mosaicstack/stack
25
0
Fork 1
Code Issues 344 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

docs: PRD rev1 review Q90 — Prettier-format the bundle, add rev0 archive README
ci/woodpecker/pr/ci Pipeline failed
Details

Browse Source 
Addresses CPS-PRD-REV1-REVIEW-Q90 findings F1 and F3 on PR #1491:

F1 (format gate): `prettier --write` on the 18 rev1 bundle documents.
Whitespace, table padding, list markers and emphasis delimiters only — a
normalized token comparison of every file before/after shows zero content
difference, so the ratified text is unchanged and no re-ratification applies.

F3 (rev0 relative links): the archived rev0 PRD stays byte-identical
(sha256 60cc2f98...36afdf verified) per GOV.1 archive-never-edit. A sibling
docs/PRDs/2026-08-26_PRD_rev0/README.md records the digest, the original
location, the owner disposition that the in-file links are intentionally
historical, and a resolution table for all 9 targets (11 occurrences), each
verified to exist. Future relocated archives ship the same README instead of
edited bytes.

F2 (test step) is investigated separately against the CI log.
This commit is contained in:
jason.woltje
2026-09-02 09:40:46 -05:00
parent ad21ad7ac5
commit 13968e9a8b
19 changed files with 279 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PRDs/2026-08-31_PRD_rev1/AUTHZ.1-capability-authority.md
+17 -16
View File
@@ -13,7 +13,7 @@ L2 authorization contracts, `mosaic-core` (measured 2026-08-31), and the lane's
## Glossary
**Privilege escapation** *(Jason, 2026-08-31)* — the outcome class in which an
**Privilege escapation** _(Jason, 2026-08-31)_ — the outcome class in which an
agent exercises authority it was never granted, regardless of mechanism.
Deliberately collapses escalation and misdirection: the outcome is identical;
the distinction matters only when choosing a control.
@@ -60,7 +60,7 @@ canary phase (gap G7 — by design for now; L2-D21 is the end state).
capability-adding edge.
**Accepted within reason: misdirection.** A rogue or colluding orchestrator can
still *route work* to a seat that already legitimately holds a capability. The
still _route work_ to a seat that already legitimately holds a capability. The
authority is genuine, so no structural control can refuse it. Jason's ruling:
escalation and misdirection are tiered **by outcome — identically**; locking
down far enough to mechanically prevent misdirection cripples the system to
@@ -71,11 +71,11 @@ see the audit surface in [[UI.1-webui-surfaces]] and gap G3 below.
Design intent (not yet enforced by any manifest — gap C3 in the lane ledger):
| Role | Must NOT |
|---|---|
| coding agent | create remote git repositories |
| gate agent | code |
| review agent | code |
| Role | Must NOT |
| -------------- | -------------------------------- |
| coding agent | create remote git repositories |
| gate agent | code |
| review agent | code |
| interact agent | code, create remote repositories |
Breaking the monopoly means no single seat holds an exit path; escape requires
@@ -85,20 +85,21 @@ role taxonomy this matrix projects onto.
## Gap register (measured 2026-08-31)
| ID | Gap | Status |
|---|---|---|
| G1 | No least-privilege language anywhere in L1/L2/NORTH-STAR (grep-verified) | **L2-D52 amendment drafted** |
| G2 | Assignment issuance criteria unspecified (renewal names criteria; issuance does not) — full-ceiling requests validate cleanly | **L2-D52 amendment drafted** |
| G3 | No misdirection audit exists — no tooling, agent, or surface | open → [[UI.1-webui-surfaces]] §Audit |
| G4 | Coordinator-as-seat would collapse the model | firewall — never violate |
| G5 | Seat config mixes authority classes (role binding beside a model dropdown) | open → [[SEAT.1-seat-profile]] |
| G6 | `role-harness-config/DESIGN.md` scope defect (unstated surface) | fix drafted (amendment in `proposed/docs/`) |
| G7 | Capability map closed/hardcoded | by design (canary phase) |
| ID | Gap | Status |
| --- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| G1 | No least-privilege language anywhere in L1/L2/NORTH-STAR (grep-verified) | **L2-D52 amendment drafted** |
| G2 | Assignment issuance criteria unspecified (renewal names criteria; issuance does not) — full-ceiling requests validate cleanly | **L2-D52 amendment drafted** |
| G3 | No misdirection audit exists — no tooling, agent, or surface | open → [[UI.1-webui-surfaces]] §Audit |
| G4 | Coordinator-as-seat would collapse the model | firewall — never violate |
| G5 | Seat config mixes authority classes (role binding beside a model dropdown) | open → [[SEAT.1-seat-profile]] |
| G6 | `role-harness-config/DESIGN.md` scope defect (unstated surface) | fix drafted (amendment in `proposed/docs/`) |
| G7 | Capability map closed/hardcoded | by design (canary phase) |
Amendments staged in `proposed/docs/` per the lane convention; ledger items
A3/A4 track ratification. The auditor-identity question (an auditor agent is
itself a seat, itself subject to misdirection) is on the grill:
[[GOV.5-open-questions]] Q-A1.
## E2 inputs (triage 2026-08-31; see [[GOV.2-docs-inventory]])
**Canonical ground truth**: `DEVELOPER-GUIDE/architecture/mutator-class-gate.md`