Skip to content

Define supported IFC profile variability and publication rules #1354

Closed
Closed
Define supported IFC profile variability and publication rules#1354
Labels
area:runtimeRuntime and control-plane codedocumentationImprovements or additions to documentation
Milestone
Runtime Refactor

Description

@Brad-Edwards
Brad-Edwards
opened on Sep 21, 2026

The general IFC model supports distinctions that the published finite security vocabulary cannot directly represent, including independent owners' confidentiality obligations.

Acceptance criteria

  • Determine which distinctions belong in authored requirements, published semantic profiles, and backend configuration. Use concrete owner-qualified confidentiality and integrity cases to establish the required expressiveness.
  • Define support negotiation and rejection when a profile cannot express or realize the requirement. Distinguish admitted guarantee strength from an unexpected weakening during execution.
  • Retain conservative propagation, independent confidentiality/integrity coordinates, release authority, and immutable provenance. Governed profile publication remains valid; additional syntax or a general plugin facility requires justification.
  • Publish the accepted decision, SEM-233/SEM-235 and ADR-101/108 amendments where needed, exact support limits, and migration obligations. Do not infer a requirement for a new general policy language.

References: Diagnosis, IFC semantics.

Requirements

  • SEM-233 — Adversarial Participant Boundary Information-Flow Control
  • SEM-235 — Modular Participant Control and Extensible Dynamic IFC Semantics

Activity

  1. Brad-Edwards
    added this to the Runtime Refactor milestone on Sep 21, 2026
  2. Brad-Edwards
    added
    documentationImprovements or additions to documentation
    area:runtimeRuntime and control-plane code
    on Sep 21, 2026
  3. Brad-Edwards
    marked this as blocking on Sep 21, 2026

  4. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    🛠️ Picked up by /implement - driver codex, branch 1354-ifc-profile-variability, 2026-09-23T04:55:21.499Z.

  5. Brad-Edwards
    added
    in-progressAn agent is actively working this issue via /implement
    on Sep 23, 2026

  6. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc workflow phase recorded: preflight (issue #1354). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

  7. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc workflow phase recorded: preflight (issue #1354). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

  8. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc workflow phase recorded: preflight (issue #1354). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

  9. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc workflow phase recorded: plan (issue #1354). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

    Implement #1354 as a semantic publication under SEM-233 and SEM-235, with acceptance effective on merge and existing runtime/contract evidence retaining its original scope.

    1. Publish ADR-113 and specs/formal/participant-semantics/ifc-profile-variability.md (IFC-01–IFC-07). Separate authored obligations, exact published profile meaning and backend realization; use independent owner confidentiality and integrity cases. Preserve the SEM-233 algebra and selective release authority. Choose governed finite publication; introduce neither owner-parameter syntax nor a general policy language/plugin facility.
    2. Define expressibility, independently evidenced realization, admission and execution weakening using CA-04. Document the exact current security vocabulary, digest-bound loader, closed modular profile union, token-replacement endorsement carrier and current rejection of non-exact support. A future publication must prove owner-scoped release and complete reader/validator support; this change will not register a new profile or claim backend implementation.
    3. Publish worked cases/evidence and migration obligations in docs/research/ifc-profile-variability/cases.md and docs/migration/ifc-profile-variability.md. Preserve historical bytes, labels, releases, memory, provenance, pending effects and exact profile interpretations. Unknown or lossy conversion never invents owner distinctions.
    4. Amend SEM-233/SEM-235 statements and evidence boundaries, ADR-101/108 with recorded amendment rows and canonical pins, and the focused formal/reference indexes. Keep both requirements ACTIVE with explicitly bounded semantic fulfillment; add precise IMPLEMENTS/TESTS/DOCUMENTS traceability.
    5. Add a small test-local finite interpretation and behavioral cases in implementations/python/tests/ifc_profile_variability_model.py and test_issue_1354_ifc_profile_variability.py, reusing sem233_boundary_flow_model.py for joins, derivations, sink checks and coordinate rewrites. Add test_issue_1354_governance.py against the real ownership/scope consumer, then make the narrow exact-path additions to tools/policy/requirement_order.yaml and docs/governance/requirement-scopes/1354.json.

