diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 593df7d9..fe5b035c 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -93,6 +93,48 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI. Three independent live instances in a single session — format gate, agent context reset, queue guard — is the class confirmed, not anecdote. +### D-20 — the orchestrator's own documentation overclaimed, and a reviewer disproved it empirically + +`rev-974` blocked PR #1027 a second time. **The defect was not in the code — it was in this file**, at +D-18's entry, written by the orchestrator. + +Two faults, both mine: + +1. **D-18's AC2 restatement omitted the scope clause** that D-19 later established as mandatory + ("within an accidental/independent-mutation threat model"). +2. **D-18 asserted that the tampered-manifest control turns integrity "from a claim into a property."** + It does not, and _cannot_. That sentence was written **before** D-19 proved the property impossible + at this layer, and was never revised when D-19 landed. + +**The reviewer did not merely read it — it disproved it.** It performed a **same-UID consistent +manifest + marker rewrite**, and **preflight passed**. My documented claim was falsified by experiment. +Code, README, scratchpad and PR body all stated both threat-model directions correctly; **this file was +the only place still overclaiming.** + +**This is two banked findings firing on the orchestrator at once:** + +- **The integrity-claim corollary** — I wrote an integrity _claim_ in the voice of an integrity + _property_, in the very document that defines the rule against doing so. +- **D-14 (propagation)** — D-19 superseded D-18's assertion. I propagated the consequence into the + charter and the delivery conditions, but **not back into D-18 itself.** A ruling that fails to + propagate _backwards_ into the finding it supersedes is the same defect as one that fails to + propagate forwards, and I did not audit for that direction. + +**Corrected in place**, with the original wording quoted and the empirical disproof recorded, rather +than silently rewritten — the same standard demanded of any restated criterion. + +**Requirement on RM-02 (fifth clause).** Documentation asserting a _security or integrity_ property is +itself a claim requiring a negative control. Where a document states "X is guaranteed", the registry +must hold a case that **fails if X is not guaranteed** — and that case must have been observed red. +**Prose is not exempt from the mission's own evidentiary standard**, and prose in the _governing_ +document least of all: it is the artifact most likely to be quoted as authority long after the code has +moved on. + +**Reviewer credit.** rev-974 was briefed that its highest-priority check was "confirm the PR claims no +more than it can deliver, and a softened or omitted boundary is a finding even though the code works." +It applied that instruction **to the orchestrator's own governing document** and produced an experiment +to settle it. That is the review standard this mission is trying to make ordinary. + ### D-19 — an integrity property that cannot exist at the layer it was specified Implementing D-18's manifest, the seat + a Codex security review reached **CWE-345**: the symlink @@ -173,16 +215,30 @@ still rejected as a symlink; descendants are rejected unless _exactly_ certified publishes atomically. Strictly **stronger** than blanket rejection — it also catches a **retargeted** symlink, which blanket rejection cannot distinguish from a legitimate one. -**AC2 restated (recorded, not absorbed).** _Generated state must reject `.next` itself being a symlink, -and must reject any descendant symlink not exactly certified by the build manifest — added, removed, -retargeted, or manifest-tampered all fail with exit 43._ +**AC2 restated (recorded, not absorbed).** _Generated state must reject `.next` itself being a symlink +or non-directory, and must reject any descendant symlink not exactly certified by the build manifest — +added, removed, retargeted, or manifest-only-tampered all fail with exit 43 — **within an accidental / +independent-mutation threat model.**_ + +> ⚠ **This entry is superseded in part by [D-19](#d-19). Do not read D-18 standalone.** The scope clause +> above is load-bearing: the design **cannot** defend against a same-UID actor, which can rewrite the +> manifest and the marker consistently (CWE-345). D-18 was written **before** that impossibility was +> established. **Hardening required before this counts.** The manifest is itself generated state, so **a manifest writable by whoever plants a rogue symlink certifies the attack** — that is the one way this design fails. It must sit inside the same ownership/fingerprint envelope, published atomically via the existing marker mechanism, with negative controls **observed red first** for: added, removed, retargeted, -**manifest-tampered**, plus a positive control that the canonical build passes. The tampered-manifest -control is non-negotiable; without it, integrity is a claim rather than a property. +**manifest-only-tampered**, plus a positive control that the canonical build passes. + +> ⚠ **CORRECTED (D-20).** This paragraph originally ended: _"without it, integrity is a claim rather +> than a property."_ **That overclaimed**, by implying the control makes integrity a _property_. It does +> not, and cannot. The manifest-only-tamper control detects **independent** mutation of the manifest; +> it confers **no authenticity** against an actor who rewrites manifest _and_ marker together. +> `rev-974` disproved the original wording empirically — a same-UID consistent manifest+marker rewrite +> **passed preflight**. Integrity here remains a scoped **drift-detection** property, never an +> authenticity one. See D-19 and the charter principle on properties that cannot exist at their +> specified layer. **Requirement on RM-02 (fourth clause).** The registry must detect **conflicts between registered criteria**, not only wrongness and coverage. Two criteria that cannot simultaneously hold is a registry