Skip to content

security: construct candidate v2 policy bundle - #22

Draft
stacknil wants to merge 8 commits into
mainfrom
stacknil/candidate-v2-construction
Draft

security: construct candidate v2 policy bundle#22
stacknil wants to merge 8 commits into
mainfrom
stacknil/candidate-v2-construction

Conversation

@stacknil

@stacknil stacknil commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

CANDIDATE POLICY ONLY

This bundle is not the final production authority root.

Its digest is review evidence only.

Final v2 must be rebuilt after production signer policy and final authority workflow/action bytes are fixed.

Future production workflow/action bytes are protected inputs. Their final hashes necessarily change the protected manifest and therefore the final bundle digest.

Problem

The external-policy-root architecture is merged, but v1 cannot admit the intentional v2 migration: the root scanner config and reviewed baseline change, and a new policy mirror appears. Historical v1 artifacts must remain immutable evidence without becoming a scanner blind spot or being copied into the baseline merely to silence hash findings.

Invariant

  • Base is exactly 8e9e4c53a123bc285dd3f7c523427747326ab281; submitted head is exactly 7c9e5135804e0ffe1f7e5d982bf419fbbd4352be.
  • All seven v1 files remain byte-identical and reproduce 6f25ebb773ce1453e8de623bca5aaecc936f1f188288f8df20aedeadb3bf4612.
  • Every regular tracked file is scanned, an exact approved config-ignore exclusion, or one of the seven exact current-v2 mirror files.
  • Protected controls, suppression-bearing sources, coverage exclusions, and mirror membership are exact path/mode/byte-hash sets.
  • The candidate digest is external review evidence and is not registered, hardcoded, published, or activated.

Design decision

  • Add only the narrow policy/repo-sentinel-authority/v1/** and policy/repo-sentinel-authority/v2/** scanner globs.
  • Bind the seven historical-v1 artifacts through exact coverage entries instead of baseline entries.
  • Extend the historical 436-entry reviewed baseline by exactly 81 full-tree findings, each individually adjudicated.
  • Generate all seven v2 components from staged source with the existing trusted builder, then reproduce them byte-for-byte from the final tree.
  • Preserve raw v2 mirror bytes on Windows with the same -text policy already used for v1.
  • Replace the transitional test assertion that v2 is absent with the durable invariant that the builder emits exactly the seven bundle filenames.

Threat and failure model

  • A broad ignore could hide an added eighth policy artifact.
  • Baseline replacement or stale-entry deletion could erase historical review evidence.
  • Mirror, protected-control, or suppression drift could reach scanner evaluation without independent admission.
  • A digest written back into runtime inputs would create a circular source-to-policy dependency.
  • A migration-only CI failure could pressure reviewers to weaken v1 or scanner semantics.

The mutation campaign demonstrates fail-closed behavior before scanner authority for all of these admission classes.

Rejected alternatives

  1. Ignore policy/**. Rejected because it creates an unbounded policy namespace blind spot.
  2. Hand-author manifests. Rejected because it bypasses the reviewed builder and increases stale-hash risk.
  3. Regenerate or prune v1 baseline entries. Rejected because v2 is a reviewed set extension, not a historical rewrite.
  4. Hardcode or register c9575ee1597337fc8c46c339eae30476bfd97571cd84d0ca7f6f95e516edac72. Rejected because this is candidate evidence, not production authority.
  5. Weaken the legacy changed-file gate. Rejected because its refusal correctly identifies a protected-policy migration requiring dedicated review.

Compatibility

No acquisition, reader, materializer, controller, worker, scanner, report-schema, signer, workflow, App, branch-protection, or ruleset semantics change. The only Python change updates a transitional contract test; all authority implementation bytes remain unchanged.

Changed file scope:

  • .gitattributes
  • .reposentinel-baseline.json
  • .reposentinel.toml
  • policy/repo-sentinel-authority/v2/baseline.json
  • policy/repo-sentinel-authority/v2/coverage-policy.json
  • policy/repo-sentinel-authority/v2/dependencies.json
  • policy/repo-sentinel-authority/v2/epoch.json
  • policy/repo-sentinel-authority/v2/protected-manifest.json
  • policy/repo-sentinel-authority/v2/scanner-config.toml
  • policy/repo-sentinel-authority/v2/suppression-manifest.json
  • tests/test_repo_sentinel_policy_contracts.py

Candidate digest

CANDIDATE_D_V2 = c9575ee1597337fc8c46c339eae30476bfd97571cd84d0ca7f6f95e516edac72

Candidate components

Component Bytes SHA256
baseline.json 425134 8eff61c98f62d54b7280517967e6f9f8e66ffb2d18f5d4acbb9de63565a01669
coverage-policy.json 2762 679da3c4f5188367842ad55f25e9f00c0af34dff97fa8c9b528f1d51b243a7cb
dependencies.json 229 a8acbdf5ba63d28ac2e8d6940d7618eb2bde1851696cbdd31ae07a7666037074
epoch.json 1103 9bc408b6db191c03c7993df6fca00dc3e7e78f116b0b7e7aa5ecbd397d42c358
protected-manifest.json 3054 787da55b0104d81d6b4404a93baf562b64c2a337c9ce94f7dff88fe4a59bcb79
scanner-config.toml 223 296b51421202609a4b770d868cd1026a2aa26e884e66dff759516679e63b73e4
suppression-manifest.json 410 6e8dbc24956284b763d74fe25fda579f49838a8e1e18d6665739e70697345506

Protected entry set (17)

Exact path, mode, and byte hash set
Path Mode SHA256
.gitattributes 100644 69c12dff31af0dd49817c0f38898cfc0304fb33d95f0bcf093f0208c0c849a59
.github/workflows/markdown-lint.yml 100644 d9a175b811a904f7b4e9da79e356980f557c8656cfa4ea81744bc86ecb241175
.github/workflows/markdownlint-debt.yml 100644 286c57901506054dfcdd5ba5425c3e851a6201ee43ffec95db765b579d99a64a
.github/workflows/placeholder-audit.yml 100644 71fffc8b84e38ab3bf95b6497dafb32a3f3ec563fef8e5894a234123989c495c
.github/workflows/repo-sentinel-gate.yml 100644 bff70a88960b96d445be7149258a4b2c5d8fef1126ecce6bb6520b794efd1931
.reposentinel-baseline.json 100644 8eff61c98f62d54b7280517967e6f9f8e66ffb2d18f5d4acbb9de63565a01669
.reposentinel.toml 100644 296b51421202609a4b770d868cd1026a2aa26e884e66dff759516679e63b73e4
scripts/repo_sentinel_acquire.py 100644 6133a969ccad41394113775c872d35403b94f1d80926fab95948a123ad8f54e9
scripts/repo_sentinel_authoritative.py 100644 33b7fe73fa798b212177e9f4a5064ee0845aa19f50a8df29d0fcd85451b95220
scripts/repo_sentinel_authority_bootstrap.sh 100755 cdeb5b89adb4005ff1c9ab4bae5f113ffb9a725164a18b4af05a1325c0e69f30
scripts/repo_sentinel_authority_controller.py 100644 52fd52bab5a6f821e874c39c6cf28298610a7854b07468c854158a0f41a032d7
scripts/repo_sentinel_commit_authoritative.py 100644 4743536cfc55b777afd06b4dc1d50c5c0bfe7dcc3bd7a80849ad0cdf4a18ed67
scripts/repo_sentinel_gate.py 100644 79be642d1aa1b464b377115ef8d02175f82a793f7f242b714efe35e4f97a190f
scripts/repo_sentinel_materialize.py 100644 05fd0b6448fdb3b6c52969700d6a9a19e4790c7c78343af09aebb37d0bc5c0ed
scripts/repo_sentinel_policy_bundle.py 100644 0b8ef28aeba391dac366f38bb5ce4903132acfcb89359f01067a773b12ad4386
scripts/repo_sentinel_reader.py 100644 3fc587a12847d58bd78d4168a3a959293c76928f60a6ccfcae5d1fb5d8e36ef0
scripts/test_repo_sentinel_integration.py 100644 ae67bd08f03c0a0877c5c078f32ec2e91b72fb0ad768cdadcf3688e8afe142a2

Suppression entry set (2)

Path Mode SHA256
tests/test_repo_sentinel_authoritative.py 100644 203e057697436bd2db73313ec8d27e7564d04684218a3c2e51608f9066a420e2
tests/test_repo_sentinel_commit_authoritative.py 100644 80656d8990f2daa58e9b0aff8a8c0b1ee2da408f6d970467beac64f8e596c44e

Coverage entry set (10)

Path Mode Reason SHA256
.reposentinel-baseline.json 100644 config_ignore 8eff61c98f62d54b7280517967e6f9f8e66ffb2d18f5d4acbb9de63565a01669
policy/repo-sentinel-authority/v1/baseline.json 100644 config_ignore 0b6e8641d58a8a4c927d6dd610562d6f6e40bddb7cb1dd0f7c42c103ae3193b5
policy/repo-sentinel-authority/v1/coverage-policy.json 100644 config_ignore 36b544546949b64e83bde547ca861f03446e7ef1f3321439795a90ffc8a6b0de
policy/repo-sentinel-authority/v1/dependencies.json 100644 config_ignore a8acbdf5ba63d28ac2e8d6940d7618eb2bde1851696cbdd31ae07a7666037074
policy/repo-sentinel-authority/v1/epoch.json 100644 config_ignore 25e08c1051ad0e8d3137728435dc1dec57b52bf3d7497cb82c51d1739a1ba82e
policy/repo-sentinel-authority/v1/protected-manifest.json 100644 config_ignore 307fc1e7c57879bc82ba9aab658d1ac318214addd16dd125057c5996a79bf466
policy/repo-sentinel-authority/v1/scanner-config.toml 100644 config_ignore 69d0c0d8748e8c113aa31f63c82992633b666a61c0eb60a4298138ee885dea33
policy/repo-sentinel-authority/v1/suppression-manifest.json 100644 config_ignore 98265ad3389adbf19f55f1141b58151a7e35ad0dcf6a43dfc2b94848db0aec1d
reports/markdownlint-debt.txt 100644 config_ignore 85c81f3abf8dce8b1e08e95ceca33243adbd6829f2c4db586d1f23a152cb6197
reports/placeholder-audit.txt 100644 config_ignore 53228461cdc4e9db92612944d30152efff3ce50a80e850bdb6cdc82641e77a13

The authority evaluation reports seven additional current-mirror exclusions, yielding 17 policy-excluded files and zero scanner skips.

Baseline migration

  • Historical v1 entries: 436
  • Added reviewed identities: 81
  • Removed historical entries: 0
  • Candidate entries: 517
  • Classifications: 28 BENIGN_POLICY_IDENTIFIER, 28 DOCUMENTATION_IDENTIFIER, 25 TEST_IDENTIFIER
  • MATERIAL_SECRET_OR_UNSAFE_LITERAL: 0
  • Final full scan unsuppressed findings: 0
Exact 81-entry reviewed identity set
Path Line Rule Version Severity Token SHA256 Fingerprint Classification Reason
.gitattributes 6 secret.high_entropy 1 error aa3b5b6ccd82e21da8bd6c5c59491f51d9f0a8de079c95f13a0bd684e40c2786 f112a4d0fe6f986695ee56d1317ac6f6bd76c0413ba374ac657db34ce34b0d5a BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
.reposentinel.toml 5 secret.high_entropy 1 error a4e1da4f5e47eaadb2f6b28a80be58e97b4b6088ff55226d90c322e8cb7b577f 8277981fffa2626b0be876bcadcdbd414e6f191148b1c847bc6a0c088d7366de BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
.reposentinel.toml 6 secret.high_entropy 1 error aa3b5b6ccd82e21da8bd6c5c59491f51d9f0a8de079c95f13a0bd684e40c2786 9e7d0206e742cb3bf1aab67e8e84251909aad15d9a52972516ec4fff9b18073b BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
docs/design-decisions/repo-sentinel-authority-controller-v1.md 140 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 ef59c8ca932ed02b102fdad10581239e9c9e94a9445d43e3015f6708b512f018 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-authority-controller-v1.md 151 secret.high_entropy 1 error 6dbcab8d4cc8b10135c40b1dafd156f310e7db0f7970ea0e9f33830fc9e805ea 871f87c11076e7c9dd22918579bac0b2cb7341a2761a838349fbfc89249e4b57 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-authority-controller-v1.md 167 secret.high_entropy 1 error a4e1da4f5e47eaadb2f6b28a80be58e97b4b6088ff55226d90c322e8cb7b577f 0356782f8a04029368fbb1544e89af01e43a8aa7b99f2abfa4a92c2d97131168 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-authority-controller-v1.md 235 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 09bb6323eed3817e3cade40cd6c67cc9ec2a2c571717a5efa24ce7f92604219a DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-authority-controller-v1.md 237 secret.high_entropy 1 error 874603f472c93da3a200c2536635499bfda0667ca6353cec09758ae379418136 ac5b53a90e0175df9ed20d29dddac461bf49074ec7d888581e5b577f89325386 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-external-policy-root-v1.md 43 secret.high_entropy 1 error aa3b5b6ccd82e21da8bd6c5c59491f51d9f0a8de079c95f13a0bd684e40c2786 5f4dd464c89687cdc410b020df8f30f7a5372d47779801b9666e96d620d1ee56 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-external-policy-root-v1.md 92 secret.high_entropy 1 error 4a9ab723a0eb41d16c4d327846b6546467478e68c92da0ad28a36ecd5bf4ca15 471358c0a426f12fd4b71a19204127a19843eea8ff612f88096683e50b17c731 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-external-policy-root-v1.md 295 secret.high_entropy 1 error a4e1da4f5e47eaadb2f6b28a80be58e97b4b6088ff55226d90c322e8cb7b577f cedd4fe83cb192691d9662f059f306470381823f04236af1e31c3d920d7139e8 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
docs/design-decisions/repo-sentinel-external-policy-root-v1.md 305 secret.high_entropy 1 error aa3b5b6ccd82e21da8bd6c5c59491f51d9f0a8de079c95f13a0bd684e40c2786 b07f64ba2c5fb383e7e52d750af4d770e5c68821bfc7cf96cb88d5c329653f51 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/00-foundations/hydra.md 193 secret.assignment_context 1 warning ee59b1ea6703655277ccc3f02187edae47bdfb2e2583c8310867c26f0482c596 460da1fa00978cc74d97a531bcadaff941548f619b3d2eada1efa6ca5aef2a86 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/00-foundations/hydra.md 404 secret.assignment_context 1 warning ee59b1ea6703655277ccc3f02187edae47bdfb2e2583c8310867c26f0482c596 d8a2d585f3d4884ec9dbf1365501517c37cbbbae9bd3683061786af3baf99599 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/00-foundations/hydra.md 410 secret.assignment_context 1 warning ee59b1ea6703655277ccc3f02187edae47bdfb2e2583c8310867c26f0482c596 9634eacb4684219b56d82653f4c897739ff34c9ab9947c702bf355b452f814ec DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/10-web/20-authentication/authentication-bypass.md 106 secret.assignment_context 1 warning fea7192489168e1eb63a4fec60186a31cbb5470fe06cfe5d634fcfe7f99869c3 e6dd6b961044a1142f2e5b10c0cf71e88fbb023e500c42a8ade888b90b0719ff DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/10-web/20-authentication/authentication-bypass.md 336 secret.assignment_context 1 warning fea7192489168e1eb63a4fec60186a31cbb5470fe06cfe5d634fcfe7f99869c3 413eae5b45273fb95ac65c2100265e543146fb5c449280e7dcd4438c9c74b080 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/10-web/intro-to-iot-pentesting.md 279 secret.assignment_context 1 warning 4bd89417201d6926b7722102d103637a9963e6e0715a958ff0afd939d218dcbd 8eaaa2a4b861c31850ccce02b9c12c605b682fa416146d91ba298553a1a034c2 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
notes/10-web/sqlmap-the-basics.md 77 secret.assignment_context 1 warning 4834e5b26a861e39f4fc2b01f7c2c913bbb5ab1ae01c3a48f3c6011cce5975f4 ea9f621a91032cc44f93e498dae9aedbec59136fe6fc53bad3037d7d3dd42c5c DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
scripts/repo_sentinel_authority_controller.py 28 secret.high_entropy 1 error 6dbcab8d4cc8b10135c40b1dafd156f310e7db0f7970ea0e9f33830fc9e805ea 9978230a465a5a7419ac5b8904275cbf4f00e0c596542ed857efbe8d5a192f74 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 31 secret.high_entropy 1 error 3dae57c31c65791e449e62c54c1f3dcc524346cd8c19e8a5ef9168b0c412809c bada2ec85672ee15eee2a7867e208a6e0cef60517572e444a0813c3d2eb6805a BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 68 secret.high_entropy 1 error a63871bc1b338055afcc069521d993fd0525e0a5352263db23ded4b61ec6ac21 c45b3012937894431ba9f08fae981c89b80ad037595af6e7ff52b85c7aa9acc6 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 87 secret.high_entropy 1 error 5a8cfc8588cce1e6360ffeca9bfda8e65881bced2e52fec34151d3bd04d2b90f 003abe1eb4805a2e2309f77be76d77990ccb5ae79158e1ba0f60c760634ad965 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 93 secret.high_entropy 1 error 7f2b15d4664cc7d6cacfe6f35763ac262eb7062de73387bbe7902738113f350f a07e40efebb354ada2916d1303e71f3981770d389ab278ab5a62c71606f846b0 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 99 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 7a4f0045fa3ccbf679f1fad5d7bf8e1307d9dc653989d0dfb67fef0113b89b32 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 102 secret.high_entropy 1 error a527b6909f40df9cec2777d8377356d6ede4e6d1714034b38c985367a27d2f9a 0cc652d10c2ea9cf8db2f80b049b3a74c8bf65d157bfcfdd5cf92189d73024ad BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 146 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 aace39995234baa6d30b3482431043425118c0cb3f2452be41e13c0b5368d71a BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 159 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 df1e217fe92be524c358f48028ea93479b934500caec01fe44f36f72a936b634 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 161 secret.high_entropy 1 error 874603f472c93da3a200c2536635499bfda0667ca6353cec09758ae379418136 ce111b01106e1489d010ff0ed242277ee8b4a772a96f5187a57091be8a2e55a2 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 395 secret.high_entropy 1 error 5a8cfc8588cce1e6360ffeca9bfda8e65881bced2e52fec34151d3bd04d2b90f 869d6b9755269e2f99db0a47b9aec74b2b7619670e6fca994da536fe4ea6fb17 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 413 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 9601027f1550479a2574d799262a7cc16d193929085f87989c05e7037309152f BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 427 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 e1c42ba037cc75f5b27284ef2450d139dcd717984bf19c76858f49ba2ae493ba BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 534 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 64040476562b748b5eb1c74bf525c2fcbf269817f5b8b5b6b79b4c244cb0945b BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 535 secret.high_entropy 1 error a527b6909f40df9cec2777d8377356d6ede4e6d1714034b38c985367a27d2f9a 7490fbaf0f6826341cc2f33ff7b3b1745d2468fc78aebab3be70ce2af0402070 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 537 secret.high_entropy 1 error 7f2b15d4664cc7d6cacfe6f35763ac262eb7062de73387bbe7902738113f350f 68e5fe63a29a48aa9c9d705e7a036588ff652b5ebbfbe3028f1b312eb5a8d3fc BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 561 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 2cbbac50dd405d3399c67c98729ce9413368a0934376bce15fcc7104a039c339 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 561 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 9ea9d740e7ca093ebfde37c607faea5203439d4c5737449e6d52fbd67e927b78 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 587 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 e0e38b21504411b1c4f38c0ac8b96c91a1923c062dc4ae7cdeb3a8b1ef715e24 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 588 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 8f34787d1ff8c3db25581c141120577948effb7a0fff569e3762b1a14ea70161 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 616 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 76f09eb73337ffa61e9c1609522bc3853850e743986905073fd497c32fe57b2d BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 688 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 2e1a71ca295df48bb5ec7e3345daa323028107cce977cae6ba458f41f2c9cad7 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 729 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 426fc4feb4553ce6d00ee4b0c579657d83b2c1818f4a41ac6d2200f680d8adea BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_authority_controller.py 734 secret.high_entropy 1 error 874603f472c93da3a200c2536635499bfda0667ca6353cec09758ae379418136 a4b879eb1c37105589ef001af304330b5ca654e9fcf1aeebf2fcf5692f234222 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
scripts/repo_sentinel_policy_bundle.py 171 secret.high_entropy 1 error aa3b5b6ccd82e21da8bd6c5c59491f51d9f0a8de079c95f13a0bd684e40c2786 03694c1416bc095d21bd3a833658f90e80e70f656888226f99785f3c6a530823 BENIGN_POLICY_IDENTIFIER Reviewed repository policy path, protocol field, or refusal identifier; not credential material.
tests/test_repo_sentinel_authority_controller.py 40 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 69c0e8afb714313eda50db8938818c0826a50a8af1ac788b469dfdf47193c697 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 46 secret.high_entropy 1 error 7f2b15d4664cc7d6cacfe6f35763ac262eb7062de73387bbe7902738113f350f 1bb03b6001e4ac8558e679f7038893e1685c59ffd4f6b9668f4a54a1ff972e50 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 52 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 2323a9d6cdc15f6730829e1248f676ff2f53cac70f313e5989dfb7532f1e5a06 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 55 secret.high_entropy 1 error a527b6909f40df9cec2777d8377356d6ede4e6d1714034b38c985367a27d2f9a 661fa9d5cf32777d58d2a450e2c17874a1aa9c8b5d6e7d65cb8300f38e032705 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 165 secret.high_entropy 1 error 874603f472c93da3a200c2536635499bfda0667ca6353cec09758ae379418136 bbfc4eb5058027f4f454057bee9c7a5648f827505c131653e8384f3eb79b893a TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 186 secret.high_entropy 1 error 5a8cfc8588cce1e6360ffeca9bfda8e65881bced2e52fec34151d3bd04d2b90f 82ebea37a5f1e2fbbc10000203fd201243a8d422d782c665a14efaa7fd8c2787 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 187 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 e8344f815bab0e2d54eac8c90fea5713af3310f0a51552796cbbbba58b4fb59c TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 239 secret.high_entropy 1 error 6c9ee1764695b6d0dcb4fd77d2ca3a0f0caf85bef480001d877ff55cbcabbc1d 9e2c7a2cf963ce3e20f9a885827eea8ca3bfaa9d17a28dc3c1cc4eaceff222b7 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 246 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 b43d53b270b2b47b691bff6f66ccfd85b40ff72d4a135dab3fae01e9dc8759f3 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 296 secret.high_entropy 1 error 788cbad0dbfd24e29cc53273bbf0ccf0f0026ff97655e5309620cca5cff12fd8 af94d0d0e89da6c7f7a320eb22106494a043bb9e19b81d0f55e8db0b8f48dce2 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 308 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 835e8577913fc2b520e5b49892c97312ada735d07a1166594e0c2c010169f764 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 309 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 8326e08bb87eca9d7000344035df5b16da477d1ed6e17d8c736856c187e5a30c TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 315 secret.high_entropy 1 error a9f908a414d96dacb1efb3c4e587a483ccef5f0e0e2a2f8c4ab4a64c2508437e 63fdeed73806fb03f407344fae18eaa294ba0de77d582ca8767272a339413d7d TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 329 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 0d63502611565c5d526bb01d2f29e828c22e43be1f53d5bb9a3648446c7b15a1 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 330 secret.high_entropy 1 error 60b59ea645ff24c792926c33141b739913782f516a7bfc1dd0702d3814dca424 daba36972dd17ae9d189826f6d6d8cd2ed58f1aa0cacec64f848a9a8039f1f29 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 339 secret.high_entropy 1 error 3dae57c31c65791e449e62c54c1f3dcc524346cd8c19e8a5ef9168b0c412809c 24f7aa94c6a98fef2de66e66adebc52abad61bc62c5147f35fafe58f0e662096 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 357 secret.high_entropy 1 error 881bd682f6515036d009b199df823dbc52f51dce9f8c5f90148ed9cde1368984 5aa76f9067965e1dd23779db30a142a74623faa4c5d429301f9a181fd8646bba TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 392 secret.high_entropy 1 error e9780fdca5c88c86e9ee5cd2a7020c0c554b934811940734f1341713dd74d726 6c1ae8f5c1aa714e0c3ce8b6f89c8f835ee51af781852bcd661bda39973766c4 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_authority_controller.py 562 secret.high_entropy 1 error c7fa791b64d78ad531d2f624044b425d020c5954826bf4a5ad7f57de7fe4e1a2 e94bf61f47f8263e05d4e82ee11c453fa3164b8400d1b918ad3458e946675b8b TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_commit_authoritative.py 