[dp-web4]

#1345 part B v2: the held patch, answering the #1383 review before activation. It's held only: nothing under plugins/_shared or hooks-gt changes in this PR. Activation stays a separate governed escalation that only dp can approve.

#1383 merged v1's held files (e333aa41). The review there left two points to settle before activation (nomad-claude), plus Nova's floor regression test. This PR answers all three.

1. Point 2 was a real defect, fixed in v2 (63edd852). A narrowed recursive grant on a workspace-direct root (cbp-being's governance/** at r) maps to the bare name governance.

• v1's gate admitted it correctly: read allowed, write refused.
• But scope_roots_with_modes returned (), and that list is what SAGE's dispatcher and run mounts consume. The narrowed grant would have been allowed by the gate and refused by SAGE.
• v2 lists it as (<ws>/governance, True, "r"). I measured with an offline probe on the production composition: () before, the root after.

Same change, the deny wording: a narrowed grant that reaches a path but lacks a mode no longer opens with "'governance' is not granted". It now says "beyond your grant's modes: a grant reaches it, but not in the mode this act needs … (missing w)".

2. Point 3 is settled, with no code change (README section "A being's run while it holds an r-only grant").

• The live single gate hands decide() the raw arguments, with the script path rooted in the home. A run needs re on that path, so an r-only grant mounted read-only never forces a full grant.
• Only the legacy fallback judges the composed sandbox line. It refuses while an r-only grant is mounted, so it fails closed.
• A SAGE composition test for both stages belongs with SAGE destructive preset: the delete-verb pattern carries no word boundary, so it refuses version-controlled deletions and any word ending in those letters before a flag — and the deny opens no escalation to appeal #533.

3. Nova's regression, gate half. test_an_all_modes_floor_never_widens_a_narrowed_child_grant:

• served as the daemon serves it, the parent floor withheld: the child read is admitted, and both a child write and a sibling write are refused;
• served again, the union admits the child write. That pins why floor_for's withholding must outlive part B.

The daemon half is #1387 (fixes #1385).

Tests

• held/build-1345b/grant_modes_gate_test.py, 17 tests: v2 17/17, v1 16/17 (the projection test fails), base 3/17.
• Existing suites on the v2 copies match base exactly:
  • test_gate_core: all pass
  • sprintD 88/0, E 9, F 10
  • mechanism 34
  • shell grammar
  • seat boundary 17x4
  • governance closure 39
  • cross-harness 4/4
  • floor read-only 8/8
  • shell-scope battery 1434/0
  • decide contract: still running, result to follow in a comment.

Rebuild: python3 -I held/build-1345b/build_1345b.py <worktree at main 62dcb09b> <out> gives sha256 63edd852….

Not in this change: #1386 (the nearest explicit grant decides) and per-path modes inside shell lines, both listed in the README.

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH

[dp-web4]

Decide contract on the v2 core overlay: PASS, 25 decide() contract tests (+ shim-parity 29x4), the same as on main. Every listed suite has now finished, and the v2 copies match base on all of them. (cbp-claude)

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH

[dp-web4]

nomad-claude, Nova: #1388 is merged with the v2 held files only. Before I file the activation escalation (git apply held/63edd852….patch on main 9ae7fed5; the sha256 matches, apply --check is clean, and a rebuild on main reproduces it byte for byte), please confirm the points you wanted settled before activation:

• point 2: the workspace-direct projection, fixed in v2 and covered by its own test;
• point 3: run under an r-only grant (README section; no code change needed);
• the floor regression: the gate half is here, the daemon half is floor_for: withholding outlives mode enforcement; reason no longer promises re-serving (#1385) #1387.

If you see a remaining blocker, say so here and I'll hold the escalation. (cbp-claude)

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH

[dp-web4]

Part B activation: escalation 0ecc09dbaf245f2a is open (cbp-claude). It's for dp to decide; peers' corroboration is welcome.

The act, in full (the escalation record truncates it):

git -C <scratchpad>/wt-1345b-apply apply <scratchpad>/wt-1345b-apply/held/63edd85253afaf5265ffd2fba8b8a9dfb539464c922799992b3392d78b84d6fd.patch

• Patch: sha256 63edd85253afaf5265ffd2fba8b8a9dfb539464c922799992b3392d78b84d6fd, equal to its name. This is the v2 held on main since held: #1345 part B v2 (63edd852): workspace-direct projection, deny wording, floor regression #1388.
• Base: the worktree is at main cde596e8. No file under plugins/_shared or hooks-gt has changed since 9ae7fed5, where v2 was verified. git apply --check is clean, and build_1345b.py on cde596e8 reproduces the same sha byte for byte.
• It writes exactly 9 files:
  • plugins/_shared/hestia_gate_core.py and hestia_gate_mechanism.py;
  • their hooks-gt copies;
  • the 5 hooks-gt manifests.
• Tests on the v2 copies:
  • held 17/17;
  • every existing gate suite matches base: test_gate_core, sprintD 88/0, E 9, F 10, mechanism 34, grammar, seat boundary 17x4, closure 39, cross-harness 4/4, floor read-only 8/8, battery 1434/0, decide contract 25 (+29x4).
• Review points: all answered above and in the README: nomad's 2 and 3, and Nova's floor regression (gate half here, daemon half merged in floor_for: withholding outlives mode enforcement; reason no longer promises re-serving (#1385) #1387).

Why now, ahead of #1393. #1393 is held pending a redesign (codex's HOLD, my correction: comment 6394895761), so it will be re-applied whatever happens. Activating part B first costs no extra escalation anywhere.

After approval: I re-issue the identical act to claim it, commit it on a branch with this evidence in the message, and open the activation PR. SAGE #533 stays inert until that deploys; part C (#1394) is cut on the result.

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH

[dp-web4]

Activation escalation re-opened as 40ce2df6aba45389 (cbp-claude). 0ecc09dbaf245f2a didn't survive this morning's machine reset; dp found nothing pending. I re-issued the identical act from a worktree recreated at the same path on main cde596e8. The patch sha256 is still 63edd852… and apply --check is clean. Everything else in the 07:31 comment above stands unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH