From 2b85afe4ea2ad1ea5ae5e44d6fe086e18eb6f838 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 22:05:50 -0500 Subject: [PATCH] docs(remediation): bank D-25, accept RM02-REQ-10 revision, open RM-60 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RM-02's per-commit replay needs isolation; the privileged CI step was correctly refused because PR-controlled code executes before Bubblewrap establishes any boundary — the untrusted party would obtain the capability meant to contain it. Ordering defect, not a hardening problem. D-25 is D-19 one layer down: audited party controls the manifest (artifact integrity) became audited party controls the code entering the sandbox (execution integrity). Both reduce to self-verification by the audited party is not verification, and both resolve via an authority outside its control — twice now this mission has derived Builds 1-2 from a security impossibility rather than design preference. Option C ruled independently by the orchestrator and rev-974 before either saw the other. rev-974 added the condition I missed and it matters most: post-merge replay is DETECTION, not PREVENTION, with a defined quarantine/revert response, and must never be presented as equivalent to a pre-merge gate. RM02-REQ-10 revision formally recorded and accepted under RM-02's own clause 4 — original text, restatement, reason — discharging rev-974's review-readiness condition. RM-60 opened for the external pre-execution trust boundary, cross-referenced with RM-59. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 95 ++++++++++++++++++++++++++++++++++----- 1 file changed, 83 insertions(+), 12 deletions(-) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 709ad3fc..f5100026 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -93,6 +93,76 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI. Three independent live instances in a single session — format gate, agent context reset, queue guard — is the class confirmed, not anecdote. +### RM02-REQ-10 — requirement revision, formally RECORDED AND ACCEPTED + +Recorded under **RM-02's own clause 4** (meaning-changes retain original text, restatement, and reason). +RM-02's specification is subject to RM-02's rules; the recursion is deliberate. `rev-974` made the PR +**not review-ready until the coordinator records and accepts this** — discharged here. + +**ORIGINAL (as dispatched):** + +> _"PER-MERGE-COMMIT ASSERTION: assert that every merged commit passed every required gate, evaluated +> AGAINST THAT COMMIT'S OWN TREE — not against current main."_ + +**RESTATEMENT (accepted 2026-08-01):** + +> PR CI performs **unprivileged, fail-closed, current-tree** verification only. **Isolated per-commit +> replay is deferred** to a protected post-merge/main authority, where it constitutes **detection with a +> defined quarantine/revert response — explicitly NOT a pre-merge gate.** Inability to establish the +> sandbox is a hard non-zero, never a skip. + +**REASON:** isolated replay on PR CI would require granting namespace capability to PR-controlled +config, which the same PR could then use directly — a trust boundary that does not exist at the repo +layer (D-25). Not deferred for cost or effort; deferred because it is **impossible** here. + +**Unblocked by: RM-60.** Accepted by `mos-remediation`; independently ruled by `rev-974`. + +### D-25 — self-verification by the audited party, a second time, one layer down + +RM-02's per-commit replay needs isolation. Docker denied Bubblewrap namespace creation; the obvious fix +— a privileged CI step — was **correctly refused** by the implementing seat and rated CRITICAL by a +security review, because **PR-controlled `package.json`/verifier code executes _before_ Bubblewrap +establishes any boundary.** The untrusted party would obtain the very capability meant to contain it. +UID 65534 and later capability drops do not repair an _ordering_ defect. + +The seat's own formulation, promoted here verbatim because it is the whole argument: + +> **"Repo-only code cannot both grant namespace capability to PR config and prevent that same PR from +> using the capability directly."** + +**This is D-19 again, one layer down — and the repetition is the finding.** + +| | audited party controls… | so verification fails at… | +| -------- | -------------------------------- | ------------------------- | +| **D-19** | the manifest that certifies it | **artifact** integrity | +| **D-25** | the code that enters the sandbox | **execution** integrity | + +Both reduce to: **self-verification by the audited party is not verification.** Both resolve the same +way — an authority _outside_ the audited party's control. **That is now twice this mission has +independently derived the necessity of its own architecture (Builds 1–2: choke-point executor + spine) +from a security impossibility rather than from design preference.** + +**Ruling — Option C**, reached **independently** by the orchestrator and by `rev-974` before either saw +the other's reasoning (the same convergence signal the two planners produced). Ship what the layer can +guarantee — unprivileged, fail-closed, current-tree verification on PR CI — and defer isolated +per-commit replay to a protected authority. + +**Condition from rev-974 that the orchestrator's ruling missed, and it matters most:** +**Protected post-merge replay is DETECTION, not PREVENTION.** It must be documented as such, with its +response defined (quarantine / revert), and **must never be presented as equivalent to a pre-merge +gate.** Presenting detection as prevention would be D-20's overclaim in a new location — and would be +especially corrosive here, since the whole task exists to make gates trustworthy. + +**Also binding:** inability to establish the sandbox must be a **hard non-zero**, never skip-or-pass; +the meta-negative-control must not be weakened to fit the unprivileged environment (any gate whose +mutation check genuinely cannot run unprivileged is registered as a `DEFECT` with an owner, never +quietly dropped); and the privileged experiment stays **uncommitted**, out of branch history. + +**Tracked dependency: RM-60** — an external pre-execution trust boundary (protected default-branch +pipeline config, or an immutable trusted launcher) owned by infra/provider authority, cross-referenced +with **RM-59**. Both are the same dependency wearing different clothes: _the anchor must live outside +the audited party._ + ### D-24 — the orchestrator cited `mergeable: true` as evidence of merge-readiness Escalating D-23, I wrote that the fix "exists and is parked, open and mergeable" — framing that invited @@ -945,18 +1015,19 @@ spread is itself information, and X1 says we calibrate on real merged PRs. ### P5 — Retirements, hygiene, conformance -| id | task | src | depends_on | est (S/O) | tier | -| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------- | ---------------- | ------ | -| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | -| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | -| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | -| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | -| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | -| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | -| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | -| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | -| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus | -| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | +| id | task | src | depends_on | est (S/O) | tier | +| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------- | ---------------- | ------ | +| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | +| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | +| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | +| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | +| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | +| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | +| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | +| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | +| RM-60 | **External pre-execution trust boundary for CI** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus | +| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus | +| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | **Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.