From ff4b45b0256a3ee44e51319c17c95b7b9f1d7a16 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 23:17:01 -0500 Subject: [PATCH] docs(remediation): RM-03 CANNOT_ASSERT semantics ruled (option B) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves an ambiguity in the orchestrator's own brief, which required CANNOT_ASSERT to neither silently pass nor permanently block without distinguishing push from merge. coder-mos1 stopped and asked rather than inferring authorisation; Codex security independently flagged CWE-693. Ruled B: merge fails CLOSED (proceeding without exact-head CI evidence is D-23's condition in a narrower costume), push degrades AUDITED (blocking during an outage bricks delivery — the Pi-brick class we already banked). A temporary block pending evidence is not a permanent block, and merge is separately gated by the merge-gate and coordinator, so nothing is stranded. Conditions: distinct exit code or the tri-state is destroyed; the audit record asserted by a registered case, not assumed, or 'audited' is a claim dressed as a property; retryable and self-clearing; cases observed RED first; no silent degraded merge path — break-glass belongs to RM-05. Option C rejected: it bricks push during an outage and defers the degraded path, which in this codebase means a silent bypass appears under incident pressure. Three are already on the books. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index a83f0ec5..4a8d2d58 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -146,6 +146,39 @@ exposure or changing provider protected-pipeline posture is a host security-post infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed, the privileged experiment stays uncommitted and out of branch history. +### RM-03 — CANNOT_ASSERT semantics: RULED (option B), 2026-08-01 + +Recorded because it resolves an **ambiguity in the orchestrator's own brief**, and because the reasoning +generalises beyond the queue guard. + +The brief required that `CANNOT_ASSERT` "must NOT silently pass and must NOT permanently block" — +**without distinguishing push from merge.** Those need different answers. `coder-mos1` stopped and asked +rather than inferring authorisation from an ambiguous instruction plus a "carry on"; a Codex security +review independently flagged **CWE-693** on the same point. + +**Ruling — B: push degrades audited/exit 0; merge returns a distinct non-zero/HOLD until the provider +recovers.** The asymmetry is the substance, not a compromise: + +| action | consequence | posture | +| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | +| **merge** | proceeding without exact-head CI evidence is **D-23's condition in a narrower costume** — the guard passing exactly when its answer matters most | **fail CLOSED** | +| **push** | blocking during a provider outage **bricks delivery** — the Pi-brick class (P-RECOVERY-001), a gate whose own unavailability prevents recovery from it | **degrade, AUDITED** | + +**"Must not permanently block" is satisfied:** a _temporary_ block pending evidence is not a _permanent_ +one. Merge HOLD clears on provider recovery, and merge is separately gated by the merge-gate verdict and +the coordinator, so a non-zero `CANNOT_ASSERT` strands nothing. + +**Conditions.** Distinct exit code (`CANNOT_ASSERT` never conflated with `ASSERTED_NOT_READY`, or the +tri-state is destroyed) · **the audit record is ASSERTED by a registered case, not assumed** — otherwise +"audited" is an integrity _claim_ dressed as a _property_ · retryable and self-clearing, documented · +registered cases observed RED first for each arm · **no silent degraded merge path, ever** — any +authorised degraded merge is break-glass (loud, audited, expiring) and belongs to RM-05, not here. + +**Option C (always non-zero) rejected:** cleaner to specify, worse in practice. It bricks push during an +outage and defers the degraded path to "later", which in this codebase means **a silent bypass appears +under incident pressure**. Three such bypasses are already on the books; do not create the conditions +for a fourth. + ### D-28 — a swallowed diagnostic destroyed the evidence a fail-closed check needed RM-02's CI run failed on four `scripts/gate-history.test.mjs` sandbox tests. **The fail-closed logic