W-20 item (3): ratify SI-32 as A27 — filesystem attacker model (ADR 0008 ACCEPTED, spec v0.10)

CLAUDE.md

@@ -4,10 +4,10 @@ Neutral, agent-agnostic state fabric: delegation manifests binding four lineages
 (state, authority, behavior, trace), snapshot-backed undo for owned state, brokered
 capabilities for external effects, human-ratified compilation loops (skills up,
 caveats down). Read `docs/agent-state-fabric-brief.md` (why/what, v0.2) and
-`docs/asf-schema-spec.md` (the constitution, v0.9) before writing any code.
+`docs/asf-schema-spec.md` (the constitution, v0.10) before writing any code.
 The spec wins over this file wherever they disagree. Spec ambiguities found
 while implementing go to `docs/spec-issues.md` (never silently interpret);
-SI-1…SI-21 are resolved (SI-20 → A20/M8 in v0.5; SI-21 → A21/M7 in v0.6); SI-22 is interpreted (gate replay clock, W-2); SI-24 is resolved (A22/§5.4 in v0.7 — capability early closure; implemented by W-8 under its gated matrix: A22 two-sided contract, targeted `a22_*` mutation lane, W-9 verdict-invariance reproduced bit-for-bit); SI-23 (actuation vs approval surfaces) is OPEN — no actuation-scoped tool may register before SI-23 resolves. SI-25 is resolved (A23/§6.2 in v0.8 — authenticated global order: signed per-home global_seq layer 1 normative now, external anchor layer 2 graduation-gated; W-15 implements; ratified via W-20 determinations D1–D7/S1–S5 in ADR 0006). SI-26…SI-30 remain OPEN from the 2026-07-12 cryptographic mechanism audit (signed type/domain, key lifecycle, AEAD envelope, post-shred generations, redaction commitments). SI-31/SI-33/SI-34 are resolved (A24–A26 in v0.9 — owned-state transition protocol §5.3, consumed authority §5.5, approval candidate binding §6; W-20 retro-ratification of the merged W-14 protocols via PR #48, determinations D31/D33/D34 plus seven rounds of review adjustments R1–R25 (round 7 scoped) and an internal pre-round-6 review in ADR 0007 — round 2 added the recovery capture record and positional freshness, round 3 hardened them, round 4 extended temporal binding to both consumption consumers, rounds 4–6 surfaced as-built defects and completed canonical-entry identity and the recovery path-state domain; spec-code deltas tracked as RF-35–RF-37/RF-39 (adjusted beyond as-built) and RF-40 (as-built fs-pipeline defects), carried by W-15/W-22; G13 files the outstanding negatives; unenforced clauses bind at their carrier gates per the ledger). SI-32 (store publication/filesystem attacker model) is OPEN from the same 2026-07-13 PR #43 review-cycle analysis and is next in W-20's batch. SI-35 (workboard domain labels vs domain-taxonomy governance, recovered from codex/workboard-dogfood at the W-21 revival decision), SI-37 (TracePosition agreement predicate; W-15 enforces fail-closed from day one), and SI-38 (TracePosition genesis representation; W-15 implements a bootstrap-event floor provisionally) are OPEN; SI-36 (mid-run "actually do Y" amendments, §3.1/M1/M5) merged via PR #46. SI-39 (recovery-window divergence: automated multi-window preservation; filed by PR #48's round-3 review, the narrow-and-file remedy ratified as R14) is OPEN. New issues start at SI-40.
+SI-1…SI-21 are resolved (SI-20 → A20/M8 in v0.5; SI-21 → A21/M7 in v0.6); SI-22 is interpreted (gate replay clock, W-2); SI-24 is resolved (A22/§5.4 in v0.7 — capability early closure; implemented by W-8 under its gated matrix: A22 two-sided contract, targeted `a22_*` mutation lane, W-9 verdict-invariance reproduced bit-for-bit); SI-23 (actuation vs approval surfaces) is OPEN — no actuation-scoped tool may register before SI-23 resolves. SI-25 is resolved (A23/§6.2 in v0.8 — authenticated global order: signed per-home global_seq layer 1 normative now, external anchor layer 2 graduation-gated; W-15 implements; ratified via W-20 determinations D1–D7/S1–S5 in ADR 0006). SI-26…SI-30 remain OPEN from the 2026-07-12 cryptographic mechanism audit (signed type/domain, key lifecycle, AEAD envelope, post-shred generations, redaction commitments). SI-31/SI-33/SI-34 are resolved (A24–A26 in v0.9 — owned-state transition protocol §5.3, consumed authority §5.5, approval candidate binding §6; W-20 retro-ratification of the merged W-14 protocols via PR #48, determinations D31/D33/D34 plus seven rounds of review adjustments R1–R25 (round 7 scoped) and an internal pre-round-6 review in ADR 0007 — round 2 added the recovery capture record and positional freshness, round 3 hardened them, round 4 extended temporal binding to both consumption consumers, rounds 4–6 surfaced as-built defects and completed canonical-entry identity and the recovery path-state domain; spec-code deltas tracked as RF-35–RF-37/RF-39 (adjusted beyond as-built) and RF-40 (as-built fs-pipeline defects), carried by W-15/W-22; G13 files the outstanding negatives; unenforced clauses bind at their carrier gates per the ledger). SI-32 is resolved (A27/§5.3 in v0.10 — the three-tier storage adversary model: T1 offline tampering defeated by verify-on-read-back with the trust-root/unsigned-index/rollback carve-outs, T2 same-uid writer answered by topology never pathname checks — every T2 claim carries "holds under COOP; requires W-4 containment at G-ADVERSARIAL" — T3 human edit answered by attribution; staged-bytes normative; ratified 2026-07-15 via W-20 determinations D32-1…D32-10 in ADR 0008; RF-41 (unsigned meta rows → W-15a/b, the W-15 split in PR #52), RF-42/RF-43 (symlink/exclusion gaps → the RF-40 mechanical bugfix lane) file the gaps; SI-40 files the active-publication-window edit, its topology arm foreclosed by D32-4). SI-35 (workboard domain labels vs domain-taxonomy governance, recovered from codex/workboard-dogfood at the W-21 revival decision), SI-37 (TracePosition agreement predicate; W-15 enforces fail-closed from day one), and SI-38 (TracePosition genesis representation; W-15 implements a bootstrap-event floor provisionally) are OPEN; SI-36 (mid-run "actually do Y" amendments, §3.1/M1/M5) merged via PR #46. SI-39 (recovery-window divergence: automated multi-window preservation; filed by PR #48's round-3 review, the narrow-and-file remedy ratified as R14) and SI-40 (a human edit inside a live promotion/revert apply window is overwritten uncaptured; filed by the SI-32 ratification, P29-bounded, preservation-protocol candidate) are OPEN. New issues start at SI-41.
 
 ## Built — Stages 1–3 (kernel, spine, promotion gate). Current queue: docs/roadmap.md