Skip to content

floor_for: withholding outlives mode enforcement; reason no longer promises re-serving (#1385) - #1387

Merged
dp-web4 merged 1 commit into
mainfrom
cbp/1385-floor-withheld-wording
Oct 25, 2026
Merged

dp-web4 merged 1 commit into
mainfrom
cbp/1385-floor-withheld-wording

Conversation

@dp-web4

@dp-web4 dp-web4 commented Oct 24, 2026

Copy link
Copy Markdown
Owner

Fixes #1385.

What. StandingScopeStore::floor_for withholds an all-modes floor entry wherever it overlaps one of a member's narrowed grants. Its reason text promised the entry would be "served again when your gate enforces modes". This change:

Why. A gate that enforces modes still unions society_floor with the member's grants. If the parent entry were served again, a narrowed child grant would widen back to rwed, which overrides the member's grant. The security review of #1375 and #1383 named this as the premature removal to guard against. The only condition for serving it again is a gate that caps the floor by the member's own grants, path by path (#1386, dp 2026-10-24: the nearest explicit grant decides). That change needs its own review.

Test. an_all_modes_parent_floor_stays_withheld_over_an_r_only_child_grant. With an all-modes floor on /w/shared and the member's own r on /w/shared/forum:

floor_for takes no gate-version input, so nothing can re-serve on "modes enforced" alone. The gate-side half (served as the daemon serves it, child write refused; served again, the union admits it) is in part B v2's held test.

cargo test --lib floor: 19 passed, 0 failed.

Accountability self-audit: this only changes the text of a refusal reason and a doc comment, and adds a test. No surface or consequential act changes; serving behaviour is identical.

surface: society floor view per member (hestia_scope_status)   act: none changed (reason text only)
S: low/reversible [construct: StandingScopeStore::floor_for why string]
R: n/a   W: n/a   O: n/a   A: n/a   V: n/a
verdict: PASS

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH

…omises re-serving (#1385)

An all-modes floor entry overlapping a member's narrowed grant is withheld (dp 2026-10-23: the
floor does not override a member's grant). Its reason said "served again when your gate enforces
modes", a promise to drop the withholding once part B (#1345, #1383) is active. That would be the
premature removal the security review of #1375/#1383 warned about: a mode-aware gate still unions
society_floor with the member's grants, so a re-served entry widens the narrowed grant back to
all modes.

- reason: "withheld until your gate caps the floor by your own grants (hestia #1386)"
- doc comment: the condition for ever re-serving is a gate that caps the floor path by path
  (#1386, nearest explicit grant decides), under its own review
- test an_all_modes_parent_floor_stays_withheld_over_an_r_only_child_grant (Nova re-review of
  #1383): parent all-modes floor, own r-only child grant: not in reach, not in read, named as
  withheld, reason names #1386 and not mode enforcement. The gate-side half is in part B v2's
  held test.

cargo test --lib floor: 19 passed, 0 failed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH
@dp-web4
dp-web4 merged commit b61da97 into main Oct 25, 2026
10 checks passed
dp-web4 added a commit that referenced this pull request Oct 26, 2026
…arrower child

nomad's HOLD (Nova corroborated): v1 judged only the path an act names, so with rwed on proj/** and
a narrowed proj/sub/**, Grep proj read a write-only child and find proj -exec sed -i rewrote a
read-only one. v2: an admitted act that can reach below the named path must satisfy every narrowed
node beneath it (_narrowed_beneath), refused naming the child; SINGLE_TARGET_TOOLS are exempt. The
shell stage checks each reached path's narrowed descendants.

Tests: nomad's full table (w-only and r-only child; Grep, grep -r, find -exec sed -i, git_clean on
the parent; direct read/write/cat controls) and a re-served-floor case (#1387 dependency): 11/11 on
v2; both new tests fail on v1. Suites on the v2 copies match main; battery 1434/0; decide contract
25 (+29x4).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

floor_for's withheld reason promises re-serving at mode enforcement; precedence must outlive it

1 participant