File docs/landscape.md (neighbor survey, 2026-07) + two grade-B field-incident rows - #57
Merged
Merged
Conversation
… rows Filing 1: docs/landscape.md — July 2026 survey of three neighbors, verified at source (both repos pinned to 2026-07-15 SHAs; Runta docs read 2026-07-16; The Information layer graded as-reported). Thesis: brokered authority boundaries, credential isolation, and hash-chained audit are becoming genre table stakes (three independent builders, weeks apart), while the delegation half — in-place owned-state undo with human-edit preservation, four-lineage manifests, zero-authorship ratification — stays unoccupied; every neighbor demands MORE upfront authoring and sells prevention, not recovery. Two source corrections recorded inline: custodian-kernel ships secret_leak_guard + spend_sentinel (not "LeakSentinel"); cyberware's DEK is subject-scoped, not per-record. Cross-refs the frontier log (PR #55); follow-ups ride in sibling filings (custodian egress-tripwire roadmap candidate; cyberware SI-26..30/F2 evidence survey), noted so docs don't duplicate. Filing 2: docs/field-incidents.md gains an explicit provenance-grade tier (A = primary artifact verified; B = second-hand press, positioning/landscape use only, never founding-example work) rather than stretching the entry rule, plus two grade-B rows from The Information's Runta coverage: an authorized Claude Fable 5 agent deleting production files (owned-state recovery failure — §5.3/A24, undeclared-reversibility, broker_verified guards) and a quant firm's bug-fixing agent injected into executing malicious code (containment failure — W-4 pair, blessed-plan execution). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…claimed for undo Cross-session amendment from the originating survey session, applied before merge. The Fable-deletes-production-files row no longer claims the incident cleanly for snapshot-backed undo: the report doesn't say which side of the custody boundary the files sat on, and the lesson differs by case — owned roots -> undo (with SI-39/SI-40 preservation caveats); external infra via granted authority -> conservative defaults + daemon-owned approval surface + A26 candidate binding, with compensation fidelity grades (named open problem) past an approved-but-wrong action. Declaring a live prod tree an owned root is explicitly ruled out (COOP: revert restores staleness under independent concurrent writers). On-thesis line is the three-part stack, never undo alone. landscape.md's thesis paragraph, positioning observation, and synthesis item 4 softened the same way: isolation reaches no branch of either incident, and the differentiated claim is the delegation stack, not undo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two related filings, verified at source before writing. Second commit applies a cross-session amendment from the originating survey session (custody-boundary framing for incident (a), applied before merge).
Filing 1 —
docs/landscape.md. July 2026 survey of three neighbors: custodian-kernel (pinned293bb76, 2026-07-15 — same Hermes ecosystem; L0–L4 bands, hand-authored policy.yaml, Twilio Verify out-of-band approvals, caduceus secret broker, hash-chained HMAC audit, optional-expiry grants), cyberware (pinned88a94f0, 2026-07-15 — blessed hash-pinned plans, value-free govd wire, in-tree RFC 8785 JCS + Go verifier, subject-scoped-DEK crypto-shredding with the chain over ciphertext, boundary-halt vs critical-kill in-flight revocation, declared-vs-materialized closure re-hash), and Runta (docs read 2026-07-16; The Information layer as-reported — Secret Stubs at the egress gateway, DEFAULT-OPEN egress, fork-not-revert checkpoints, Token X-Ray). Thesis the pinned facts support: brokered authority boundaries + credential isolation (all three) and hash-chained audit (both OSS stacks) are genre table stakes; the delegation half (in-place owned-state undo with human-edit preservation, four-lineage manifests, zero-authorship ratification) is unoccupied — every neighbor demands more upfront authoring and sells prevention, while the incidents the best-funded neighbor markets with flow through legitimately granted authority, the class prevention doesn't answer. Two collection-note corrections recorded inline (secret_leak_guard/spend_sentinel, not "LeakSentinel"; subject-scoped, not per-record, DEK). F2 evidence surfaced, decision reserved to F2 per CLAUDE.md. Cross-refs the frontier log (PR #55); follow-ups ride in the two sibling filings from this survey (custodian egress-tripwire roadmap candidate; cyberware SI-26…30/F2 evidence survey), noted so docs don't duplicate.Filing 2 —
docs/field-incidents.md. Adds an explicit provenance-grade tier (A = primary artifact verified at filing time, the existing entry rule; B = second-hand press, positioning/landscape use only, never founding-example work) rather than silently stretching the entry rule, plus two grade-B rows from The Information's Runta coverage: (a) an authorized Claude Fable 5 agent deleting production files — recorded on the custody boundary, not claimed cleanly for undo: owned roots → snapshot-backed undo (SI-39/SI-40 preservation caveats); external infra via granted authority → conservative defaults + daemon-owned approval surface + A26 candidate binding, with compensation fidelity grades (named open problem) past an approved-but-wrong action; live prod tree as owned root explicitly ruled out (COOP — revert restores staleness under independent concurrent writers); (b) a Singapore quant firm's bug-fixing agent prompt-injected into executing malicious code (containment-of-granted-authority failure — W-4 pair, blessed-plan execution).Declared scope:
docs/landscape.md(new) anddocs/field-incidents.mdonly. Docs-only; no ledger, spec, or authority surface touched; Tier-1 hygiene green locally.🤖 Generated with Claude Code