mosaicstack/stack
1
0
Fork 1
Code Issues 156 Pull Requests 9 Actions Packages Projects Releases 15 Wiki Activity

docs(remediation): amend the credential ruling — the widening is withdrawn, and my lean was wrong

Browse Source 
tl-mosaic's split is adopted and it partially reverses (a). Two of the three reasons did not survive:
the read-back doctrine mandates reading back the AUTHORED ARTIFACT, whose author field is readable under
existing repo scopes, so identity-on-authoring never needed read:user; and "read-only, marginal
privilege" is true but is not a justification, because cheap is not the same as needed.

The named trap is a fleet-wide scope widening performed to make an instrument green — the tail wagging
the dog, same family as buying admin read to answer the wrong question more authoritatively.

My error is the sharper one and I am recording it as mine. I recommended (a), and my stated reason was
verbatim the discredited one: read-only on the actor's own identity, converts an unverifiable property
into a one-command self-check. Worse, I had already written the correct answer as my own option (b) —
the authored-artifact read-back — and reached past it for the widening because it made the check
mechanical. Having the right answer in hand and preferring the one that services the instrument is the
whole failure. tl-mosaic caught what neither Mos nor I did.

The amended split: CAPABILITY is the in-scope probe plus differential — this seat's D-11b check,
canonical and unchanged. IDENTITY is /user where the token holds read:user, and otherwise NOT-MEASURED,
which is neither pass nor fail; a seat lacking read:user is correctly provisioned, not defective.
NOT-MEASURED is the resolution of the whole class — P-WRAPPER-001's tri-state applied to measurement
itself. The false negative existed because a missing measurement was scored as a failure.

The MISMATCH class closes at mint time instead, at zero runtime scope cost: the minting authority holds
admin scopes and reads back the principal at mint, asserting filename-vs-principal once, at the only
moment a mismatch can be created. coder-mos1's criterion is replaced rather than repaired, no re-mint;
it was correctly provisioned throughout.

Also ratified: a pre-registered check whose premise has died is an active pressure toward breaking
working code. Amending it before it runs, in writing, with the premise-change named, is the only honest
handling — the original arm would have been satisfied by seats that were never broken, so a false red
was traded for a real test. That completes the pre-registration principle by naming its one legitimate
amendment.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-05 12:01:49 -05:00
co-authored by Claude Opus 5
parent b66d1858e1
commit 7fc7fa1a25
1 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/TASKS.md
+57
View File
@@ -2056,6 +2056,63 @@ governs the raw-API path, the tea login governs the tea path, and the two can di
> operation) enters the seat-provisioning checklist; and **verdict classification happens on the ERROR > operation) enters the seat-provisioning checklist; and **verdict classification happens on the ERROR
> BODY, never the status code alone.** > BODY, never the status code alone.**
> **★★★ AMENDED — THE FLEET-WIDE WIDENING IS WITHDRAWN (Mos, 2026-08-05, on `tl-mosaic`'s split).
> AND THE ORCHESTRATOR LEANED THE WRONG WAY FOR THE SAME REASON THE COORDINATOR DID.**
>
> Two of the three reasons for (a) did not survive inspection:
>
> | reason | verdict |
> | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
> | "read-back doctrine requires identity self-verification" | **WRONG BY MECHANISM** — the mandated read-back is of the **AUTHORED ARTIFACT**, whose author field is readable under the seat's **existing repo scopes**. **Identity-on-authoring never needed `read:user`.** |
> | "read-only, about the actor, marginal privilege" | **TRUE BUT NOT A JUSTIFICATION — cheap is not the same as needed.** |
>
> > **★ THE NAMED TRAP: A FLEET-WIDE SCOPE WIDENING PERFORMED TO MAKE AN INSTRUMENT GREEN.** The tail
> > wagging the dog — same family as buying admin read to answer the wrong question more
> > authoritatively. Mos wrote that rule into doctrine hours earlier and walked into its sibling within
> > the hour.
>
> **MY OWN ERROR, AND IT IS THE SHARPER ONE: I recommended (a).** I wrote _"I lean (a): the scope
> widening is read-only on the actor's own identity, and it converts an unverifiable property into a
> one-command self-check."_ That is **exactly** the discredited reason 1. Worse — **I had already
> written the correct answer as my own option (b)**, the authored-artifact read-back, and preferred the
> widening **because it made the check mechanical.** Having the right answer in hand and reaching past
> it for the one that services the instrument is the whole failure. `tl-mosaic` caught what neither the
> coordinator nor I did.
>
> **THE AMENDED SPLIT — two questions, different instruments:**
>
> | question | instrument | on absence |
> | ------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
> | **CAPABILITY** "does this credential work?" | in-scope probe + differential (**this seat's D-11b check, CANONICAL, unchanged**) | fail-closed — this is the real question |
> | **IDENTITY** "who does it authenticate as?" | `/user` **where the token holds `read:user`** | **NOT-MEASURED — neither pass NOR fail; a seat lacking `read:user` is CORRECTLY PROVISIONED, not defective** |
>
> **`NOT-MEASURED` is the resolution of this entire class** — it is P-WRAPPER-001's tri-state applied to
> measurement itself. The false negative existed because a missing measurement was being scored as a
> failure. The residual is stated in every report: **MISMATCH coverage extends only to
> `read:user`-holding tokens.**
>
> **The MISMATCH class closes at MINT TIME instead, at zero runtime scope cost:** the minting authority
> already holds admin scopes and can **read back the principal at mint**, asserting filename-vs-principal
> **once, at the only moment a mismatch can be created.**
>
> **`coder-mos1`: criterion REPLACED, not repaired** — capability differential + artifact read-back on
> its next natural authored write. **No re-mint. It was correctly provisioned the entire time.**
> **★ PRE-REGISTRATION DOCTRINE — WHAT TO DO WHEN A CHECK'S PREMISE DIES (ratified from `tl-mosaic` §2).**
> The original post-condition arm **would have been satisfied by seats that were never broken** — so it
> was amended before running, and **a false red was traded for a real test**.
>
> > **A pre-registered check whose PREMISE has died is an ACTIVE PRESSURE TOWARD BREAKING WORKING CODE.**
> > Amending it **BEFORE it runs, in writing, with the premise-change NAMED**, is the only honest
> > handling. Leaving it to fail and then "fixing" reality to satisfy it is the corruption.
>
> This completes the pre-registration principle: pre-registration prevents **retrofitting**, and this
> names the one legitimate amendment — premise falsified, amended before execution, change recorded.
>
> **Control-property note:** `tl-mosaic` was itself the **unrepresentative control** (its token holds
> `read:user`; the fleet's correctly do not) — **and it caught that in its own evidence before anyone
> else read it.**
### D-12 — a requested SAFETY flag was silently degraded, and I did not check ### D-12 — a requested SAFETY flag was silently degraded, and I did not check
I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**. I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.