forked from mosaicstack/stack
mos-dt-0andClaude Opus 5
f9435c2a03
Implementing the D-18 manifest hit CWE-345: manifest and marker share one same-UID writable tree, so that actor can regenerate both and pass. No local construction fixes self-authentication without a key outside its authority. The seat escalated rather than calling it tamper-resistant — the charter corollary working on its first real test. Ruling: Option A, scope AC2 to accidental/independent/stale mutation, retain the design. The undefendable boundary is not the weak link (same-UID write already owns the source, the tests, preflight.mjs and .husky); AC2 exists for the D-5 staleness class, against which the design works; and a real anchor arrives with the choke-point executor and PG spine, which verify outside the worktree's authority. Acceptable only with honest labelling: threat model verbatim in code and PR, the words tamper-proof/tamper-evident/secure barred there, scope carried in AC2's restatement, residual risk named as backlog, all controls kept RED-first. Generalizable: when a property cannot exist at the layer it was specified, implement what the layer can guarantee, state the boundary precisely, and record where the real guarantee comes from. A known gap written down is acceptable; a gap implied fixed is not. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>