diff --git a/docs/remediation/MISSION.md b/docs/remediation/MISSION.md index e0258a86..65df03a3 100644 --- a/docs/remediation/MISSION.md +++ b/docs/remediation/MISSION.md @@ -66,6 +66,31 @@ gate/program; the LLM handles only genuine judgment. > content as certified is the only unacceptable outcome; an honest "this cannot be verified" is always > available and always preferable. +### First-class principle — when a property cannot exist at the layer it was specified + +> Some required properties are **impossible at the layer that asked for them** — not hard, impossible. +> A local check cannot defend against an actor who can rewrite the check itself. When that happens, +> there are exactly three honest moves, and all three are mandatory: +> +> 1. **Implement what the layer _can_ guarantee.** Partial protection against the class it was actually +> born from is worth having. +> 2. **State the boundary precisely, in BOTH directions.** What it does _not_ defend, **and** beside it +> what it _does_. A reader who sees only the negative dismisses the check as worthless; one who sees +> only the positive over-trusts it. **Both together is the honest artifact** — either alone misleads. +> 3. **Record where the real guarantee will come from — as a TRACKED DEPENDENCY, not prose.** It must +> name a task that someone must close. _A documented gap with no owner becomes a permanent gap that +> reads as intentional._ +> +> **A written-down gap is acceptable engineering. An implied-fixed gap is this mission's core failure in +> a new costume** — a verification artifact that verifies nothing, with a green to prove it. +> +> Promoted to the charter by Mos (2026-07-31) from D-19. Origin: the RM-01 symlink manifest could not be +> made tamper-evident against a same-UID actor (CWE-345), because the manifest and its marker share one +> writable tree. The implementing seat **escalated rather than relabelling self-authentication as +> tamper-resistance** — the corollary above firing on its first real adversarial test, on the cheapest +> seat in the loop. Residual risk bound to **RM-59** (`depends_on: RM-12, RM-21, RM-25`), where the +> choke-point executor and spine verify from _outside_ the worktree's authority. + ## Decision record (authoritative, immutable) - **15/15 proposals decided: 13 accept, 2 modify (P-AUTHORITY-001, P-INBOX-001), 0 reject.** diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 5d8d3c82..593df7d9 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -120,11 +120,22 @@ Rationale, recorded so it can be challenged: authority. Hand-rolling key distribution for a local preflight now would duplicate that work badly. 4. Option C (structural policy, no manifest) is strictly worse — it cannot detect a **removed** expected link. -**Option A is acceptable only with honest labelling**, or it becomes the disease it is meant to cure: -the threat model stated verbatim in the code _and_ the PR ("does **not** defend against same-UID write; -no local construction can"), the words _tamper-proof / tamper-evident / secure_ barred from that -context, the scope carried in AC2's restatement, the residual risk named as a backlog item pointing at -the spine work, and every existing control kept RED-first. +**Option A is acceptable only with honest labelling**, or it becomes the disease it is meant to cure. +Conditions (last two added/sharpened by Mos): + +- Threat model stated verbatim in the code **and** the PR; the words _tamper-proof / tamper-evident / + secure_ **barred** from that context; the scope carried in AC2's restatement; every control kept + RED-first including manifest-only tamper. +- **State the boundary in BOTH directions.** Not only what it does _not_ defend (same-UID write; no + local construction can) but, beside it, what it **does** defend: accidental / independent / stale / + foreign-residue mutation — the **D-5** class it was born from (the five-month `.next` and its 19 + phantom `TS2307`s). _A reader who sees only the negative dismisses the check as worthless; one who + sees only the positive over-trusts it. Both together is the honest artifact._ +- **The residual risk is a HARD TRACKED DEPENDENCY EDGE, not a comment.** It is **RM-59**, owned by the + choke-point executor + spine work (`depends_on: RM-12, RM-21, RM-25`), and the AC2 scope note must + cite that id. _"Record where the real guarantee comes from" only holds if the record is a live + dependency someone must close._ **A documented gap with no owner becomes a permanent gap that reads + as intentional.** **The generalizable rule.** When a required property **cannot exist at the layer where it was specified**, the honest moves are: implement what the layer _can_ guarantee, **state the boundary @@ -735,17 +746,18 @@ spread is itself information, and X1 says we calibrate on real merged PRs. ### P5 — Retirements, hygiene, conformance -| id | task | src | depends_on | est (S/O) | tier | -| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | -------------------------- | ---------------- | ------ | -| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | -| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | -| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | -| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | -| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | -| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | -| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | -| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | -| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | +| id | task | src | depends_on | est (S/O) | tier | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------- | ---------------- | ------ | +| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | +| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | +| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | +| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | +| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | +| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | +| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | +| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | +| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus | +| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | **Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.