329 lines
15 KiB
JSON
329 lines
15 KiB
JSON
{
|
|
"proposal_id": "CUST80-G07-local-hooks-001",
|
|
"scope_roots": [
|
|
"/home/worsch/access-engine",
|
|
"/home/worsch/approval-engine",
|
|
"/home/worsch/audit-core",
|
|
"/home/worsch/gate-house",
|
|
"/home/worsch/glas-harness",
|
|
"/home/worsch/key-cape",
|
|
"/home/worsch/kings-guard",
|
|
"/home/worsch/maturity-engine",
|
|
"/home/worsch/net-kingdom",
|
|
"/home/worsch/ops-mason",
|
|
"/home/worsch/ops-warden",
|
|
"/home/worsch/policy-nexus",
|
|
"/home/worsch/railiance-forge",
|
|
"/home/worsch/railiance-platform",
|
|
"/home/worsch/repo-manager",
|
|
"/home/worsch/role-engine",
|
|
"/home/worsch/secrets-engine",
|
|
"/home/worsch/security-canon",
|
|
"/home/worsch/tenant-engine",
|
|
"/home/worsch/the-custodian",
|
|
"/home/worsch/user-engine",
|
|
"/home/worsch/zone-engine"
|
|
],
|
|
"binary": {
|
|
"source": "/tmp/netkingdom-secret-detection/gitleaks",
|
|
"target": "/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
|
"sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509"
|
|
},
|
|
"hook_source": "/home/worsch/the-custodian/docs/changes/CUST-WP-0080/secret-hooks-pre-commit",
|
|
"hooks": [
|
|
{
|
|
"path": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"before_sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"before_mode": 493,
|
|
"backup": "/home/worsch/the-custodian/docs/changes/CUST-WP-0080/secret-hooks-prior-hook-0",
|
|
"after_sha256": "d50cf763dc9814383c6886e30b6650bbbdcb49ddd78889082e3fda3626a2cbfd"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-commit",
|
|
"before_sha256": "4d23af188d7891209f032123508893d2bc49a1709644278a0f1fa9008b0b187f",
|
|
"before_mode": 493,
|
|
"backup": "/home/worsch/the-custodian/docs/changes/CUST-WP-0080/secret-hooks-prior-hook-1",
|
|
"after_sha256": "d50cf763dc9814383c6886e30b6650bbbdcb49ddd78889082e3fda3626a2cbfd"
|
|
}
|
|
],
|
|
"original_routes": [
|
|
{
|
|
"repo": "security-canon",
|
|
"head": "1664a6def20be2759a1e575024563efd27c9f36f",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "net-kingdom",
|
|
"head": "19a1c75d309991de8654c4b7a9eeffea8fb90b18",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "gate-house",
|
|
"head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "ops-mason",
|
|
"head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "ops-warden",
|
|
"head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "key-cape",
|
|
"head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "user-engine",
|
|
"head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "tenant-engine",
|
|
"head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "role-engine",
|
|
"head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "zone-engine",
|
|
"head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "access-engine",
|
|
"head": "16ca97b2776789f730cc7049a2d6533612faaccd",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "approval-engine",
|
|
"head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "secrets-engine",
|
|
"head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "audit-core",
|
|
"head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "kings-guard",
|
|
"head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "maturity-engine",
|
|
"head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "policy-nexus",
|
|
"head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "railiance-platform",
|
|
"head": "7c79293831e2f46ad93f2ef689d9129b2ac0e139",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "glas-harness",
|
|
"head": "5ce4f38aedfd27cc783131f18480df02e2951514",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "repo-manager",
|
|
"head": "78d91efc76ddaf778365e445dc8fb5b6c924a274",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "railiance-forge",
|
|
"head": "e395e5e9c196fe7cea9cd2be513554e493e675ee",
|
|
"effective_pre_commit": "/home/worsch/repo-manager/.githooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "03a46897ea61589fe111316e561a98b423028375a1cddd1152b808df1fbeb4b5",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
},
|
|
{
|
|
"repo": "the-custodian",
|
|
"head": "e2dbe1267ffea38cd8042c153c942b26f6d177a4",
|
|
"effective_pre_commit": "/home/worsch/the-custodian/.git/hooks/pre-commit",
|
|
"executable": true,
|
|
"sha256": "4d23af188d7891209f032123508893d2bc49a1709644278a0f1fa9008b0b187f",
|
|
"observed_control": "generated-only commit guard; no scanner invocation",
|
|
"scanner_activation": "not activated by this repair"
|
|
}
|
|
],
|
|
"expected_result": "Synthetic clean source accepted, synthetic private key rejected, unavailable scanner refused on all 22 exact roots; generated-only guard/provenance and routing preserved.",
|
|
"verification": "Alternate Git indexes and temporary object directories; no user index, source file, branch or production credential mutation. Brief native scanner non-executable probe restores mode in finally.",
|
|
"rollback": "Restore exact prior hook bytes/modes after checking installed hashes; leave admitted scanner inert. No Git configuration changed.",
|
|
"cost_eur": 0,
|
|
"risk": "Local commits to selected checkouts may be refused on detections or verification failure. Scanner mode fault probe briefly refuses concurrent commits; no runtime service changes.",
|
|
"protected_files": [
|
|
{
|
|
"path": "/home/worsch/repo-manager/src/repo_manager/secret_scan.py",
|
|
"sha256": "4559d7714308eaa70ce5f8fa91dfcc6b10fe74b607e9f2a94269d31ff76bce9d"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/scripts/check_generated_only_commit.py",
|
|
"sha256": "1b372740a3265bbaaef254582be3eb116a8659f2efffccd5a26ec1c9d8db7105"
|
|
},
|
|
{
|
|
"path": "/home/worsch/repo-manager/.githooks/prepare-commit-msg",
|
|
"sha256": "6640924b9ba281e1fc413802cff91c808580b323f11e60d1fc71f4d5cd13bd45"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-rebase.sample",
|
|
"sha256": "4febce867790052338076f4e66cc47efb14879d18097d1d61c8261859eaaa7b3"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/fsmonitor-watchman.sample",
|
|
"sha256": "e0549964e93897b519bd8e333c037e51fff0f88ba13e086a331592bf801fa1d0"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/update.sample",
|
|
"sha256": "8d5f2fa83e103cf08b57eaa67521df9194f45cbdbcb37da52ad586097a14d106"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/post-update.sample",
|
|
"sha256": "81765af2daef323061dcbc5e61fc16481cb74b3bac9ad8a174b186523586f6c5"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/push-to-checkout.sample",
|
|
"sha256": "a53d0741798b287c6dd7afa64aee473f305e65d3f49463bb9d7408ec3b12bf5f"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-applypatch.sample",
|
|
"sha256": "e15c5b469ea3e0a695bea6f2c82bcf8e62821074939ddd85b77e0007ff165475"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/post-commit",
|
|
"sha256": "da2461970c32ee3ca9be48993a15476e368184622b008732c202b9c8a35840e6"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-merge-commit.sample",
|
|
"sha256": "d3825a70337940ebbd0a5c072984e13245920cdf8898bd225c8d27a6dfc9cb53"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/commit-msg.sample",
|
|
"sha256": "1f74d5e9292979b573ebd59741d46cb93ff391acdd083d340b94370753d92437"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-push.sample",
|
|
"sha256": "ecce9c7e04d3f5dd9d8ada81753dd1d549a9634b26770042b58dda00217d086a"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/prepare-commit-msg.sample",
|
|
"sha256": "e9ddcaa4189fddd25ed97fc8c789eca7b6ca16390b2392ae3276f0c8e1aa4619"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-commit.sample",
|
|
"sha256": "f9af7d95eb1231ecf2eba9770fedfa8d4797a12b02d7240e98d568201251244a"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/sendemail-validate.sample",
|
|
"sha256": "44ebfc923dc5466bc009602f0ecf067b9c65459abfe8868ddc49b78e6ced7a92"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/pre-receive.sample",
|
|
"sha256": "a4c3d2b9c7bb3fd8d1441c31bd4ee71a595d66b44fcf49ddb310252320169989"
|
|
},
|
|
{
|
|
"path": "/home/worsch/the-custodian/.git/hooks/applypatch-msg.sample",
|
|
"sha256": "0223497a0b8b033aa58a3a521b8629869386cf7ab0e2f101963d328aa62193f7"
|
|
}
|
|
],
|
|
"executor_sha256": "1935cc442026a36db8fecc7f58f779dc877a79b6b2e987f8ab074138230ff74f"
|
|
}
|