No new production repository, identity, credential or publication.",
|
|
"cost_estimate_eur": 0,
|
|
"risk_estimate": "No new resource requests, spend commitments, RBAC or credential scope. Existing Recreate deployment incurs a brief forge interruption; abort after 240-second readiness budget, restore default template under conditional rollback with its own 240-second verification budget. Unknown state stops automatic recovery. New repository writes can refuse if scanner missing, overloaded or input unsupported; existing 22 profiles unchanged. Recorded node CPU requests 3460m/4000m and memory 9472Mi (59%).",
|
|
"verification_limit": "Native config and Git inheritance, not authenticated production HTTP/SSO/frontend repository creation. Initial 22 repositories remain sole existing-repository activation scope; other 143, imported/mirrored history, CI and private response remain open.",
|
|
"promotion_evidence": false
|
|
}
|
|
}
|