Repository navigation
floor_for: withholding outlives mode enforcement; reason no longer promises re-serving (#1385) - #1387
Merged
Merged
Conversation
…omises re-serving (#1385) An all-modes floor entry overlapping a member's narrowed grant is withheld (dp 2026-10-23: the floor does not override a member's grant). Its reason said "served again when your gate enforces modes", a promise to drop the withholding once part B (#1345, #1383) is active. That would be the premature removal the security review of #1375/#1383 warned about: a mode-aware gate still unions society_floor with the member's grants, so a re-served entry widens the narrowed grant back to all modes. - reason: "withheld until your gate caps the floor by your own grants (hestia #1386)" - doc comment: the condition for ever re-serving is a gate that caps the floor path by path (#1386, nearest explicit grant decides), under its own review - test an_all_modes_parent_floor_stays_withheld_over_an_r_only_child_grant (Nova re-review of #1383): parent all-modes floor, own r-only child grant: not in reach, not in read, named as withheld, reason names #1386 and not mode enforcement. The gate-side half is in part B v2's held test. cargo test --lib floor: 19 passed, 0 failed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH
This was referenced Oct 25, 2026
dp-web4
added a commit
that referenced
this pull request
Oct 26, 2026
…arrower child nomad's HOLD (Nova corroborated): v1 judged only the path an act names, so with rwed on proj/** and a narrowed proj/sub/**, Grep proj read a write-only child and find proj -exec sed -i rewrote a read-only one. v2: an admitted act that can reach below the named path must satisfy every narrowed node beneath it (_narrowed_beneath), refused naming the child; SINGLE_TARGET_TOOLS are exempt. The shell stage checks each reached path's narrowed descendants. Tests: nomad's full table (w-only and r-only child; Grep, grep -r, find -exec sed -i, git_clean on the parent; direct read/write/cat controls) and a re-served-floor case (#1387 dependency): 11/11 on v2; both new tests fail on v1. Suites on the v2 copies match main; battery 1434/0; decide contract 25 (+29x4). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1385.
What.
StandingScopeStore::floor_forwithholds an all-modes floor entry wherever it overlaps one of a member's narrowed grants. Its reason text promised the entry would be "served again when your gate enforces modes". This change:Why. A gate that enforces modes still unions
society_floorwith the member's grants. If the parent entry were served again, a narrowed child grant would widen back to rwed, which overrides the member's grant. The security review of #1375 and #1383 named this as the premature removal to guard against. The only condition for serving it again is a gate that caps the floor by the member's own grants, path by path (#1386, dp 2026-10-24: the nearest explicit grant decides). That change needs its own review.Test.
an_all_modes_parent_floor_stays_withheld_over_an_r_only_child_grant. With an all-modes floor on/w/sharedand the member's ownron/w/shared/forum:reachand not inread;withheld;floor_fortakes no gate-version input, so nothing can re-serve on "modes enforced" alone. The gate-side half (served as the daemon serves it, child write refused; served again, the union admits it) is in part B v2's held test.cargo test --lib floor: 19 passed, 0 failed.Accountability self-audit: this only changes the text of a refusal reason and a doc comment, and adds a test. No surface or consequential act changes; serving behaviour is identical.
🤖 Generated with Claude Code
https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH