Close the six confirmed holes from the adversarial intake verification - #21
Merged
Conversation
The design reviewer attacked the merged implementation with live fixtures and confirmed six defects; each fix carries a regression test: 1. Read intake documents BEFORE any repository probe executes — a changed test demonstrably wrote the configured document during its own probe run and minted T4 for itself. 2. Canonical containment for the out-of-tree boundary: every path component of the document and the repo root is symlink-resolved before the prefix check (a symlinked parent smuggled an in-tree file past the lexical version), the final component opens with O_NOFOLLOW, regularity is judged on the opened fd, and size bounds ride a limited reader on that single open. 3. Supplier-scoped duplicate keys: one supplier's pass no longer suppresses another's counterexample on the same raw probe id (refutation dominance was demonstrably violated). A contradictory duplicate within one supplier fails the run loudly. 4. Required means USABLE: an admitted document with zero accepted rows blocks the gate. 5. Strict decoding rejects duplicate JSON keys at any depth — the stdlib's last-wins parsing smuggled a verified outcome behind a counterexample, and duplicate keys would make future signatures ambiguous. 6. Every stored external field is scrubbed (now including DEL and C1) and bounded — a live ESC reached the text receipt through a rejected row. Also from the same review: binding markers accumulate so in-tree coverage cannot hide an acting external row; a discarded external pass on an LLM claim is now explained on the remainder row; intake records carry the supplier version and the config digest. Two recommendations are consciously declined and documented (open mechanism tokens; invoker-supplied paths in stderr diagnostics). Schema 0.0.13. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015GeUG1gboWiZSnFyzQghyp
correctful receipt12 claims — ✅ 12 verified · ❌ 0 refuted · Change:
|
| Tier | Claim | Statement |
|---|---|---|
| T1-assertion | TestContradictoryVerdictsFailLoudly |
Contradictory Verdicts Fail Loudly |
| T1-assertion | TestCrossSupplierCounterexampleSurvives |
Cross Supplier Counterexample Survives |
| T1-assertion | TestDuplicateJSONKeysRejected |
Duplicate JSONKeys Rejected |
| T1-assertion | TestParentSymlinkCannotSmuggleInTreeFiles |
Parent Symlink Cannot Smuggle In Tree Files |
| T1-assertion | TestRequiredNeedsUsableEvidence |
Required Needs Usable Evidence |
| T1-assertion | TestRejectedRowsAreScrubbed |
Rejected Rows Are Scrubbed |
| T1-assertion | TestConfigValidatesLoudly |
Config Validates Loudly |
| T1-assertion | TestInTreePathsRejected |
In Tree Paths Rejected |
| T1-assertion | TestAdmissionGates |
Admission Gates |
| T1-assertion | TestAuthorityComesFromTheProfile |
Authority Comes From The Profile |
| T1-assertion | TestOutcomeVocabulary |
Outcome Vocabulary |
| T1-assertion | TestRowRejections |
Row Rejections |
Harvest coverage: 7 files — 3 claimed · 4 scanned · 0 unread
3 spec-id mention(s) not minted as claims — the repo defines no spec-id corpus, so a reference has no possible referent
schema 0.0.13 · correctful v0.0.0-20260818014146-eb1786a2ee15 eb1786a · exit gate: refuted claims block; the remainder informs, never fails
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The design reviewer (resumed session) attacked the merged intake implementation with live fixtures and confirmed six defects: probe-order self-supply, parent-symlink boundary bypass, cross-supplier dedupe suppressing refutation, empty-required-document gate satisfaction, duplicate-JSON-key outcome smuggling, and unscrubbed rejection fields. All six are closed with regression tests pinning the exact attack. Plus: accumulating binding markers, an explanation note for discarded external passes on LLM claims, supplier version + config digest in the audit records. Two reviewer recommendations consciously declined and documented in DESIGN.md. Schema 0.0.13.
🤖 Generated with Claude Code
https://claude.ai/code/session_015GeUG1gboWiZSnFyzQghyp