From ab080897f54fca0265def894b668b294e3dece87 Mon Sep 17 00:00:00 2001 From: Vu Nguyen Date: Fri, 25 Sep 2026 15:04:35 +0700 Subject: [PATCH 1/2] docs: narrow the v0.5 Layer B gate and accept the attestation cost MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit S7 scoping for PDN-0004, proposed for owner review: - The Layer B release gate keeps one real-host scenario per invariant: F1, F2, F11, F18 and F27. Layer A already runs every scenario in CI against the reference host. Layer B only has to show that a real host follows the prose. F4, F8, F10 and F12-F15 move to post-release evidence. - Owner attestation is the v0.5 cost. The S6 measurements show that no shipped executor gives safe machine stop evidence on macOS, so every delegated attempt ends with a person confirming no process remains. v0.5 documents this instead of weakening §8.3; lowering it is v0.6 work. - In Layer B the owner attests by hand; the harness never records owner-attested itself. Co-Authored-By: Claude Opus 5.5 --- .../PDN-0004-v05-acceptance-recovery.md | 37 +++++++++++++++++-- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/docs/design/PDN-0004-v05-acceptance-recovery.md b/docs/design/PDN-0004-v05-acceptance-recovery.md index 543f258..d004e01 100644 --- a/docs/design/PDN-0004-v05-acceptance-recovery.md +++ b/docs/design/PDN-0004-v05-acceptance-recovery.md @@ -1720,10 +1720,25 @@ through `tests/harness/ref-host` and `tests/harness/fake-executor`: worker tampering. **Release gate:** all of Layer A green in CI (F19, F21, F23 and F25 run in a -concurrency stress job); Layer B run for at least F1, F2, F4, F8, F10–F15, F18 and -F27 with zero false acceptance and zero silent duplicate overlapping writers. The 20-organic-dispatch measurement from the RFC is +concurrency stress job); Layer B run for F1, F2, F11, F18 and F27 with zero +false acceptance and zero silent duplicate overlapping writers. The 20-organic-dispatch measurement from the RFC is post-release measurement, not a gate. +*Narrowed 2026-09-25 (S7 scoping).* The gate first listed F1, F2, F4, F8, +F10–F15, F18 and F27. Layer A already runs every one of them in CI against +the reference host. Layer B asks a different question: does a real host +follow the prose? One scenario per invariant answers it: + +- F1: a worker does not accept its own work (I-1); +- F2: pickup does not trust a forged `accepted` line after a crash (§13.2); +- F11: an interrupted launch window is never taken as "not launched" + (§8.1); +- F18: a surviving descendant blocks a stop and a second writer (§8.3, I-12); +- F27: routing respects an owner-mandated executor (§17). + +The other Layer B scenarios (F4, F8, F10, F12–F15) move to post-release +evidence under `docs/evidence/v0.5.x/`. + ## 21. Migration from current v0.4.x files | Area | v0.4.x | v0.5 | Migration | @@ -2149,8 +2164,22 @@ ships it. **S7 — Real-host evidence, docs, migration, release.** - Files: `docs/evidence/v0.5.0/`, README, `docs/INTEGRATIONS.md`, `docs/SMOKE_TEST.md`, CHANGELOG `[0.5.0]`, VERSION + manifests. -- Acceptance: Layer B scenarios listed in §20.2 gate pass; `release.yml` - green; migration table §21 reflected in README. +- Acceptance: the Layer B scenarios in the §20.2 release gate pass; + `release.yml` green; migration table §21 reflected in README; the release + notes state the attestation cost below. +- **Owner attestation is the v0.5 cost (decision 2026-09-25).** The measured + cards (S6) show that no shipped executor gives safe machine stop evidence + on macOS. Claude Code and Codex tool shells survive `SIGKILL`; kiro-cli + could detach through a trusted shell. So every delegated attempt ends with + a person confirming that no process remains, unless it ran in a + containment scope. v0.5 ships this cost and documents it in the README + and release notes, and does not weaken §8.3 to avoid it. Lowering the cost + is v0.6 work: a containment scope on macOS, or measured evidence that a + normal (not killed) exit leaves nothing behind. +- **Who attests in Layer B.