pdurlej/platform

Fork 0

docs(security): record secret incident containment receipt #737

Merged

pdurlej merged 1 commit from codex/secret-incident-closure-receipt into main

2026-06-07 15:33:10 +02:00

codex commented

2026-06-07 15:25:31 +02:00

Collaborator

Summary

add a 2026-06-07 secret incident containment receipt
link it from runbooks/platform-secret-recovery.md
explicitly distinguish immediate containment from full platform-wide all-clear

Scope

Documentation only. No runtime mutation, no credential rotation, no secret reads committed, no secret values, no fingerprints, no hashes, no DSNs.

Status

This is containment_complete_with_deferred_exceptions, not all_clear.

Retained exceptions remain:

FORGEJO_API_TOKEN
FORGEJO_ADMIN_PAT_TEMP

Deferred classes remain:

database passwords requiring Wave D
high-risk crypto/session secrets requiring Wave E
final Infisical audit tracked by #735

Spec sources read

AGENTS.md — repo operating rules and Forgejo identity discipline
docs/forgejo-agent-operations.md — Forgejo actor identity rules
runbooks/platform-secret-recovery.md — recovery waves and evidence requirements
scripts/security/secret_recovery_verify.py — verifier schema and scope
tests/test_secret_recovery_verify.py — verifier safety expectations
docs/incidents/2026-06-02-honcho-qwen-fix.md — incident doc style reference

Verification

Forgejo authenticated user checked as codex, non-admin
repo-only verifier command class run with no secret output:
python3 scripts/security/secret_recovery_verify.py --repo-root . --format json
sanitized summary: schema platform_secret_recovery_report.v1, records 85, repo-only findings 0, waves B/C/D/E
grep check over touched docs for accidental secret-like patterns; only policy/prohibition words matched, not secret material

Rollback

Revert this PR. It changes only documentation.

Refs #735

## Summary - add a 2026-06-07 secret incident containment receipt - link it from `runbooks/platform-secret-recovery.md` - explicitly distinguish immediate containment from full platform-wide all-clear ## Scope Documentation only. No runtime mutation, no credential rotation, no secret reads committed, no secret values, no fingerprints, no hashes, no DSNs. ## Status This is `containment_complete_with_deferred_exceptions`, not `all_clear`. Retained exceptions remain: - `FORGEJO_API_TOKEN` - `FORGEJO_ADMIN_PAT_TEMP` Deferred classes remain: - database passwords requiring Wave D - high-risk crypto/session secrets requiring Wave E - final Infisical audit tracked by #735 ## Spec sources read - `AGENTS.md` — repo operating rules and Forgejo identity discipline - `docs/forgejo-agent-operations.md` — Forgejo actor identity rules - `runbooks/platform-secret-recovery.md` — recovery waves and evidence requirements - `scripts/security/secret_recovery_verify.py` — verifier schema and scope - `tests/test_secret_recovery_verify.py` — verifier safety expectations - `docs/incidents/2026-06-02-honcho-qwen-fix.md` — incident doc style reference ## Verification - Forgejo authenticated user checked as `codex`, non-admin - repo-only verifier command class run with no secret output: `python3 scripts/security/secret_recovery_verify.py --repo-root . --format json` - sanitized summary: schema `platform_secret_recovery_report.v1`, records `85`, repo-only findings `0`, waves `B/C/D/E` - grep check over touched docs for accidental secret-like patterns; only policy/prohibition words matched, not secret material ## Rollback Revert this PR. It changes only documentation. Refs #735

codex added 1 commit

2026-06-07 15:25:31 +02:00

docs(security): record secret incident containment receipt

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 22s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 18s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 55s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m57s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.13 (pull_request) Successful in 43s

Details

canary-required / canary (pull_request) Has been skipped

Details

dd763f5397

codex referenced this pull request

2026-06-07 15:25:50 +02:00

docs(secrets): build Infisical metadata inventory and migration map #735

patchwarden commented

2026-06-07 15:29:32 +02:00

First-time contributor

No Patchwarden findings to render.

patchwarden commented

2026-06-07 15:31:30 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 737
Commit: dd763f5397f0a24adf4e2590fa5c18c2ff1f5589
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `737` - Commit: `dd763f5397f0a24adf4e2590fa5c18c2ff1f5589` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.