    TDD: all four acceptance criteria use Path A for the new finite semantic/ownership evidence, with prose amendments accompanying it. Observe failing negotiation/selective-release and ownership tests before implementing their model/configuration. Existing real parser/context rejection tests establish current support limits. No documentation-only carve-out or text-substring tests.

    Security: reuse bounded closed ingress, exact profile/digest resolution, trusted source/sink/per-obligation authority and capability context, API-409/API-423 admission, final-sink mediation and atomic history boundaries. The test model assumes resolved synthetic context and proves no live enforcement. Safe reason categories and projected evidence disclose no rejected values or credentials. No new env/OS/provider execution surface.
    Maintainability: reuse the existing flow oracle, profile loader, CA-04 relation, requirement-scope evaluator, ADR pin and publication tooling; add no parallel production resolver, state store or policy engine.
    Extensibility: a new governed finite profile can add justified distinctions only with its own identity, validation, release correspondence and consumer evidence. Unbounded owners or new parameter syntax remain unsupported until separately justified.
    Whole-repo view: preserve normative/contract/runtime ownership, profile packaging and schema parity, historical readers, concept-family authority, ADR-059 pins, requirement governance, pre-publish hooks, CI and Sonar.

    Verification: set RAES_REQUIREMENT_UID=SEM-235; run only the new focused pytest modules and relevant existing SEM-233/CA tests, file-local repository policy, exact changed-path requirement governance, ADR pin checks and documentation checks. Baseline: 85 relevant tests passed. Full suites remain in CI. Preserve the mandatory review, publish, CI/Sonar and readiness gates. Do not edit CHANGELOG.md, release versions or published schema/profile bytes.

  10. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc_codex_review — sanitized deferred publication for issue #1354, cycle 1 of 1
    Reviewed revision: 0ff40b91604a3e31984a115f4c01030fd5b7772b643d4c7ce74aeb72882db8b2

    Architectural read

    Core and security review found no material blockers in the 20-file candidate. The semantic publication reuses SEM-233 and CA-04, preserves per-obligation authority, propagation and historical interpretation, and keeps runtime adoption separate. The finite witnesses exercise meaningful distinctions without broadening operational claims.

    Verdict: ship

    Findings

    • (none)

  11. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    gc_codex_review pre-push cycle 1 of 1 complete for issue #1354 on branch '1354-ifc-profile-variability'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

  12. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Review decision record — codex cycle 1 (issue #1354)

    Reviewer: codex
    Cycle: 1
    Verdict: ship

    Architectural read:

    Core and security review found no material blockers in the 20-file candidate. The semantic publication reuses SEM-233 and CA-04, preserves per-obligation authority, propagation and historical interpretation, and keeps runtime adoption separate. The finite witnesses exercise meaningful distinctions without broadening operational claims.

    Blocking findings: 0 (clean run)

  13. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at ddba5049a0f851a0906792e1e61a1917033e2f6e
    • Outcome: already_current
    • Published feature head: 7b6e981f936454f53fb8c57ff8ebb0bb9a33ceda
    • Synchronized tree: d76bda5bce3f8230aa50984a6f7695c7bb4fd512

  14. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at ddba5049a0f851a0906792e1e61a1917033e2f6e
    • Outcome: already_current
    • Published feature head: 95d2dabbefbe5988dfaaf185b33c3c1ddba95486
    • Synchronized tree: d162e824d0ff47026de6fa67e63ad1447fa875ae

  15. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Ready for review — issue #1354

    PR: #1383
    Plan: #1354 (comment)

    Outcome

    Authors and operators can distinguish required owner-qualified IFC semantics from what a published profile can express and what a backend can realize. The amendment defines explicit admission, refusal, publication, and migration rules, supported by bounded semantic evidence; it adds no runtime profile support.

    In-scope requirements

    Proposed state in this PR — authoritative only after merge.

    • SEM-233 (Adversarial Participant Boundary Information-Flow Control) — ACTIVE (proposed) — Existing ACTIVE state retained; IFC-01–IFC-07 semantic amendment and bounded evidence only.
    • SEM-235 (Modular Participant Control and Extensible Dynamic IFC Semantics) — ACTIVE (proposed) — Existing ACTIVE state retained; governed publication and support semantics, without runtime adoption.