** The owner, by hand, during each real-host run. + The harness may pause and show the process listings, but it never records + `owner-attested` itself (the rule #21 applied to the measurement runner). + The narrowed gate keeps this to five scenarios. - Independent merge: this is the release PR (`release/v0.5.0` → `main`). - Rollback: do not merge; `main` stays at v0.4.x. From ef0bd54c93a7098a5bd1a9f14f43e31596f75592 Mon Sep 17 00:00:00 2001 From: Vu Nguyen Date: Fri, 25 Sep 2026 15:35:11 +0700 Subject: [PATCH 2/2] docs: keep F14 in the narrowed Layer B gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review on #22: C6 recovery depends on host prose the helper does not enforce. `projected` checks the persisted verdict, the checkbox and the attempt line, but it does not recompute the task or artifact digest or rerun any check. A real host that skipped the §13.3 re-checks could project a historical verdict, and none of the other five gate scenarios exercises that path. F14 goes back into the gate, with the changed-task and changed-artifact cases, making six scenarios. Co-Authored-By: Claude Opus 5.5 --- .../design/PDN-0004-v05-acceptance-recovery.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/docs/design/PDN-0004-v05-acceptance-recovery.md b/docs/design/PDN-0004-v05-acceptance-recovery.md index d004e01..001c7f7 100644 --- a/docs/design/PDN-0004-v05-acceptance-recovery.md +++ b/docs/design/PDN-0004-v05-acceptance-recovery.md @@ -1720,8 +1720,8 @@ through `tests/harness/ref-host` and `tests/harness/fake-executor`: worker tampering. **Release gate:** all of Layer A green in CI (F19, F21, F23 and F25 run in a -concurrency stress job); Layer B run for F1, F2, F11, F18 and F27 with zero -false acceptance and zero silent duplicate overlapping writers. The 20-organic-dispatch measurement from the RFC is +concurrency stress job); Layer B run for F1, F2, F11, F14, F18 and F27 with +zero false acceptance and zero silent duplicate overlapping writers. The 20-organic-dispatch measurement from the RFC is post-release measurement, not a gate. *Narrowed 2026-09-25 (S7 scoping).* The gate first listed F1, F2, F4, F8, @@ -1733,11 +1733,19 @@ follow the prose? One scenario per invariant answers it: - F2: pickup does not trust a forged `accepted` line after a crash (§13.2); - F11: an interrupted launch window is never taken as "not launched" (§8.1); +- F14: a crash between verdict and projection is repaired only after the + re-checks of §13.3. The real-host run covers both the changed-task case + (the verdict stays historical) and the changed-artifact case (the digest + no longer matches). `projected` checks the persisted verdict, the + checkbox and the attempt line, but it recomputes neither digest and runs + no check. So these re-checks are host prose that only a real host can + prove it follows; - F18: a surviving descendant blocks a stop and a second writer (§8.3, I-12); - F27: routing respects an owner-mandated executor (§17). -The other Layer B scenarios (F4, F8, F10, F12–F15) move to post-release -evidence under `docs/evidence/v0.5.x/`. +The other Layer B scenarios (F4, F8, F10, F12, F13, F15) move to +post-release evidence under `docs/evidence/v0.5.x/`. F14 was added back in +review ([#22](https://github.com/vunm-io/passdown/pull/22)). ## 21. Migration from current v0.4.x files @@ -2179,7 +2187,7 @@ ships it. - **Who attests in Layer B.** The owner, by hand, during each real-host run. The harness may pause and show the process listings, but it never records `owner-attested` itself (the rule #21 applied to the measurement runner). - The narrowed gate keeps this to five scenarios. + The narrowed gate keeps this to six scenarios. - Independent merge: this is the release PR (`release/v0.5.0` → `main`). - Rollback: do not merge; `main` stays at v0.4.x.