diff --git a/CLAUDE.md b/CLAUDE.md index 201d9e7..05670c5 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -121,7 +121,11 @@ and runs in `required`. Tier 2 (the two tables) ships in the PR body like the G9 sweep. Tier 3 is the internal adversarial pre-review for candidates, scoped to soundness/shape, never asked to also be the exhaustive checker. A review round that finds completeness or code-fact -debris means a Tier-1/2 pass was skipped or run as prose. +debris means a Tier-1/2 pass was skipped or run as prose. External +rounds stop by rule, not by momentum: one round after the battery; +delta-scoped continuation only while blocking findings persist; buying +past that is a recorded operator gate decision (`docs/review-battery.md` +stopping rule, adopted 2026-07-15). ## Session-end git contract diff --git a/docs/dogfooding-rubric.md b/docs/dogfooding-rubric.md index 792de35..fbc5221 100644 --- a/docs/dogfooding-rubric.md +++ b/docs/dogfooding-rubric.md @@ -13,6 +13,41 @@ A denial during a DF-P test **is** a false positive: log it in the denial-FP tally with the ledger event id. Log results in the vault's `coppice-dogfooding-log.md` by id (e.g. "DF-N4 pass, approval latency 40s"). +## Session plan — remaining W-1 residue (2026-07-15) + +State of the board: DF-P1/P2/P3/P5 exercised 2026-07-09 (findings inline +below); DF-P8 partially (RF-9's discovery covered the crash path, but the +formal kill-9 → recover check never ran); DF-P4/P6/P7 and all nine +negatives unexercised. Three staged sessions retire the residue. Each +anchors to real vault-maintenance work so the denial-FP metric accrues +from genuine sessions, with the staged cases layered on. Dogfood +workspace only (two-surface rule); log by id as above. + +1. **Session A — approval surface.** A real bulk task touching 20+ files + (wikilink repair, frontmatter normalization) blows the 20-writes/run + budget → DF-P4 (park, `asf approve … --uses N`, retry, measure + latency). While the escalation is pending, say "approved, go ahead" + in chat → DF-N4 (run it more than once, phrased differently). Deny a + second escalation → DF-N5. Ask for a delete → DF-N1; a nonexistent + tool → DF-N2. Also the W-1 brokered-mode ledger check + (`authority: {"mode":"brokered"}` + the grant). +2. **Session B — the undo promise.** Real filing session, promote, then + `asf revert` to the prior manifest → DF-P7 (all roots together; + ledger ends "every live root is explained"). Then `kill -9` the proxy + mid-session; next session recovers → DF-P8, formally this time. Path + escape `../escape.md` → DF-N3. +3. **Session C — shared state.** Hand-edit a note the agent is actively + editing → DF-N6 (conflict parks; judge the card's legibility). + Hand-edit one it isn't touching → DF-N7 (drift `human_local`, ordered + before the promotion). Leave the session idle past 2h → DF-N8 (judge + whether the expiry denial reads as a bug). Give it a delete-requiring + task and watch post-denial behavior → DF-N9. + +DF-P6 (false-drift watch) satisfies itself across the three sessions — +check the ledger for drift you didn't cause at week's end. After this, +W-1 becomes a cadence (positives during normal work; a negative +re-staged only when its touched code changes), not an open-ended item. + ## Positive — should succeed, cleanly and legibly **DF-P1 — plain filing session.** Reads, writes, a move; quit the client. diff --git a/docs/posture-assumptions.md b/docs/posture-assumptions.md index 4549ccd..87bd6a5 100644 --- a/docs/posture-assumptions.md +++ b/docs/posture-assumptions.md @@ -148,13 +148,24 @@ default cannot save this class retroactively. - **P15 / RF-16** Standing authority may not derive from a substrate whose authority view can be changed through unsigned index columns or whose global order/completeness is unauthenticated. W-11 closes verified-row use; - **W-15 layer 1** (the A23 signed global chain / `VerifiedPrefix`) must land - before W-3 proceeds beyond disposable experiments. Freshness (rollback + **W-15a** (layer-1 emission on a fresh-start home plus the clerk-side + `VerifiedPrefix` — the 2026-07-15 re-cut of W-15; roadmap) must land + before W-3 proceeds beyond disposable experiments. The + decision/gate/recovery consumption swap is **W-15b** and does not gate + W-3 — P28 records that staged consumption. Freshness (rollback detection, layer 2) is **scoped per A23/D2**: single-machine compilation under the `local-integrity` label is valid within this posture and re-earned at graduation; the anchored head becomes mandatory for counting at G-ROAMING-SURFACE (multi-location) and for production claims at G-PRODUCTION — it does not gate single-machine W-3. +- **P28** *(staged consumption, filed 2026-07-15)* After W-15a the clerk + and TrustRecord counting read the `VerifiedPrefix` while decision, + gate, and recovery still consume the W-11 verified-row view + (signature/selector/within-span-chain verified; cross-span order + unauthenticated on those paths). No authority *source* changes — both + views read the same signed append path, and the clerk is born on the + stronger view; the seam is which verification tier each consumer + applies. → W-15b consumption swap; RF-13/P15 remainder. - **P26** Corpus-ingest homes (`asf corpus ingest`) sign placeholder principals and a placeholder behavior bundle into a REAL substrate — P8's class, second site. Nothing mechanical distinguishes a corpus @@ -276,7 +287,7 @@ in scope, or when storage leaves that filesystem boundary. ## The shortcut ledger (backing index) -All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/ +All 28 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/ 1SESS/1HUMAN/1TEN/DEBUG` = the invariant(s) that make each safe now. ### Tier 1 — items this sweep filed or newly gated @@ -292,6 +303,7 @@ All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/ | P25 | ~~F1 calls capabilities revocable with expiry-only enforcement~~ **CLOSED by W-8 (PR #33)**: signed `revoke` (§5.4), `a22_*` event-derived liveness at decision + gate, `asf revoke` kill switch | `broker.rs` (`a22_*`, `revoke_capability`), `proxy.rs` revoke surface | — (implemented) | SI-24 → A22 (v0.7) → W-8; residuals: P22 (in-flight dispatch), P15/RF-13 (rollback erasure), P21 (partitions) | | P26 | Corpus-ingest homes: placeholder identities/behavior signed into a real substrate; evidence-quarantined by convention only (second P8 site) | `asf-cli corpus/ingest.rs` (`placeholder_key`, behavior literal) | COOP SU | W-3 mechanical exclusion (G-RATCHET); `agent-trace-corpora-2026-07-11.md` boundaries | | P27 | Injected credentials enter a downstream adapter whose response reaches the agent unchanged | `broker.rs:560-576`, `proxy.rs:501-571` | COOP LOCAL, first-party/no credential | RF-23; G-EGRESS/G-3P-TOOL; W-18 | +| P28 | Staged A23 consumption: clerk/TrustRecord counting on the `VerifiedPrefix`; decision/gate/recovery still on the W-11 verified-row view (cross-span order unauthenticated on those paths) | `broker.rs`, `kernel.rs` (post-W-15a) | SU 1SESS COOP (broker locally the sole approval producer) | W-15b consumption swap; RF-13/P15 remainder | ### Tier 2 — items already tracked (this ledger just indexes and gates them) @@ -344,3 +356,8 @@ All 27 currently tracked, grouped by filing status. `SU/COOP/LOCAL/NOACT/ switch, closed-parent/closed-id refusals). First closed row in this ledger; the row is kept struck-through as the record. Residual exposure moved to where it already lived: P22, P15/RF-13, P21. +- **Follow-up (heading check, 2026-07-15):** re-scoped G-RATCHET's + satisfaction condition to W-15a (the W-15a/W-15b re-cut; roadmap) and + filed P28 for the staged `VerifiedPrefix` consumption between W-15a + and W-15b — the ledger's same-change rule, applied at decision time + rather than late. diff --git a/docs/review-battery.md b/docs/review-battery.md index 25b76ee..8639e90 100644 --- a/docs/review-battery.md +++ b/docs/review-battery.md @@ -96,6 +96,31 @@ unaddressed item is visible instead of silently absent. the external round. The battery's job is to make this round return only genuine soundness seams, not completeness or code-fact debris. +## Stopping rule — external rounds end by rule, not by momentum + +The default for a ratification or authority-surface artifact is the battery +(Tiers 1–3) and **one** external round. A further round is bought only while +the latest round returned a blocking finding — a high-severity defect or a +finding against the determination skeleton — and each further round is +**scoped to the previous round's delta**, not the whole artifact (the PR #48 +round-7 pattern). The first round that returns no blocking finding closes the +cycle; remaining mediums are folded by the author under the battery, without +a confirming round. Two corollaries: + +- **New protocol questions never extend a cycle.** A finding whose remedy is + protocol-class files an SI and queues at its own trigger (the R14/SI-39 + narrow-and-file precedent); the artifact under review narrows, and the + cycle converges instead of tracking an open-ended frontier. +- **Buying past the rule is an operator gate decision**, recorded as one + (with what the extra round is expected to find) — the same discipline as + un-parking. It is never the silent default. + +Founding case: PR #48 ran seven external rounds with no written stopping +condition — each next round was the default rather than a decision (adopted +2026-07-15, the heading check). The battery is where exhaustiveness lives +(the internal pre-review caught 13 findings at a fraction of a round's +cost); external rounds are for soundness seams. + ## Running order 1. Extract the filing's deliverables into the completeness table (drives diff --git a/docs/roadmap.md b/docs/roadmap.md index 356e178..116b541 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -29,6 +29,13 @@ post-A21 session doubles as live verification of the brokered mode declaration (ledger shows `authority: {"mode":"brokered"}` + the grant). Approvals accumulate as founding examples for W-3 regardless of when the clerk lands. *Provenance: standing plan; re-confirmed 2026-07-10.* +**Resumed 2026-07-15** (heading check; the log had one real session, +2026-07-09): the remaining rubric residue packs into three staged +sessions — see "Session plan" in `dogfooding-rubric.md`; log by DF id +as before. Approvals recorded before the W-15a fresh-home restart are +disposable examples (G-RATCHET permits collecting them; §6.2 +migration-is-invalidation is why they cannot found standing rules) — +the denial-FP metric is unaffected by the restart. ## Queued (ordered) @@ -131,6 +138,19 @@ external round caught 13 findings (two high) at a fraction of a round's cost — carry it forward for items (3)–(6) and consider it in the W-20 close-out as standing practice for authority-surface PRs. Next: item (3), SI-32. +**Close-out decision (operator, 2026-07-15 heading check): the batch +closes when item (3) ratifies.** Items (4)–(6) leave the batch and +defer to their named triggers — SI-26/SI-28/SI-29 to W-16 and the W-6 +publication gate (SI-26 already gates W-6), SI-27 to W-17 (no real +credential ships before it regardless), and the item-(6) §0 +posture-qualifier convention rides with whichever of those fires +first. None of the three gates W-1, W-3, or W-5. The closing +composition review runs when the deferred items ratify, over the full +seam set; the (1)–(3) seams have meanwhile been exercised by PR #48's +seven-round cycle and the SI-32 candidate's battery (PR #50). Rationale: review yield had +fallen below dogfooding yield, and the deferred items harden against +adversaries the posture ledger parks (P1/P17 bound what further +integrity refinement buys at this posture). **W-21 — workboard dogfood profile (revival).