doctor: the preflight says what each seat may do to your files, before the room opens

[sanlee-ys]

telltale doctor gains a POSTURE block under the seats.

posture — what each seat's read-only claim is worth in the room `telltale
council --read` opens, and what class of evidence stands behind it. Nothing
below was probed here: it is read off the same data the room's own column badges
are drawn from, so the two surfaces cannot disagree.
  claude      ro:tools     enforced by CONSTRUCTION — the write and shell tools
                           are absent from that session, read off what the
                           session reported about itself rather than off a flag.
                           The residual is that a deny list cannot cover a tool
                           a future release adds
  codex       ro:enforced  enforced by an OPERATING SYSTEM — the vendor's own
                           sandbox, and the one posture in this table that a
                           flag is not the last thing standing behind
  agy         unsandboxed  MEASURED not to restrict — a live run refuted the
                           flags rather than leaving them unestablished, so
                           treat this seat as able to change your files
  cursor      ro:requested ASKED FOR, and never observed — the flag was accepted
                           and what it enforces on this machine is not
                           established. Weaker than a construction or an OS
                           sandbox, and says so
  grok        unsandboxed  MEASURED not to restrict — a live run refuted the
                           flags rather than leaving them unestablished, so
                           treat this seat as able to change your files

The room `telltale council` opens by default WRITES, and 1 of the 5 seats above
can be asked to ask first: claude carries `gated` there and asks before every
tool call that changes anything, while the rest carry `WRITES`. What contains a
room that writes is the workspace you point it at, not any of these words —
point council at a throwaway worktree when that matters.

Why the preflight owes this

The room already says all of it — the column badges, and the help panel's
posture page under each one. Both are read inside the room, which is after
the decision they inform. A user picks a workspace and a posture before the
room opens, and the one surface that runs before the room opens said nothing
about either. §9.17's frame settles that the fact belongs here: what a vendor's
own flags buy on this machine is true at launch and stays true.

One source, two surfaces

Nothing in the block is written in internal/doctor. council.DoctorSeats
builds it from postureClaim — the same function the room's own columns are
built from — and hands over the badge off SandboxClaim.Badge() and an evidence
class off the claim's Level. A preflight with a per-vendor posture table of its
own would agree with the badges the day it was written and diverge the day a
level moved, and a reader looking at two disagreeing surfaces cannot tell which
one is lying.

TestThePreflightPostureIsTheRoomsOwnBadge makes that assertion through a
different construction path on each side — DoctorSeats against the columns
stateWith builds — because comparing doctorPosture with postureClaim would
be comparing a call with itself.

The badge says what it IS; the evidence class says what it RESTS ON

unsandboxed is the case that proves they are two questions: two seats reach
that badge because a live run refuted the flags and because no flag was
ever passed, and a reader deciding whether to point council at a worktree needs
the second sentence. §4a.1's rule that two kinds of nothing must not render alike
is the same rule one level up.

evidenceClass is a table keyed by level, so TestEveryPostureLevelHasAnEvidenceClass
walks the type and fails the build the day a sixth level renders a badge with
nothing to classify it. TestNoEvidenceClassSoftensItsBadge holds the other half
on TestThePostureLegendDoesNotSoftenAnyClaim's terms: these sentences classify
evidence and never weaken it, and none may call a posture read-only, safe or
unable to write.

The rows are the --read room, and the argv is on the block

The room WRITES by default and --read is the opt-out. The rows report the
--read posture because that is the only one that is a fact about the machine
— the default room's badge is a property of an argv the reader has not typed yet,
and five cells all reading WRITES carry nothing per seat. So the header names
telltale council --read in its first clause, and one closing declaration states
the default. The gating half is counted off canGate, never written down:
that measurement has already moved once, when the Cursor seat became a live
process that can be asked and still does not ask about edits.

Non-gating, and pinned as such

No new probe, no network call, no login check, no exit-code change. A posture is
a claim measured once against a live run, not a check on this machine, so it
renders outside the three-state block beside the capability line and the survey
pin. It is wrong in both directions as a check: a FAILED would redden a working
install over a vendor's own design decision, and an ok would claim this
preflight established a containment property it never probed.

• TestAPostureIsNotACheck — the same seat with and without the data, the three
  counts required identical, no state word on any posture row. The method
  TestDriftIsNotAFailedCheck uses.
• TestThePostureBlockCostsNoProbe — the probe count is unchanged by the block.
• A seat council states no posture for gets no claim, not a missing row, and
  the word is deliberately not shaped like not checked.

Gates

• go vet ./... — clean.
• go test ./internal/doctor ./internal/council -timeout 20m — both green
  (council 54s on this Mac).
• go test ./... -timeout 20m — green.
• No golden changed, and none was regenerated: internal/doctor renders no
  goldens, and this touches no council render path.

Measured on the reference Mac (Intel, 2026-08-17) — the block above is that run's
real output. The codex row is the platform branch working: the same block on
Windows reads unsandboxed there, from postureClaim rather than from a second
platform test in the preflight.

Docs: a dated 2026-08-17 amendment to docs/design.md §9.42.

🤖 Generated with Claude Code