567 secret.high_entropy 1 error 614b07cf3f6078e0a6ca69e42e4ab35a14354f257cbb58bad1ab0a2255bf071a cf2576403a797045e6725e0c4495bcc796308304f7b4b18f1fa714566d06ef90 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_policy_contracts.py 181 secret.high_entropy 1 error a63871bc1b338055afcc069521d993fd0525e0a5352263db23ded4b61ec6ac21 229c8ec5d02ee45cbe7b13c07c0545df2b0d4f53a9a27e24e28a644ae6b0767d TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_policy_contracts.py 187 secret.high_entropy 1 error a63871bc1b338055afcc069521d993fd0525e0a5352263db23ded4b61ec6ac21 56822c7515f1b6dab7c2c49f455e28e899f398f66248760ffb1c3fe4a558397b TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_policy_contracts.py 267 secret.high_entropy 1 error 1a4dc4210ed198222315b422f420f49d662796027eedb643942557a0c3b1e699 72376b7fd1a226cdd8ef59d96716504ad1f84cd77b56893fdac930ace33c3681 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_policy_contracts.py 271 secret.high_entropy 1 error 127c59b80ce68fe3f1893abb25940b66c3460324edeaa40643f87efb0181c28d 08baf8c677d0072c7625c35c383823fb5caa8d341114fa65025179f9b6dc9951 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
tests/test_repo_sentinel_policy_contracts.py 272 secret.high_entropy 1 error 01a64cd0117a8e03ed044bacc9cdee12d1e20433e2d9a3bf2563800717e21ea5 0c4193e8048fe9168a47764ded9210ef790eb8edbc2116fda2cc14f18924ccd5 TEST_IDENTIFIER Reviewed deterministic test name, synthetic digest, or policy fixture identifier.
TryHackMe/00-foundations/learning-meta/become-a-hacker.md 149 secret.assignment_context 1 warning bf1f521268a702e8878df0164d0739fb3c56104c6d7075952e2ea74063333e76 43569acc61337300812fa0b257191354a69cbf2c4076260e70739a1d350135fe DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/00-foundations/learning-meta/become-a-hacker.md 159 secret.assignment_context 1 warning bf1f521268a702e8878df0164d0739fb3c56104c6d7075952e2ea74063333e76 b7c0e34920b6ff8b3c61fd17a1ff8e80bfa5d5541b726cc563bf4757677a9485 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/00-foundations/writing-pentest-reports.md 550 secret.assignment_context 1 warning 4bd89417201d6926b7722102d103637a9963e6e0715a958ff0afd939d218dcbd dc42efa6d9a9d6182f9e593c8f0718012ce5062ac8c85bc53263c1ad51eb7216 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/10-web/how-the-web-works/02-HTTP-in-detailed.md 386 secret.assignment_context 1 warning c44566f0c976231fcdea01d86c4711d668f67872de4094c2c65745768f11b91b 03b9b4345c510ebf0976096ead6f73a874511cbbacc44c95a7670722c5ef8441 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/20-linux/linux-fundamentals/partIII.md 66 secret.assignment_context 1 warning 5f2353e51b0d82ceeeb7bbaa57dc6d09a5ddc09c0f9889aae107bdcda92292ef 189a8502bacb62ac3c23909f6804cb5d7c0994ffc757f42c8957abc696d2ec61 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/hidden-deep-into-my-heart.md 59 secret.assignment_context 1 warning 1931abb1cda2dfc0e7a52acc40495a8bee8a6d15ec7dd404a103d02c098c01d0 12f5e1841bf9dbbda3e6ebdff34960bc276009102e57ba0833c3b527ad3f82a0 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/hidden-deep-into-my-heart.md 89 secret.assignment_context 1 warning d1213a984e33f6e2983e7bd9cc389d71719d5452fc37eb54d973dc6b0ab29c02 f1630b8293d0807308a14e79f48aa39719ddcce53e35ae1b5698a4ba906f78c2 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/valenfind.md 120 secret.assignment_context 1 warning 66d4f7b7ebfeaf9c59da3cdff30e41637c76a7e4fcbccd2e254eac2e1238d592 b62fde08d3dd24674165ba76c9ada03f753337f819d5469c75db9e5d3420f4b1 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/valenfind.md 135 secret.assignment_context 1 warning ed3ee06cd1f9ae42a18e9f35a8e4e6269fc70b7abe1d38b59823d17047c28245 7f1b2322d86206524b29bdb70dd003feb3ca16750910d7599863889874fa19ea DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/valenfind.md 203 secret.assignment_context 1 warning 3cc7a7c0f77b00f022dfb2a7f48cfacfa0e3dd4518f3a6fa4e4e2a9690ee9647 d0e151d367891cf20d2bcde2992f06774ea7ef3af98689de0efd7bedbb194094 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/love-at-first-breach-2026/valenfind.md 211 secret.assignment_context 1 warning 40e62b329ef3c48a337b896ffde89601926e2748fe105b192c65dce447cf2476 8c1691190a1a0ffb27aaaae1310695a047c38f918b2cec999fdfb57f0fa405a9 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.
TryHackMe/90-events/thm-aoc-2025/Day 17 - CyberChef - Hoperation Save McSkidy.md 113 secret.assignment_context 1 warning 96d62e2abd3e42de5f50330fb8efc4c5599835278077b21e9aa0b33c1df07a1c 834441ee69b33d317caa28d8325caac7d794dead7098aa37a825e3b42f9d0cc6 DOCUMENTATION_IDENTIFIER Reviewed public documentation or sanitized training-lab example; no live secret or private credential.

Validation

  • Candidate bundle verifier: c9575ee1597337fc8c46c339eae30476bfd97571cd84d0ca7f6f95e516edac72.
  • Deterministic rebuilds: first and two independent rebuilds produced c9575ee1597337fc8c46c339eae30476bfd97571cd84d0ca7f6f95e516edac72; all seven files are byte-identical.
  • Exact-H worker run 1 and run 2: PASS, 271 total, 254 scanned, 17 policy-excluded, 0 skipped.
  • Exact-H report SHA256: 23c1d46ac13805d84d491d8c3eaa27aa084abf06d3f0b26bf5808cdf9e80b8f1.
  • Exact-H semantic SHA256: 14a20d65e98e1d4993fc09479b4a6719574ea8a7f88af07282582724df9618f1.
  • Mutation campaign: 16/16 expected admission refusals across v1, v2 mirror, protected-control, and suppression classes.
  • Baseline negative control: removing f112a4d0...d5a from an otherwise self-consistent temporary bundle produced SCANNER_FINDING, no refusal, and non-null report/semantic digests.
  • Wrong external digest: INFRASTRUCTURE_REFUSAL / policy_bundle_mismatch, with no semantic authority result.
  • v1 verifier: 6f25ebb773ce1453e8de623bca5aaecc936f1f188288f8df20aedeadb3bf4612; no v1 diff from base.
  • Focused boundary suites: 121 tests passed, 1 POSIX-only skip.
  • Full repository suite: 178 tests passed, 4 expected skips.
  • Taxonomy, README snapshot, pattern library, 157-file Markdown/front matter, pre-commit, changed-Python Ruff lint/format, privacy review, and git diff --check: pass.
  • Repository-wide Ruff reports existing base debt (5 lint findings and 18 checkout-format candidates); the exact committed changed Python blob passes both Ruff checks, so this PR does not broaden that debt.
  • CI: all non-legacy checks pass. Changed-file error gate fails only with the expected protected-policy migration message for .reposentinel-baseline.json and .reposentinel.toml.
  • Controller protocol was exercised with a SHA-verified bootstrap blob and the required non-symlink CPython 3.12.3 runtime. Local fixed-environment WSL acquisition returned acquisition_refused because direct public Git transport is unavailable from that isolated environment; controller contract tests pass, and no authority status was published.

Migration exception candidate

This review exception is narrowly bound to:

  • PR: #22
  • Exact head: 7c9e5135804e0ffe1f7e5d982bf419fbbd4352be
  • Policy epoch: repo-sentinel-authority-v2
  • Candidate digest: c9575ee1597337fc8c46c339eae30476bfd97571cd84d0ca7f6f95e516edac72
  • Reviewed baseline delta: exactly the 81 identities in the table above
  • Reviewed file scope: exactly the 11 paths listed above

It authorizes review of this candidate migration only. It does not authorize any signer, authority workflow/action, GitHub App, Commit Status, branch-protection, ruleset, or later source change.

Rollback

Close this Draft PR and delete the candidate branch. Main, v1 evidence, production authority, branch rules, and status publication remain unchanged.

@stacknil stacknil mentioned this pull request Sep 18, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stacknil