docs(remediation): bank D-25, accept RM02-REQ-10 revision, open RM-60
RM-02's per-commit replay needs isolation; the privileged CI step was correctly refused because PR-controlled code executes before Bubblewrap establishes any boundary — the untrusted party would obtain the capability meant to contain it. Ordering defect, not a hardening problem. D-25 is D-19 one layer down: audited party controls the manifest (artifact integrity) became audited party controls the code entering the sandbox (execution integrity). Both reduce to self-verification by the audited party is not verification, and both resolve via an authority outside its control — twice now this mission has derived Builds 1-2 from a security impossibility rather than design preference. Option C ruled independently by the orchestrator and rev-974 before either saw the other. rev-974 added the condition I missed and it matters most: post-merge replay is DETECTION, not PREVENTION, with a defined quarantine/revert response, and must never be presented as equivalent to a pre-merge gate. RM02-REQ-10 revision formally recorded and accepted under RM-02's own clause 4 — original text, restatement, reason — discharging rev-974's review-readiness condition. RM-60 opened for the external pre-execution trust boundary, cross-referenced with RM-59. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
co-authored by
Claude Opus 5
Claude Opus 5
parent
eabe04bc5e
commit
2b85afe4ea
+83
-12
@@ -93,6 +93,76 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI.
|
||||
Three independent live instances in a single session — format gate, agent context reset, queue guard —
|
||||
is the class confirmed, not anecdote.
|
||||
|
||||
### RM02-REQ-10 — requirement revision, formally RECORDED AND ACCEPTED
|
||||
|
||||
Recorded under **RM-02's own clause 4** (meaning-changes retain original text, restatement, and reason).
|
||||
RM-02's specification is subject to RM-02's rules; the recursion is deliberate. `rev-974` made the PR
|
||||
**not review-ready until the coordinator records and accepts this** — discharged here.
|
||||
|
||||
**ORIGINAL (as dispatched):**
|
||||
|
||||
> _"PER-MERGE-COMMIT ASSERTION: assert that every merged commit passed every required gate, evaluated
|
||||
> AGAINST THAT COMMIT'S OWN TREE — not against current main."_
|
||||
|
||||
**RESTATEMENT (accepted 2026-08-01):**
|
||||
|
||||
> PR CI performs **unprivileged, fail-closed, current-tree** verification only. **Isolated per-commit
|
||||
> replay is deferred** to a protected post-merge/main authority, where it constitutes **detection with a
|
||||
> defined quarantine/revert response — explicitly NOT a pre-merge gate.** Inability to establish the
|
||||
> sandbox is a hard non-zero, never a skip.
|
||||
|
||||
**REASON:** isolated replay on PR CI would require granting namespace capability to PR-controlled
|
||||
config, which the same PR could then use directly — a trust boundary that does not exist at the repo
|
||||
layer (D-25). Not deferred for cost or effort; deferred because it is **impossible** here.
|
||||
|
||||
**Unblocked by: RM-60.** Accepted by `mos-remediation`; independently ruled by `rev-974`.
|
||||
|
||||
### D-25 — self-verification by the audited party, a second time, one layer down
|
||||
|
||||
RM-02's per-commit replay needs isolation. Docker denied Bubblewrap namespace creation; the obvious fix
|
||||
— a privileged CI step — was **correctly refused** by the implementing seat and rated CRITICAL by a
|
||||
security review, because **PR-controlled `package.json`/verifier code executes _before_ Bubblewrap
|
||||
establishes any boundary.** The untrusted party would obtain the very capability meant to contain it.
|
||||
UID 65534 and later capability drops do not repair an _ordering_ defect.
|
||||
|
||||
The seat's own formulation, promoted here verbatim because it is the whole argument:
|
||||
|
||||
> **"Repo-only code cannot both grant namespace capability to PR config and prevent that same PR from
|
||||
> using the capability directly."**
|
||||
|
||||
**This is D-19 again, one layer down — and the repetition is the finding.**
|
||||
|
||||
| | audited party controls… | so verification fails at… |
|
||||
| -------- | -------------------------------- | ------------------------- |
|
||||
| **D-19** | the manifest that certifies it | **artifact** integrity |
|
||||
| **D-25** | the code that enters the sandbox | **execution** integrity |
|
||||
|
||||
Both reduce to: **self-verification by the audited party is not verification.** Both resolve the same
|
||||
way — an authority _outside_ the audited party's control. **That is now twice this mission has
|
||||
independently derived the necessity of its own architecture (Builds 1–2: choke-point executor + spine)
|
||||
from a security impossibility rather than from design preference.**
|
||||
|
||||
**Ruling — Option C**, reached **independently** by the orchestrator and by `rev-974` before either saw
|
||||
the other's reasoning (the same convergence signal the two planners produced). Ship what the layer can
|
||||
guarantee — unprivileged, fail-closed, current-tree verification on PR CI — and defer isolated
|
||||
per-commit replay to a protected authority.
|
||||
|
||||
**Condition from rev-974 that the orchestrator's ruling missed, and it matters most:**
|
||||
**Protected post-merge replay is DETECTION, not PREVENTION.** It must be documented as such, with its
|
||||
response defined (quarantine / revert), and **must never be presented as equivalent to a pre-merge
|
||||
gate.** Presenting detection as prevention would be D-20's overclaim in a new location — and would be
|
||||
especially corrosive here, since the whole task exists to make gates trustworthy.
|
||||
|
||||
**Also binding:** inability to establish the sandbox must be a **hard non-zero**, never skip-or-pass;
|
||||
the meta-negative-control must not be weakened to fit the unprivileged environment (any gate whose
|
||||
mutation check genuinely cannot run unprivileged is registered as a `DEFECT` with an owner, never
|
||||
quietly dropped); and the privileged experiment stays **uncommitted**, out of branch history.
|
||||
|
||||
**Tracked dependency: RM-60** — an external pre-execution trust boundary (protected default-branch
|
||||
pipeline config, or an immutable trusted launcher) owned by infra/provider authority, cross-referenced
|
||||
with **RM-59**. Both are the same dependency wearing different clothes: _the anchor must live outside
|
||||
the audited party._
|
||||
|
||||
### D-24 — the orchestrator cited `mergeable: true` as evidence of merge-readiness
|
||||
|
||||
Escalating D-23, I wrote that the fix "exists and is parked, open and mergeable" — framing that invited
|
||||
@@ -945,18 +1015,19 @@ spread is itself information, and X1 says we calibrate on real merged PRs.
|
||||
|
||||
### P5 — Retirements, hygiene, conformance
|
||||
|
||||
| id | task | src | depends_on | est (S/O) | tier |
|
||||
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------- | ---------------- | ------ |
|
||||
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet |
|
||||
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
|
||||
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
|
||||
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
|
||||
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
|
||||
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
|
||||
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
|
||||
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
|
||||
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
|
||||
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet |
|
||||
| id | task | src | depends_on | est (S/O) | tier |
|
||||
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------- | ---------------- | ------ |
|
||||
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet |
|
||||
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
|
||||
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
|
||||
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
|
||||
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
|
||||
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
|
||||
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
|
||||
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
|
||||
| RM-60 | **External pre-execution trust boundary for CI** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus |
|
||||
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
|
||||
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet |
|
||||
|
||||
**Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user