** Owner: agent; operator ratifies the registration shape. Recovered from `codex/workboard-dogfood` @@ -154,11 +174,48 @@ SI-25 is ratified as A23 (spec v0.8 §6.2; determinations D1–D7/S1–S5/R1–R in ADR 0006's addendum — note the security-critical ones W-15 must honor: R6 two-terminals/local-closure, R7/R9 cross-epoch order + migration activation barrier, R8 journal-before-stores, R9's activation-prefix-aware object -resolution). W-15 implements **layer 1 only**: signed -`home`/`epoch`/`global_seq`/`global_prev` on every event; local signed -`TraceCheckpoint`s (every profile); the `VerifiedPrefix` consumed by -decision, gate, and recovery — upgrading W-14's journal recovery to -prefix-bounded and to the A24 adjusted clauses (RF-35 as adjusted through review round 7: the positional D31-4 +resolution). W-15 implements **layer 1 only**. **Re-cut 2026-07-15 +(operator decision, the heading-check G-RATCHET re-examination): W-15 +splits into W-15a (ratchet substrate — gates W-3) and W-15b (consumer +migration + recovery hardening — sequenced with W-22).** Rationale: +G-RATCHET's bite is economic, not cryptographic, at this posture — +§6.2's migration-is-invalidation means rules and founding examples +minted on a pre-layer-1 substrate are scheduled to die, so the ratchet +needs layer-1-native events and its own counting verified; it does not +need the decision/gate/recovery consumption swap, whose paths keep the +W-11 verified-row view until W-15b (P28). D2 already ratifies +single-machine counting under the `local-integrity` label. **Layer 2 +(`AnchorStore`) remains out of scope for both halves** — it lands at +G-ROAMING-SURFACE (coordination), G-EGRESS (dispatch gating), and +G-PRODUCTION (freshness authority), where the freshness half of +RF-13/P15 closes. + +**W-15a — layer-1 substrate + clerk consumption (queued next; gates +W-3).** Fresh homes only, single epoch (`reason: "initialize"`), no +migration machinery: the existing dogfood home restarts fresh — §6.2's +own advice ("migrate early, before a large corpus accrues") taken at +its cheapest moment; total prior history is one session, and the cost +is DF-P3's founding example #1, re-earnable in a session. Scope: +signed `home`/`epoch`/`global_seq`/`global_prev` on every event; the +SI-38 bootstrap-event genesis floor and the SI-37 position-agreement +predicate at their provisional shapes (fail-closed from day one; +`TracePosition` emission in signed cross-references per §6.2); the +terminal `TraceCheckpoint` as a row in the same commit (S3); +durable-commit at `synchronous=NORMAL` (permitted unanchored per R5); +a full-scan `VerifiedPrefix` constructor — no checkpoint-keyed caching +(the clerk runs offline at ceremony time; dogfood volume is hundreds +of events) — consumed by exactly one reader: W-3's clerk and +TrustRecord counting (D2). Single-epoch operation makes R7/R9's +activation prefix the whole chain (as A15 today). Closes RF-13/P15's +**order/completeness half** for the counting path; satisfies G-RATCHET +as re-scoped (posture ledger, P15 bullet). + +**W-15b — consumer migration + recovery hardening (sequenced with +W-22, which rewrites the same gate-replay region).** The +`VerifiedPrefix` consumption swap for decision, gate, and recovery — +replacing the per-decision full `verified_events` scan with +checkpoint-keyed incremental caching — upgrading W-14's journal +recovery to prefix-bounded and to the A24 adjusted clauses (RF-35 as adjusted through review round 7: the positional D31-4 freshness predicate over total V — including unbranched `tool_call.state_root_after` — the D31-6 recovery capture record (exact-set validation; the R24 kind-complete scan on every active @@ -172,22 +229,22 @@ G13(e–g)/(k)/(m) negatives; plus RF-40's as-built fs-pipeline entry-identity fixes — planner mode-only ops with the A17 composition rule (rename+chmod, G13(n)), mode-only writes, file↔directory pass ordering over the widened empty-directory quantifier (G13(o)) — with -the G13(i–l) negatives), and replacing the per-decision full -`verified_events` scan with checkpoint-keyed incremental caching; the writer-fence-as-lease -abstraction (D5); the migration epoch (invalidation + the R3 -pre-epoch-grant refusal + `legacy_commitment`); the SI-37 position-agreement -predicate (fail-closed from day one); and the durable-commit synchronous -plumbing. Closes RF-13/P15's **order/completeness half**; unblocks W-3 -beyond disposable examples (G-RATCHET). **Layer 2 (`AnchorStore`) is out of -scope** — it lands at G-ROAMING-SURFACE (coordination), G-EGRESS (dispatch -gating), and G-PRODUCTION (freshness authority), where the freshness half -of RF-13/P15 closes. Implementation seams: the four recovery-note items at -the top of ADR 0006 (W-14 journal composition, W-13 initialize boundary, -W-19 diagnostic surface, W-9 baseline re-pin); the unpushed sketch on -`agent/si25-authenticated-head-design` predates W-12…W-14 and needs rebase. -W-3 may collect disposable examples but may not compile standing authority -until W-15 lands. *Provenance: RF-13 + 2026-07-12 cryptographic mechanism -audit; scope re-cut 2026-07-13 by the A23 ratification.* +the G13(i–l) negatives; RF-40 is mechanism-class under +already-ratified semantics and may be pulled forward as an independent +bugfix PR by operator decision); the writer-fence-as-lease abstraction +(D5); and the migration epoch (invalidation + the R3 pre-epoch-grant +refusal + `legacy_commitment`) — implemented only if a pre-A23 home +with history worth carrying still exists then; otherwise it stays +spec'd, unimplemented, and posture-noted. Implementation seams: the +four recovery-note items at the top of ADR 0006 (W-14 journal +composition, W-13 initialize boundary, W-19 diagnostic surface, W-9 +baseline re-pin); the unpushed sketch on +`agent/si25-authenticated-head-design` predates W-12…W-14 and needs +rebase. W-3 may collect disposable examples but may not compile +standing authority until **W-15a** lands. *Provenance: RF-13 + +2026-07-12 cryptographic mechanism audit; scope re-cut 2026-07-13 by +the A23 ratification; W-15a/W-15b split 2026-07-15 by the +heading-check G-RATCHET re-examination (operator decision).* **W-22 — A25/A26 broker conformance mechanisms.** Close the three authority-surface gaps the A24–A26 ratification reviews (rounds 1–2) @@ -211,11 +268,11 @@ signed escalation version presented (`escalation_event` in the approval body) and C2 listings render from or verify against signed events (the RF-31 class on the exemption surface; supplies the version-swap and tampered-listing negatives). All under the two-sided contract and -targeted-mutation discipline. Sequenced after W-15 because RF-36 -rewrites the same gate-replay region W-15 converts to -checkpoint-keyed `VerifiedPrefix` consumption — landing RF-36 first -would be churned; may be pulled earlier by operator decision if W-15 -slips (RF-36 is posture-bounded: the broker is locally the sole +targeted-mutation discipline. Sequenced after W-15a and with W-15b +(the split of 2026-07-15) because RF-36 rewrites the same gate-replay +region W-15b converts to checkpoint-keyed `VerifiedPrefix` consumption +— landing RF-36 first would be churned; may be pulled earlier by +operator decision if W-15b slips (RF-36 is posture-bounded: the broker is locally the sole approval producer; the exposure is the W-9 foreign-trace surface). *Provenance: PR #48 independent review — round-1 findings 1–2 (ADR 0007 R1/R2), round-2 finding 3 (R10/RF-39), round-3 finding 3 pinning @@ -250,7 +307,13 @@ Deterministic, no model. `asf rules candidates`: cluster approval events by (caveat, action-class, domain); at k ≥ 3 propose the least-general covering rule with ledger-derived counterfactuals for ratification (§7.1 schema). TrustRecords as counters over existing events per (principal, -domain, behavior version) (§7.2). Sequenced after W-1 produces real +domain, behavior version) (§7.2). Counting reads only the W-15a +`VerifiedPrefix` (§6.2 D2 — valid single-machine under the +`local-integrity` label); gate: **W-15a**, not full W-15 (2026-07-15 +G-RATCHET re-examination; P15/P28). Deliverable alongside the clerk: +P26's mechanical corpus-home exclusion (the clerk refuses substrates +whose principals carry placeholder keys, or a corpus-home marker). +Sequenced after W-1 produces real approvals to cluster — but not far after; this is where authority stops evaporating at session end. *Provenance: 2026-07-10 review (highest- confidence convergent recommendation: ratchet before judge).*