94 lines
3.5 KiB
JSON
94 lines
3.5 KiB
JSON
{
|
|
"date": "2026-10-12",
|
|
"gap": "G08",
|
|
"owner_task": "NK-WP-0049-T02",
|
|
"manifest": {
|
|
"repo": "net-kingdom",
|
|
"base_head": "b97f9f616f2f0aea41fbb6716269767aa691b023",
|
|
"files": [
|
|
{
|
|
"path": "sso-mfa/bootstrap/sops-custody-unlock.sh",
|
|
"before": "fb2ac94873a382b2d68b6c27ea11005c8ea2c19e71090515f77414e549ffc06d",
|
|
"after": "8a6c02ace974b489d23869a9e99d3305896f4bdc4c430164df09bb4ce1710959"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/encrypt-secrets.sh",
|
|
"before": "7b34fcbc510d8b82ecf18ed624250f8ceb4d65a92b730744f7e26ee9b7c4cddc",
|
|
"after": "5b4774488e09a22b409079021e7cd10632c7cf6cf9db6f98cd85e3878d34d435"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/decrypt-secrets.sh",
|
|
"before": "4b581a85d3643c94461015abf2917495c7ad66c0fe5839e52de4d6c340f22329",
|
|
"after": "9def33e2c5d5ca338f17b8dce2a444b3a2fedc258789cc67ca311248ce213e01"
|
|
},
|
|
{
|
|
"path": "tests/test_custody_entrypoints.py",
|
|
"before": null,
|
|
"after": "e1f9afa6e62462a77ddc3ee7b2cd2dad8b031cf64e80f32bd37a7cd44a9847a9"
|
|
},
|
|
{
|
|
"path": "docs/security-bootstrap-age-custody.md",
|
|
"before": "f50f7995563060e85886c7f0465e320cb3351d5648659e1caced0147028e3fc0",
|
|
"after": "d499fc515b7c8323455d192167e5f3721596bedd60d6b0ddc3b3aba7ae092922"
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
|
"before": "02eb5975b88900e835bf2033b65b3dbbbbda5a05f1834347f3b3b4dc6c6291e4",
|
|
"after": "543df4936f0f9782622ccad0b57f9fb628514b4776d3df8ba5ce24455f80ce11"
|
|
}
|
|
]
|
|
},
|
|
"source_commit": "4cf26a9bc869dc81df086240243376f67fdbf795",
|
|
"source_pushed": true,
|
|
"verification": {
|
|
"baseline": {
|
|
"failed": 8,
|
|
"passed": 1
|
|
},
|
|
"focused": {
|
|
"passed": 27,
|
|
"failed": 0
|
|
},
|
|
"actual_checkout_full_suite": {
|
|
"passed": 206,
|
|
"failed": 0,
|
|
"seconds": 25.95,
|
|
"command": "PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests tools -q --tb=short"
|
|
},
|
|
"shell_syntax": "pass"
|
|
},
|
|
"repaired": [
|
|
"hidden custody prompt xtrace leakage",
|
|
"ambiguous custody input modes",
|
|
"unknown argument echo",
|
|
"signal cleanup continuing with success status",
|
|
"competing inline/key-command SOPS credentials inherited by child",
|
|
"private-key input accepted for public encryption",
|
|
"permanent HOME key fallback on decrypt",
|
|
"permissive plaintext output modes",
|
|
"partial decryption left behind on failure"
|
|
],
|
|
"proof_scope": "Disposable age cryptography, hidden-prompt PTY and synthetic child/process tests. No live key, credential, cluster or rotation used.",
|
|
"limits": [
|
|
"Bash defers signal traps during foreground children; no process-group supervision",
|
|
"SIGKILL cleanup and arbitrary child retained copies unproven",
|
|
"Permanent-key Make targets, stdout decrypt target, rotation and bootstrap-admin output remain concrete source findings",
|
|
"No native recovery, runtime root isolation or complete caller coverage claimed"
|
|
],
|
|
"statehub_sync": {
|
|
"owner": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 35,
|
|
"info": 5
|
|
},
|
|
"owner_note": "Generated-only brief commit refused; scoped source/workplan commit pushed separately.",
|
|
"custodian": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 7,
|
|
"info": 4
|
|
},
|
|
"custodian_note": "Database reconciliation succeeded; sandbox prevents automatic working-memory Git commit. Assessment/evidence committed separately."
|
|
}
|
|
}
|