    Files changed

    Added:

    • docs/decisions/adrs/adr-113-ifc-profile-variability-and-publication.md
    • docs/decisions/issue-1354-ifc-profile-variability-preflight.md
    • docs/governance/requirement-scopes/1354.json
    • docs/migration/ifc-profile-variability.md
    • docs/research/ifc-profile-variability/cases.md
    • implementations/python/tests/ifc_profile_variability_model.py
    • implementations/python/tests/test_issue_1354_governance.py
    • implementations/python/tests/test_issue_1354_ifc_profile_variability.py
    • specs/formal/participant-semantics/ifc-profile-variability.md

    Modified:

    • docs/decisions/adrs/README.md
    • docs/decisions/adrs/adr-101-adversarial-participant-flow-control.md
    • docs/decisions/adrs/adr-108-modular-participant-control-and-governed-effects.md
    • docs/decisions/adrs/adr-index.yaml
    • docs/explain/reference/modular-participant-control-contracts.md
    • docs/requirements/SEM-233/requirement.md
    • docs/requirements/SEM-235/requirement.md
    • specs/formal/participant-semantics/README.md
    • specs/formal/participant-semantics/adversarial-flow-control.md
    • specs/formal/participant-semantics/modular-participant-control.md
    • tools/policy/historical_identity_records.json
    • tools/policy/requirement_order.yaml

    Reviews

    • codex: Pre-push review: ship, no findings. Nine Sonar exception-test findings were repaired; current-head CI is green, with Sonar quality gate OK and zero open issues or hotspots.

    Traceability reconciliation

    Proposed in this PR — verified against the merged tree in Phase E.

    • IMPLEMENTS / TESTS / DOCUMENTS added: 1
    • Links updated: 1
    • Stale links removed: 0

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge. Phase E validates the merged requirement state, posts the final report, and closes the issue automatically once this PR merges.

  16. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Delivery readiness recorded — Phase E finalizes issue #1354 automatically when PR #1383 merges.

  17. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at 8407a630125e637f64d01130b40fa1d84b6fae2a
    • Outcome: merged_conflicts_resolved
    • Published feature head: 716f6e3742ac6b76307018d1e31fa5bbec152135
    • Synchronized tree: 63a20e671b9ae704aa047660fec356272c494289

  18. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Ready for review — issue #1354

    PR: #1383
    Plan: #1354 (comment)

    Outcome

    Authors and operators can distinguish required owner-qualified IFC semantics from what a published profile can express and what a backend can realize. The amendment defines explicit admission, refusal, publication, and migration rules, supported by bounded semantic evidence; it adds no runtime profile support.

    In-scope requirements

    Proposed state in this PR — authoritative only after merge.

    • SEM-233 (Adversarial Participant Boundary Information-Flow Control) — ACTIVE (proposed) — Existing ACTIVE state retained; IFC-01–IFC-07 semantic amendment and bounded evidence only.
    • SEM-235 (Modular Participant Control and Extensible Dynamic IFC Semantics) — ACTIVE (proposed) — Existing ACTIVE state retained; governed publication and support semantics, without runtime adoption.

    Files changed

    Added:

    • docs/decisions/adrs/adr-114-ifc-profile-variability-and-publication.md
    • docs/decisions/issue-1354-ifc-profile-variability-preflight.md
    • docs/governance/requirement-scopes/1354.json
    • docs/migration/ifc-profile-variability.md
    • docs/research/ifc-profile-variability/cases.md
    • implementations/python/tests/ifc_profile_variability_model.py
    • implementations/python/tests/test_issue_1354_governance.py
    • implementations/python/tests/test_issue_1354_ifc_profile_variability.py
    • specs/formal/participant-semantics/ifc-profile-variability.md

    Modified:

    • docs/decisions/adrs/README.md
    • docs/decisions/adrs/adr-101-adversarial-participant-flow-control.md
    • docs/decisions/adrs/adr-108-modular-participant-control-and-governed-effects.md
    • docs/decisions/adrs/adr-index.yaml
    • docs/explain/reference/modular-participant-control-contracts.md
    • docs/requirements/SEM-233/requirement.md
    • docs/requirements/SEM-235/requirement.md
    • specs/formal/participant-semantics/README.md
    • specs/formal/participant-semantics/adversarial-flow-control.md
    • specs/formal/participant-semantics/modular-participant-control.md
    • tools/policy/historical_identity_records.json
    • tools/policy/requirement_order.yaml

    Reviews

    • codex: Pre-push review: ship, no findings. The origin/dev merge resolved the ADR number collision and 28 focused tests plus ADR, requirement, and identity checks passed; current-head hosted gates are verified at readiness.

    Traceability reconciliation

    Proposed in this PR — verified against the merged tree in Phase E.

    • IMPLEMENTS / TESTS / DOCUMENTS added: 1
    • Links updated: 1
    • Stale links removed: 0

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge. Phase E validates the merged requirement state, posts the final report, and closes the issue automatically once this PR merges.

  19. Brad-Edwards commented on Sep 23, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 23, 2026
    CollaboratorAuthor

    Delivery readiness recorded — Phase E finalizes issue #1354 automatically when PR #1383 merges.

  20. github-actions commented on Sep 23, 2026

    @github-actions
    github-actionsbot
    on Sep 23, 2026 – with GitHub Actions
    Contributor

    Final report — issue #1354 complete

    PR: #1383
    Plan: #1354 (comment)

    Outcome

    Authors and operators can distinguish required owner-qualified IFC semantics from what a published profile can express and what a backend can realize. The amendment defines explicit admission, refusal, publication, and migration rules, supported by bounded semantic evidence; it adds no runtime profile support.

    In-scope requirements

    Verified at merge revision b00aba06389a.

    • SEM-233 (Adversarial Participant Boundary Information-Flow Control) — ACTIVE — Existing ACTIVE state retained; IFC-01–IFC-07 semantic amendment and bounded evidence only.
    • SEM-235 (Modular Participant Control and Extensible Dynamic IFC Semantics) — ACTIVE — Existing ACTIVE state retained; governed publication and support semantics, without runtime adoption.

    Files changed

    Added:

    • docs/decisions/adrs/adr-114-ifc-profile-variability-and-publication.md
    • docs/decisions/issue-1354-ifc-profile-variability-preflight.md
    • docs/governance/requirement-scopes/1354.json
    • docs/migration/ifc-profile-variability.md
    • docs/research/ifc-profile-variability/cases.md
    • implementations/python/tests/ifc_profile_variability_model.py
    • implementations/python/tests/test_issue_1354_governance.py
    • implementations/python/tests/test_issue_1354_ifc_profile_variability.py
    • specs/formal/participant-semantics/ifc-profile-variability.md

    Modified:

    • docs/decisions/adrs/README.md
    • docs/decisions/adrs/adr-101-adversarial-participant-flow-control.md
    • docs/decisions/adrs/adr-108-modular-participant-control-and-governed-effects.md
    • docs/decisions/adrs/adr-index.yaml
    • docs/explain/reference/modular-participant-control-contracts.md
    • docs/requirements/SEM-233/requirement.md
    • docs/requirements/SEM-235/requirement.md
    • specs/formal/participant-semantics/README.md
    • specs/formal/participant-semantics/adversarial-flow-control.md
    • specs/formal/participant-semantics/modular-participant-control.md
    • tools/policy/historical_identity_records.json
    • tools/policy/requirement_order.yaml

    Reviews

    • codex: Pre-push review: ship, no findings. The origin/dev merge resolved the ADR number collision and 28 focused tests plus ADR, requirement, and identity checks passed; current-head hosted gates are verified at readiness.

    Traceability reconciliation

    • IMPLEMENTS / TESTS / DOCUMENTS added: 1
    • Links updated: 1
    • Stale links removed: 0

    Both requirements retain their existing ACTIVE state. New evidence establishes the semantic publication boundary only and does not claim runtime adoption.

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge.
  21. github-actions
    closed this as completedon Sep 23, 2026
  22. github-actions
    removed
    in-progressAn agent is actively working this issue via /implement
    on Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:runtimeRuntime and control-plane codedocumentationImprovements or additions to documentation

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions