repair(#402): final provenance-ID + post-freeze accounting closeout + reseal
- sources.md: Framing Gap duplicate A3-16 -> A3-17 (ClawSentry keeps A3-16); noWorkflow/ProvBook added as A3-27 (Crossref/OpenAlex-verified identity); A3-24 V1/V2 -> DOCUMENTATION_AUDITED; stale ~128-row summary prose rewritten to mechanical truth; ledger 83 rows / 79 unique / 106 labels - references re-pointed BY IDENTITY across load_bearing_evidence.md (5), claims.json (7), 03_applicability.md (4), 04_innovation.md (8, incl. phantom 'Sagas (A3-6)' removed) - gate: +check_source_reference_resolution (exact resolution, no suffix truncation, duplicate-ID fail, arXiv/DOI identity adjacency) + check_post_freeze_protocol; NC-E/F/G/I CAUGHT, NC-H PASS - post-freeze writes VERIFIED from persisted state: canonical entry 194015 created (superseded 193729, receipt 1515) + derived fact-9293 in knowledge.json — accounted; 8564009's 'write count 0' corrected - gap populations named: saturation 8 typed / 9 honest (5+4) / 14 remaining unknowns / 2 parked - mutation_audit.md FINAL version written LAST; gate PASS + Z/Y/X/W regression clean; canonical/derived writes this repair = 0
This commit is contained in:
conductor committed
1 parent
8564009882
commit
8fb0907b11
10 files changed
+178
-71
No files matched your search
@@ -11,12 +11,12 @@ Every mechanism carries a verdict: COVERED / ADOPT / ADAPT / EXPERIMENT / FUTURE
|
||||
| 5 | Sybil-resistant elevation (count distinct evidence ROOTS, never reports/agents/similarity; human as the only declassification authority) | ADOPT | Epistemic Sybil Resistance 2609.01873 (A2-26: report multiplicity collapses coverage 0.940→0.263); TMA-NM T3 |
|
||||
| 6 | ★ Crypto by property (per-threat mechanism selection; no universal chain; anti-rollback requires monotonic state outside the attacker) | ADOPT | arm-3 crypto table (A3-1..A3-6); adversarial J (no external monotonic state exists in Rune today) |
|
||||
| 7 | ★ Key custody honesty (secrets outside agent uid; same-uid readability assumed; encryption at rest = disk theft only) | ADOPT | arm-1 key-custody matrix; NIST SP 800-57 (A3-1); inward I: auth.json + /proc/pid/environ exposure |
|
||||
| 8 | ★ Tombstone vs payload distinction; crypto-erase; derived-data best-effort deletion | ADOPT | NIST SP 800-88r2 (A3-23); inward B2: hard delete, no tombstone; #401 cross-flag |
|
||||
| 9 | Destination allow-lists / capability isolation (the only empirically demonstrated near-zero exfiltration defense) | ADOPT | Framing Gap 2608.27092 (A3-15: model-side recognition fails 0%→100%, allow-lists close to 0%); FLOWSEAL (leak 52.2%→0.5%) |
|
||||
| 8 | ★ Tombstone vs payload distinction; crypto-erase; derived-data best-effort deletion | ADOPT | NIST SP 800-88r2 (A3-24); inward B2: hard delete, no tombstone; #401 cross-flag |
|
||||
| 9 | Destination allow-lists / capability isolation (the only empirically demonstrated near-zero exfiltration defense) | ADOPT | Framing Gap 2608.27092 (A3-17: model-side recognition fails 0%→100%, allow-lists close to 0%); FLOWSEAL (leak 52.2%→0.5%) |
|
||||
| 10 | ★ Fencing tokens / authority generations (stale-write rejection at the store; per-agent PoP keys; workers never inherit Main authority) | ADOPT | Kleppmann 2016 (A3-2); A-JWT 2509.13597 (A3-18); inward K: no fencing exists; adversarial EA-EE |
|
||||
| 11 | Detection discipline: deterministic violation auto-contain; anomaly becomes SUSPECTED only; FPR-first; typed security states | ADOPT | Axelsson 2000 (A3-8: base-rate fallacy); ClawSentry 2608.21101 (A3-16: progressive 4-locus monitoring); mandate §50-§55 |
|
||||
| 12 | ★ Provider boundary: access ends at the explicitly authorized interface; least-context disclosure; disclosure record | ADOPT | Framing Gap (A3-15); Claw in Plain Sight (A3-14: 20.8-75% policy-violating disclosure); mandate §29/§30 |
|
||||
| 13 | ★ Substrate security awareness (derived authorized-actor view; rogue-agent fixture; security state without false certainty) | ADOPT | mandate §39-42; Agent libOS 2606.03895 (A3-17: 3-plane design); inward F: no security state exists |
|
||||
| 12 | ★ Provider boundary: access ends at the explicitly authorized interface; least-context disclosure; disclosure record | ADOPT | Framing Gap (A3-17); Claw in Plain Sight (A3-14: 20.8-75% policy-violating disclosure); mandate §29/§30 |
|
||||
| 13 | ★ Substrate security awareness (derived authorized-actor view; rogue-agent fixture; security state without false certainty) | ADOPT | mandate §39-42; Agent libOS 2606.03895 (A3-18: 3-plane design); inward F: no security state exists |
|
||||
| 14 | ★ Safe rendering (escape-by-default in TUI; content isolation; link handling; no auto external-resource loading) | ADOPT | inward O: RichLog(markup=True) live attack surface; adversarial BG/F11 SUCCEEDS; mandate §61 |
|
||||
| 15 | ★ Input validation (Unicode confusables; encoding attacks; control chars; terminal escape; Markdown injection; path injection; SQL injection) | ADOPT | mandate §60; adversarial CC-CJ pass; no validation exists today |
|
||||
| 16 | Signed content = trustworthy | REJECT | xz CVE-2024-3094: poisoned upstream release defeats hashing/pinning; A: signature ≠ correctness; TMA-NM T1 |
|
||||
|
||||
@@ -16,7 +16,7 @@ Actor/source/origin separated as distinct fields, not one trust score. Prior art
|
||||
|
||||
## D. QUARANTINE FIRST-CLASS SEMANTICS (ADOPT)
|
||||
|
||||
Suspect content preserved but inactive. Prior art: noWorkflow/ProvBook (A3-17/18); mandate §59/§78. For: inward has no quarantine; adversarial F4 proves unguarded quarantine flags are themselves an attack surface. Against: storage overhead. Falsifier: E3/E25. Kill: quarantine rate makes the system unusable.
|
||||
Suspect content preserved but inactive. Prior art: noWorkflow/ProvBook (A3-27); mandate §59/§78. For: inward has no quarantine; adversarial F4 proves unguarded quarantine flags are themselves an attack surface. Against: storage overhead. Falsifier: E3/E25. Kill: quarantine rate makes the system unusable.
|
||||
|
||||
## E. PROVENANCE-AWARE TAINT (ADOPT)
|
||||
|
||||
@@ -28,7 +28,7 @@ Each action receives only the authority required for that specific operation. Pr
|
||||
|
||||
## G. AUTHORITY GENERATIONS (ADOPT)
|
||||
|
||||
Stale workers/sessions rejected via monotonic counter. Prior art: Kleppmann fencing tokens (A3-2); A-JWT (A3-18); #395 carry. For: inward K shows no fencing exists; workers inherit ambient authority. Against: storage-side validation overhead. Falsifier: E9/E30. Kill: fencing overhead exceeds the stale-write risk.
|
||||
Stale workers/sessions rejected via monotonic counter. Prior art: Kleppmann fencing tokens (A3-2); A-JWT (A3-19); #395 carry. For: inward K shows no fencing exists; workers inherit ambient authority. Against: storage-side validation overhead. Falsifier: E9/E30. Kill: fencing overhead exceeds the stale-write risk.
|
||||
|
||||
## H. RESTORE SECURITY GATE (ADOPT)
|
||||
|
||||
@@ -36,7 +36,7 @@ Fixity/authenticity + quarantine + semantic reconciliation + ledger-forward. Pri
|
||||
|
||||
## I. COMPENSATING SECURITY ROLLBACK (ADOPT)
|
||||
|
||||
Reuse #401 undo/history mechanism for poisoned state without destructive history rewriting. Prior art: #401 compensating-event undo (Sagas/Berlage/Sun); arm-3 Sagas (A3-6). For: inward B2 shows hard delete is the current behavior; adversarial BU confirms direct DB edit without audit. Against: adds complexity. Falsifier: E3 (containment). Kill: compensation complexity exceeds the recovery value.
|
||||
Reuse #401 undo/history mechanism for poisoned state without destructive history rewriting. Prior art: #401 compensating-event undo (Sagas/Berlage/Sun — #401 arm-3 ledger; no AA ledger row). For: inward B2 shows hard delete is the current behavior; adversarial BU confirms direct DB edit without audit. Against: adds complexity. Falsifier: E3 (containment). Kill: compensation complexity exceeds the recovery value.
|
||||
|
||||
## J. CRYPTO BY PROPERTY (ADOPT)
|
||||
|
||||
@@ -44,7 +44,7 @@ Choose mechanism by threat. Prior art: arm-3 crypto table (A3-1..A3-6). For: inw
|
||||
|
||||
## K. LEAST-CONTEXT DISCLOSURE (ADOPT)
|
||||
|
||||
Provider gets minimum needed context. Prior art: Framing Gap 2608.27092 (A3-15); Claw in Plain Sight 2608.20658 (A3-14); CaMeL capability labels (A1-18). For: inward I shows no disclosure record exists; provider currently gets full active context. Against: utility reduction. Falsifier: E32/E38. Kill: least-context degrades model quality beyond acceptable threshold.
|
||||
Provider gets minimum needed context. Prior art: Framing Gap 2608.27092 (A3-17); Claw in Plain Sight 2608.20658 (A3-14); CaMeL capability labels (A1-18). For: inward I shows no disclosure record exists; provider currently gets full active context. Against: utility reduction. Falsifier: E32/E38. Kill: least-context degrades model quality beyond acceptable threshold.
|
||||
|
||||
## L. SECURITY OBSERVABILITY WITHOUT SECRET SPILL (ADOPT)
|
||||
|
||||
@@ -72,7 +72,7 @@ Proven violation may auto-contain; anomaly becomes SUSPECTED. Prior art: Axelsso
|
||||
|
||||
## R. REVERSIBLE CONTAINMENT (ADOPT)
|
||||
|
||||
Isolate ambiguity without destroying data. Prior art: mandate §55; arm-3 Agent libOS 2606.03895 (A3-17). For: mandate §55. Against: containment overhead. Falsifier: E25. Kill: containment always destructive.
|
||||
Isolate ambiguity without destroying data. Prior art: mandate §55; arm-3 Agent libOS 2606.03895 (A3-18). For: mandate §55. Against: containment overhead. Falsifier: E25. Kill: containment always destructive.
|
||||
|
||||
## S. SECURITY STATE WITHOUT FALSE CERTAINTY (ADOPT)
|
||||
|
||||
@@ -92,14 +92,14 @@ Protocol participation ≠ authority. Prior art: mandate §41; arm-1 SO_PEERCRED
|
||||
|
||||
## W. OUTBOUND DATA-CAPABILITY CONTROL (ADAPT)
|
||||
|
||||
Network/tool egress scoped like any other capability. Prior art: Framing Gap 2608.27092 (A3-15); FLOWSEAL (A1-20); NIST SP 800-53 SC-7 (A1-12). For: inward: qBittorrent WAN-exposed; no egress control. Against: brittle universal denylists are bad; per-tool scoping is better. Falsifier: E35 exfil canary. Kill: egress control breaks all legitimate network use.
|
||||
Network/tool egress scoped like any other capability. Prior art: Framing Gap 2608.27092 (A3-17); FLOWSEAL (A1-20); NIST SP 800-53 SC-7 (A1-12). For: inward: qBittorrent WAN-exposed; no egress control. Against: brittle universal denylists are bad; per-tool scoping is better. Falsifier: E35 exfil canary. Kill: egress control breaks all legitimate network use.
|
||||
|
||||
## X. PROVIDER BOUNDARY ENFORCEMENT (ADOPT)
|
||||
|
||||
Provider receives only explicitly disclosed data, never implicit Rune authority. Prior art: mandate §29/§30; Framing Gap (A3-15); CaMeL (A1-18). For: inward I: no disclosure record; auth.json keys. Against: provider needs context to be useful. Falsifier: E32/E33/E38. Kill: least-context makes the model useless.
|
||||
Provider receives only explicitly disclosed data, never implicit Rune authority. Prior art: mandate §29/§30; Framing Gap (A3-17); CaMeL (A1-18). For: inward I: no disclosure record; auth.json keys. Against: provider needs context to be useful. Falsifier: E32/E33/E38. Kill: least-context makes the model useless.
|
||||
|
||||
## Y. COMPROMISE CLEARANCE PROOF (ADOPT)
|
||||
|
||||
Rune cannot declare attack resolved merely because alerts stop. Prior art: mandate §56; adversarial EV-EZ/F1; agent libOS (A3-17). For: inward: no recovery mechanism exists; F1 shows the evidence chain is forgeable. Against: no counter-evidence. Falsifier: E41. Kill: clearance overhead exceeds the compromise risk.
|
||||
Rune cannot declare attack resolved merely because alerts stop. Prior art: mandate §56; adversarial EV-EZ/F1; agent libOS (A3-18). For: inward: no recovery mechanism exists; F1 shows the evidence chain is forgeable. Against: no counter-evidence. Falsifier: E41. Kill: clearance overhead exceeds the compromise risk.
|
||||
|
||||
Row count: 25 candidates (A–Y) — ADOPT 22 · ADAPT 3 (T, U, W) · PARK 0 · Sum 25.
|
||||
+4
-4
@@ -11,7 +11,7 @@ The architecture answers with a small, threat-modeled design whose honesty is it
|
||||
|
||||
The adversarial pass (170 attacks: mandated A–EZ + 12 fresh) returned **SUCCEEDS 30 · PARTIAL 30 · FAILS 110** and produced the domain's sharpest structural finding: **the architecture's enforcement claims contradicted its own honesty clause.** At same uid, in-process enforcement is policy discipline, not boundary — the proposer can skip the choke point, the quarantine flag is writable, rollback is free, and the evidence chain is forgeable with the hardcoded key. Seven corrections were applied in place, including a global relabel, safe rendering as an architectural point, quota governance, loopback authentication, an external monotonic floor, and a migration story for 456 MB of legacy rows.
|
||||
|
||||
Applicability: 50 rows (19/1/2/3/24/1). Qualification: 94 rows (82/4/1/5/2). R0: CONFIRMED 4 · REFINED 1 (Sum 5). Preliminary: CONFIRMED 6 · REFINED 2 (Sum 8). Claims: 15 (all ADOPT; elevels 1 RUNE_PROVEN / 14 RUNE_APPLICABLE). Sources: 82 rows / 78 unique (FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 38 · DOCUMENTATION_AUDITED 8 · CODE_AUDITED 1 · UNVERIFIED 5). Innovation: 25 (22 ADOPT, 3 ADAPT, 0 PARK). Nine honest gaps. Citation corrections: 20+ across arms (including four batched-artifact defects).
|
||||
Applicability: 50 rows (19/1/2/3/24/1). Qualification: 94 rows (82/4/1/5/2). R0: CONFIRMED 4 · REFINED 1 (Sum 5). Preliminary: CONFIRMED 6 · REFINED 2 (Sum 8). Claims: 15 (all ADOPT; elevels 1 RUNE_PROVEN / 14 RUNE_APPLICABLE). Sources: 83 rows / 79 unique (FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5; 106 labels). Innovation: 25 (22 ADOPT, 3 ADAPT, 0 PARK). Nine honest gaps (5 bounded-search + 4 unverified-this-run — distinct from evidence_saturation.md's 8 typed outcomes and §49's 14 remaining unknowns, 2 parked to #403/#405). Citation corrections: 20+ across arms (including four batched-artifact defects).
|
||||
|
||||
## 2. Inward reality (read-only security audit, 2026-09-22)
|
||||
|
||||
@@ -224,7 +224,7 @@ claims.json: 15 claims (all ADOPT), each with evidence_for/against, limitations,
|
||||
|
||||
## 50. Source-depth summary (mandate §91)
|
||||
|
||||
sources.md row truth (machine-derived): **82 ledger rows / 78 unique** (4 cross-arm duplicates counted once). Depth labels (gate parser, 2026-09-22 evidence-depth repair): **FULL_PAPER 2** (Axelsson 2000 TISSEC, full open-access text; Framing Gap arXiv:2608.27092, full HTML text — both read in full during the bounded repair top-up) · **RELEVANT_SECTIONS 9** (incl. TMA-NM, 2609.01873) · **ABSTRACT_ONLY 41** · **METADATA_VERIFIED 38** · **DOCUMENTATION_AUDITED 8** (Yama, unix(7), systemd-creds, dm-verity fully read as KERNEL/TOOL DOCUMENTATION; Kleppmann fencing-token essay fully read as PRACTITIONER material — read depth describes what was read, not what the source is; source TYPE and DEPTH are separate) · **CODE_AUDITED 1** · **UNVERIFIED 5** — label total 104 across 82 rows. **Depth honesty (explicit): FULL_PAPER exists only where an academic paper was genuinely read in full** — the injection/poisoning arms' 2025-26 preprints are abstract-verified; the classical security texts are paywalled/DTIC-only. **An unverifiable/do-not-cite register is maintained** (Pyshield; "Akash 2009.11890"; CAPTURE's 24.7%; "Trust No Bot"; "SPA 0–0.2%"; 2503.15478-as-TPA; 1807.05052-as-Uptane; IMA specifics; Miller 2006).
|
||||
sources.md row truth (machine-derived, final closeout 2026-09-22): **83 ledger rows / 79 unique** (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). Depth labels (gate parser): **FULL_PAPER 2** (Axelsson 2000 A3-8; Framing Gap A3-17 — both academic papers read in full during the evidence-depth repair's bounded top-up) · **RELEVANT_SECTIONS 9** (incl. TMA-NM, 2609.01873) · **ABSTRACT_ONLY 41** · **METADATA_VERIFIED 39** (incl. noWorkflow/ProvBook A3-27, Crossref/OpenAlex-verified at the final closeout) · **DOCUMENTATION_AUDITED 9** (Yama, unix(7), systemd-creds, dm-verity, Kleppmann practitioner essay, SLSA/Sigstore/NIST standards row — fully read as documentation/practitioner/standards, never mislabeled FULL_PAPER; source TYPE and DEPTH are separate) · **CODE_AUDITED 1** · **UNVERIFIED 5** — label total 106 across 83 rows. **Exact-reference discipline (final closeout):** every load-bearing citation token resolves EXACTLY to one ledger row (A3-17 = Framing Gap after the A3-15b split/rename defect was repaired; A3-16 = ClawSentry; the shifted tail A3-18–A3-24 re-pointed by identity; gate-enforced with negative controls NC-E/NC-F/NC-G CAUGHT, NC-H PASS). **Depth honesty (explicit): FULL_PAPER exists only where an academic paper was genuinely read in full** — the injection/poisoning arms' 2025-26 preprints are abstract-verified; the classical security texts are paywalled/DTIC-only. **An unverifiable/do-not-cite register is maintained** (Pyshield; "Akash 2009.11890"; CAPTURE's 24.7%; "Trust No Bot"; "SPA 0–0.2%"; 2503.15478-as-TPA; 1807.05052-as-Uptane; IMA specifics; Miller 2006).
|
||||
|
||||
## 51. Evidence saturation + load-bearing depth (mandate §93)
|
||||
|
||||
@@ -237,9 +237,9 @@ evidence_saturation.md: **SEARCH_SATURATION = REACHED** (25 branches; 8 typed ga
|
||||
- Source-access failures: Semantic Scholar/DBLP 429 rate limits (arms 2/3) → arXiv API/abs pages, Crossref, OpenAlex, NVD, USENIX substituted; IMA kernel doc 404 (recorded UNVERIFIED); DTIC volume-I accession unverified.
|
||||
- Saturation claimed on evidence (8 typed gaps), not because the arms ended.
|
||||
|
||||
## 53. Content-freeze mutation audit (mandate §101/§102)
|
||||
## 53. Content-freeze mutation audit (mandate §101/§102 + final closeout §15/§16)
|
||||
|
||||
Authoritative record: mutation_audit.md (CONTENT-FREEZE AUDIT, written LAST after all artifact/tooling/registry/session-note writes; TRUE-FREEZE discipline carried from #400/#401: if the final gate exposes a defect requiring mutation, the freeze is STALE → repair + NEW audit LAST + re-gate). Canonical Memory write (§100): see mutation_audit.md (intended ≠ executed). Two-phase closeout: all writes BEFORE freeze → CONTENT-FREEZE AUDIT → FINAL CONTENT GATE → SEAL COMMIT → push/mirror/verify → Gitea #402 closeout + #375 update → POST_CLOSEOUT_RECEIPT. No post-freeze session note.
|
||||
Authoritative record: mutation_audit.md (final-closeout version, written LAST; supersedes both prior audits). TRUE-FREEZE discipline carried from #400/#401 plus the final-closeout state machine: RESEARCH/REPAIR MUTATIONS → CANONICAL + DERIVED MEMORY WRITES → SESSION/REGISTRY/TOOLING ACCOUNTING → CONTENT-FREEZE AUDIT → FINAL CONTENT GATE → SEAL COMMIT → PUSH/MIRROR/VERIFY → GITEA RECEIPTS → STOP. **After the CONTENT-FREEZE AUDIT only read-only verification, the final gate, git commit, push, mirror, and Gitea transport/receipts are allowed**; canonical Memory writes, derived consolidation writes, session notes, artifact/registry/tooling edits are FORBIDDEN. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — a new mutation audit is required; no narrative claim overrides it. Canonical/derived-write accounting (final closeout): original #402 canonical write receipt 192685 (preserved); the evidence-depth repair's "write count 0" was INCOMPLETE closeout accounting — the verified post-seal writes (canonical entry 194015 superseding 193729, receipt 1515; derived fact-9293 in ~/.rune/consolidation/knowledge.json) are accounted in the final audit. THIS final repair: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0.
|
||||
|
||||
## 54. Experiments / falsifiers (mandate §94 — designed, NOT run)
|
||||
|
||||
|
||||
@@ -105,7 +105,7 @@
|
||||
"evidence_for": [
|
||||
"mandate §59/§78",
|
||||
"adversarial F4 SUCCEEDS (unguarded state machine)",
|
||||
"noWorkflow/ProvBook pattern (A3-17/A3-18): provenance captured but shown separately; same pattern applies to quarantine",
|
||||
"noWorkflow/ProvBook pattern (A3-27): provenance captured but shown separately; same pattern applies to quarantine",
|
||||
"MPBench/Salami: poisoned content must be identifiable, not deleted (would destroy evidence)"
|
||||
],
|
||||
"evidence_against": [
|
||||
@@ -176,8 +176,8 @@
|
||||
"id": "AA-R1-C008",
|
||||
"claim": "DELETION/ERASURE: TOMBSTONE (deletion fact/identifier/provenance) is distinct from DELETED PAYLOAD (content that may need actual removal). Crypto-erase (NIST SP 800-88 Rev.2) is the only practical primitive under SSD wear-leveling and journaling. Deletion must propagate to derived data (embeddings, caches, summaries) on a best-effort basis. Privacy-vs-provenance tension is real: erasure (GDPR Art. 17) vs accountability (Art. 5(2)) is unresolved; provenance fields on tombstones may leak deleted content. Tombstone visibility vs erasure is #401's cross-flag to this domain.",
|
||||
"evidence_for": [
|
||||
"NIST SP 800-88 Rev.2 (A3-23): crypto-erase as the practical primitive under wear-leveling",
|
||||
"GDPR Art. 17 + Art. 5(2) (normative, A3-23)",
|
||||
"NIST SP 800-88 Rev.2 (A3-24): crypto-erase as the practical primitive under wear-leveling",
|
||||
"GDPR Art. 17 + Art. 5(2) (normative, A3-24)",
|
||||
"adversarial AU/W/X pass; #401 cross-flag on provenance display leaking deleted content",
|
||||
"inward B2: delete_entry is a hard delete with NO tombstone today"
|
||||
],
|
||||
@@ -252,7 +252,7 @@
|
||||
"id": "AA-R1-C011",
|
||||
"claim": "PROVIDER BOUNDARY: provider access ends at the explicitly authorized interface. PROVIDER ACCESS ENDS AT THE EXPLICITLY AUTHORIZED INTERFACE — a provider must not gain implicit access to filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, or Substrate control merely because Rune queried its model. LEAST-CONTEXT DISCLOSURE: minimum necessary fields sent; disclosure record kept (provider/model/categories/why/sensitivity/time). Destination allow-lists and capability splits are the only empirically demonstrated near-zero exfiltration defenses. Model output = UNTRUSTED SEMANTIC PROPOSAL until independently verified or specifically authorized.",
|
||||
"evidence_for": [
|
||||
"Framing Gap 2608.27092 (A3-15): destination allow-lists close 0%→100% exfil attacks; model-side recognition fails",
|
||||
"Framing Gap 2608.27092 (A3-17): destination allow-lists close 0%→100% exfil attacks; model-side recognition fails",
|
||||
"FLOWSEAL 2609.14003 (A1-20): tool-level interceptor; leak 52.2%→0.5%",
|
||||
"Claw in Plain Sight 2608.20658 (A3-14): 20.8-75.0% policy-violating disclosure across pressure/policy levels",
|
||||
"CaMeL 2503.18813 (A1-18): capability labels enforced at tool calls",
|
||||
@@ -279,8 +279,8 @@
|
||||
"claim": "WORKER/DISTRIBUTED AUTHORITY: workers provide evidence and proposals but NEVER inherit Main Rune authority automatically. Fencing tokens (strictly monotonic counter checked by the storage server, rejecting regressions) govern stale-write rejection. Authority generations prevent stale workers from writing after authority changed. Per-agent proof-of-possession keys + chained delegation assertions. Protocol participation, worker name, PID, or old credential alone grants nothing.",
|
||||
"evidence_for": [
|
||||
"Kleppmann 2016 (A3-2): fencing tokens; leases cannot be made safe by re-checking expiry",
|
||||
"A-JWT 2509.13597 (A3-18): per-agent PoP keys + chained delegation + one-way identity hashes",
|
||||
"Multi-agent boundary verification 2608.00718 (A3-19): pipelines lack boundary verification; attack success tracks pipeline STRUCTURE not model capability",
|
||||
"A-JWT 2509.13597 (A3-19): per-agent PoP keys + chained delegation + one-way identity hashes",
|
||||
"Multi-agent boundary verification 2608.00718 (A3-20): pipelines lack boundary verification; attack success tracks pipeline STRUCTURE not model capability",
|
||||
"inward K: no worker identity/auth/fencing implemented; workers inherit ambient authority",
|
||||
"adversarial AE/AF/AG pass; EA-EE/EC/ED pass"
|
||||
],
|
||||
@@ -308,7 +308,7 @@
|
||||
"inward F: no Substrate security state exists",
|
||||
"adversarial EQ/ER/ES/ET/EU pass (security state ≠ persona, ≠ canonical, ≠ emotion)",
|
||||
"arm-1 P6: dedicated uid + SO_PEERCRED is the real boundary",
|
||||
"agent libOS 2606.03895 (A3-17): 3-plane design (operation admission/IFC admission/durable evidence)"
|
||||
"agent libOS 2606.03895 (A3-18): 3-plane design (operation admission/IFC admission/durable evidence)"
|
||||
],
|
||||
"evidence_against": [
|
||||
"no Substrate security state is implemented; the view is designed only",
|
||||
|
||||
@@ -6,15 +6,15 @@
|
||||
| AA-R1-C002 | content/control separation; enforce at sink | indirect prompt injection; tool-output injection | 01_inward: no authorization exists | CaMeL 2503.18813; FLOWSEAL 2609.14003; SPA 2608.27234; APPA 2607.24625; Nasr 2510.09023 (12 defenses >90% adaptive); Greshake 2302.12173; Design Patterns 2506.08837 | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + DEEP_EXTERNAL | in-process = policy discipline; cognition steering below action threshold | untrusted content grants authority through the intended architecture |
|
||||
| AA-R1-C003 | proposal/authorization separation; deterministic authorize() | model-generated proposals; worker proposals; confused deputy | 01_inward B: no write auth exists | Clark-Wilson 1987 (A1-3); Anderson 1972 (A1-8); Hardy 1988 (A1-7) | METADATA/ABSTRACT | DESIGN_INVARIANT (A1-3 CW is METADATA depth) | choke point bypassable at same uid | model output shown to bypass authorize() |
|
||||
| AA-R1-C004 | write-time origin binding; taint JOIN; dedupe preserves provenance | provenance laundering; salami; dedupe corruption | 01_inward C: source is free-text mutable | TMA-NM 2606.24322 (A2-29 RELEVANT_SECTIONS); Epistemic Sybil 2609.01873 (A2-26 RELEVANT_SECTIONS); Salami 2608.01637 (A2-19 ABSTRACT_ONLY) | RELEVANT_SECTIONS | DEEP_EXTERNAL | bootstrapping problem for 941 legacy rows | laundered provenance passes through summarization/merge |
|
||||
| AA-R1-C005 | quarantine as first-class state | poisoned memory; suspect imports | 01_inward: no quarantine exists | noWorkflow/ProvBook (A3-17/18); adversarial F4 | ABSTRACT | DESIGN_INVARIANT | quarantine transitions need enforcement | quarantined content still affects application |
|
||||
| AA-R1-C005 | quarantine as first-class state | poisoned memory; suspect imports | 01_inward: no quarantine exists | noWorkflow/ProvBook (A3-27); adversarial F4 | ABSTRACT | DESIGN_INVARIANT | quarantine transitions need enforcement | quarantined content still affects application |
|
||||
| AA-R1-C006 | crypto by property | corruption; tampering; rollback; key theft | 01_inward: no crypto exists | Crosby & Wallach USENIX 2009 (A3-3); Schneier & Kelsey 1999 (A3-4 DOI corrected); TUF CCS 2010 (A3-5); Uptane IEEE VT 2018 (A3-6); NIST SP 800-57 (A3-1) — corroborating (metadata depth) | METADATA | DESIGN_INVARIANT | key custody is a precondition | mechanism fails to provide its selected property |
|
||||
| AA-R1-C007 | key custody honesty | same-uid malware; root | 01_inward I: auth.json + /proc environ exposure | arm-1 key-custody matrix (A1-13/14/15/16); NIST SP 800-57 (A3-1) | DOCUMENTATION_AUDITED/METADATA | DESIGN_INVARIANT + RUNE_DIRECT | | desktop limits available hardware | same-uid process unable to read a protected secret |
|
||||
| AA-R1-C008 | tombstone vs payload; crypto-erase | retention; accidental deletion; compliance | 01_inward B2: hard delete, no tombstone | NIST SP 800-88r2 (A3-23); GDPR Art 17/5(2) (normative) | METADATA | DESIGN_INVARIANT | derived-data deletion is best-effort | UI claims erased while payload is reachable |
|
||||
| AA-R1-C008 | tombstone vs payload; crypto-erase | retention; accidental deletion; compliance | 01_inward B2: hard delete, no tombstone | NIST SP 800-88r2 (A3-24); GDPR Art 17/5(2) (normative) | METADATA | DESIGN_INVARIANT | derived-data deletion is best-effort | UI claims erased while payload is reachable |
|
||||
| AA-R1-C009 | authorization / reference monitor | model proposals; confused deputy | 01_inward J: ambient tool authority | Anderson 1972 (A1-8); Hardy 1988 (A1-7); Design Patterns (A3-10) | ABSTRACT/METADATA | DESIGN_INVARIANT | in-process = policy discipline | model output directly mutates canonical state |
|
||||
| AA-R1-C010 | detection discipline; FPR-first; typed states | persistent injection; poisoning; DoS | 01_inward: no IDS exists | Axelsson 2000 (A3-8 FULL_PAPER — bronze OA PDF read: P(I)=2e-5, FPR 1e-5 → detection rate 66%, FPR 1e-3 → ~2%); Denning 1987 (A3-7); ClawSentry 2608.21101 (A3-16) | FULL_PAPER/METADATA/ABSTRACT | DEEP_EXTERNAL (Axelsson) | FPR calibration data thin | anomaly elevates to CONFIRMED without corroboration |
|
||||
| AA-R1-C011 | provider boundary; least-context; destination allow-lists | prompt-injection exfil; compromised provider | 01_inward I: auth.json 0600; no per-call disclosure record | Framing Gap 2608.27092 (A3-15b FULL_PAPER — HTML full text read: 10 overt frames all 0% on gpt-4o; reframing 0%→100%; destination allow-list 0% by construction; planner/reader split 0% at 90% utility); FLOWSEAL (A1-20); CaMeL (A1-18); Claw 2608.20658 (A3-14) | FULL_PAPER/ABSTRACT | DEEP_EXTERNAL (A3-15) | utility trade-off unmeasured | provider response carries filesystem/Memory/tool authority |
|
||||
| AA-R1-C012 | worker fencing; authority generations | stale worker; impersonation; replay | 01_inward K: no fencing exists | Kleppmann 2016 (A3-2 DOCUMENTATION_AUDITED — fully read but practitioner); A-JWT 2509.13597 (A3-18); Bappy 2608.00718 (A3-19) | DOCUMENTATION_AUDITED/ABSTRACT | DESIGN_INVARIANT | same-uid fencing is policy discipline | stale authority accepted by the store |
|
||||
| AA-R1-C013 | Substrate security awareness; authorized-actor view | rogue agent; impersonation; persistence | 01_inward F: no security state exists | Agent libOS 2606.03895 (A3-17); mandate §40-42 | ABSTRACT | DESIGN_INVARIANT | view is derived; could be stale/incomplete | protocol fluency grants authority, or the view becomes canonical |
|
||||
| AA-R1-C011 | provider boundary; least-context; destination allow-lists | prompt-injection exfil; compromised provider | 01_inward I: auth.json 0600; no per-call disclosure record | Framing Gap 2608.27092 (A3-17 FULL_PAPER — HTML full text read: 10 overt frames all 0% on gpt-4o; reframing 0%→100%; destination allow-list 0% by construction; planner/reader split 0% at 90% utility); FLOWSEAL (A1-20); CaMeL (A1-18); Claw 2608.20658 (A3-14) | FULL_PAPER/ABSTRACT | DEEP_EXTERNAL (A3-15) | utility trade-off unmeasured | provider response carries filesystem/Memory/tool authority |
|
||||
| AA-R1-C012 | worker fencing; authority generations | stale worker; impersonation; replay | 01_inward K: no fencing exists | Kleppmann 2016 (A3-2 DOCUMENTATION_AUDITED — fully read but practitioner); A-JWT 2509.13597 (A3-19); Bappy/Multi-agent boundary 2608.00718 (A3-20) | DOCUMENTATION_AUDITED/ABSTRACT | DESIGN_INVARIANT | same-uid fencing is policy discipline | stale authority accepted by the store |
|
||||
| AA-R1-C013 | Substrate security awareness; authorized-actor view | rogue agent; impersonation; persistence | 01_inward F: no security state exists | Agent libOS 2606.03895 (A3-18); mandate §40-42 | ABSTRACT | DESIGN_INVARIANT | view is derived; could be stale/incomplete | protocol fluency grants authority, or the view becomes canonical |
|
||||
| AA-R1-C014 | safe rendering; input validation | terminal escape; markup injection; hostile Markdown | 01_inward O: RichLog(markup=True) | Greshake 2302.12173 (A2-1); MCPTox (A2-11); WCAG 2.2 (carried from #401) | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + RUNE_DIRECT | research-only prevents live testing | hostile markup executes in the TUI |
|
||||
| AA-R1-C015 | scope honesty; bounded security | root; kernel; firmware; provider-internal; side-channel | 01_inward: 8 ABSENT mechanisms; 3 BYPASS paths | arm-1 transfer failures (10 items); NIST SP 800-57 (A3-1) | METADATA/ABSTRACT | DESIGN_INVARIANT + RUNE_DIRECT | honest scope is not a defense; it is a prerequisite | a mechanism claimed to survive process compromise when it cannot |
|
||||
|
||||
|
||||
@@ -1,55 +1,76 @@
|
||||
# #402 AA — MUTATION AUDIT / CONTENT-FREEZE (evidence-depth repair, 2026-09-22)
|
||||
# #402 AA — FINAL CLOSEOUT MUTATION AUDIT (provenance-ID + post-freeze accounting, 2026-09-22)
|
||||
|
||||
Written LAST — this audit is the final research-artifact/accounting/registry/tooling write before FINAL_CONTENT_GATE. Supersedes the original-seal audit of the same filename. TRUE-FREEZE discipline (carried #400/#401): if the final gate exposes a defect requiring mutation, the freeze is STALE → repair → NEW audit LAST → re-gate.
|
||||
Written LAST — this audit supersedes the audits sealed at `eef6ae4` and `8564009`. It is the final research-artifact/accounting/registry/tooling write before FINAL_CONTENT_GATE. TRUE-FREEZE discipline carried from #400/#401: if the final gate exposes a defect requiring mutation, the freeze is STALE → repair → NEW audit LAST → re-gate.
|
||||
|
||||
## Repair scope (mandate: bounded evidence-depth / load-bearing / arithmetic repair)
|
||||
## Post-freeze protocol (mandate §15/§16 — encoded, not remembered)
|
||||
|
||||
BASE SEAL: eef6ae4 (MEMORY_ATLAS_R1_AA_SEALED — substantive research + architecture ACCEPTED; final clean seal pending this repair). No broad research reopened; no adversarial arm dispatched; no architecture redesigned; no production changes.
|
||||
Closeout state machine: RESEARCH/REPAIR MUTATIONS → CANONICAL + DERIVED MEMORY WRITES → SESSION/REGISTRY/TOOLING ACCOUNTING → CONTENT-FREEZE AUDIT → FINAL CONTENT GATE → SEAL COMMIT → PUSH/MIRROR/VERIFY → GITEA RECEIPTS → STOP.
|
||||
|
||||
RESEARCH_ARTIFACT_MUTATION = YES (bounded) — files mutated in this repair, in order:
|
||||
1. sources.md — semantic depth repair: FULL_TEXT→FULL_PAPER normalization reverted; Yama/unix(7)/systemd-creds/dm-verity → DOCUMENTATION_AUDITED (kernel/tool docs, fully read but documentation); Kleppmann → DOCUMENTATION_AUDITED (practitioner essay, fully read but practitioner); ledger header + separator inserted (gate parser requires it); A3-15b ID fixed to gate convention; two new rows from the bounded top-up actor (Axelsson FULL_PAPER, Framing Gap FULL_PAPER). Row truth: 82 rows / 78 unique.
|
||||
2. load_bearing_evidence.md — support/depth consistency: C003 DEEP_EXTERNAL removed (metadata-depth anchors; DESIGN_INVARIANT + RUNE_DIRECT retained); C010 DEEP_EXTERNAL earned via Axelsson FULL_PAPER; C011 DEEP_EXTERNAL earned via Framing Gap FULL_PAPER; C006 correction from the original run PRESERVED (DEEP_EXTERNAL → DESIGN_INVARIANT, verified present); C012 practitioner evidence honestly labeled; every C001–C015 row audited support↔source↔type↔depth↔proposition.
|
||||
3. 04_innovation.md — footer corrected to mechanically parsed truth: 25 rows = ADOPT 22 · ADAPT 3 (T, U, W) · PARK 0.
|
||||
4. AA_SECURITY_MEMORY_POISONING_R1_MASTER.md — §1 aggregate (sources 82/78; innovation 25 = 22/3/0), §43 innovation arithmetic (mechanical, not hard-coded), §50 source-depth summary rewritten (FULL_PAPER 2 with named sources; DOCUMENTATION_AUDITED 8; 104 labels/82 rows), §15-adjacent encryption wording made exact (full-disk vs field/envelope distinction), stale "81/77" occurrences swept.
|
||||
5. evidence_saturation.md — LOAD_BEARING_DEPTH = PASS re-stated as RE-EARNED (2026-09-22) after row-by-row re-audit + gate hardening; SEARCH_SATURATION unchanged = REACHED.
|
||||
6. reconciliation_arithmetic_check.txt — innovation total now DERIVED from 04_innovation.md rows (no hard-coded 22/2/1); source-ledger line corrected to 82 rows — 78 unique; depth labels machine-derived.
|
||||
7. domain_registry.md — #402 row source/depth/innovation figures synchronized.
|
||||
8. scripts/research_gate_check.py — TWO new structural-semantic checks: (a) DEEP_EXTERNAL support requires a resolved cited anchor at FULL_PAPER or RELEVANT_SECTIONS (not ABSTRACT_ONLY/METADATA_VERIFIED/DOCUMENTATION_AUDITED/CODE_AUDITED/UNVERIFIED); (b) documentation-as-paper sanity check (kernel-doc/man-page/systemd/tool-doc type with FULL_PAPER depth = FAIL). Both scoped to the strengthened-schema map (AA-); negative controls below. `_LBM_DOMAINS`/`_REPAIR_DOMAINS` extended to `AA-`.
|
||||
**After the CONTENT-FREEZE AUDIT, allowed:** read-only verification, the final content gate, `git commit`, push, mirror/copy of sealed bytes, Gitea transport/reference/receipt. **FORBIDDEN:** canonical Memory writes (`memory_store.py add/update/delete`), derived Memory/consolidation writes (`memory_consolidation.py consolidate-fact` or equivalent), session-note writes, research-artifact edits, registry edits, gate/tooling edits, production/state edits. The controller must NOT perform a "durable memory write" as a celebratory/housekeeping step after closeout — that action belongs BEFORE freeze or not at all.
|
||||
|
||||
NEGATIVE CONTROLS (all run and restored byte-identically):
|
||||
- NC-A shallow-DEEP_EXTERNAL: DEEP_EXTERNAL set on a row whose anchors are ABSTRACT/METADATA only → **GATE FAIL (CAUGHT)**.
|
||||
- NC-B documentation-as-paper: unix(7) DOCUMENTATION_AUDITED → FULL_PAPER → **GATE FAIL (CAUGHT)**.
|
||||
- NC-C valid DESIGN_INVARIANT (shallow corroborating literature) → **GATE PASS** (repair does not force ceremony papers).
|
||||
- NC-D real DEEP_EXTERNAL (Axelsson FULL_PAPER) → **GATE PASS**.
|
||||
**Invalidation rule:** if ANY forbidden post-freeze write occurs, **FREEZE_STALE = TRUE automatically**. No narrative claim may override it. A new mutation audit is required before resealing. Enforced by the gate's `check_post_freeze_protocol` (this section must exist in every AA- closeout audit).
|
||||
|
||||
BOUNDED TOP-UP ACTOR = 1 (general-16, within the ≤1 limit): deepened exactly two load-bearing anchors — Axelsson 2000 (ACM TISSEC 3(3):186–205, full open-access PDF: base-rate formula, numeric example P(I)=2·10⁻⁵, 66% Bayesian detection rate at FPR 1e-5, ~2% at FPR 1e-3, "suppress false alarms" design priority) and Framing Gap arXiv:2608.27092 (full HTML: threat model, 6 models, ten overt frames all 0% on gpt-4o, reframing J4/J7 →100%, allow-list 0% by construction, planner/reader split 0% at 90% utility, limitations). Exact sections persisted in sources.md + load_bearing_evidence.md.
|
||||
## Why this audit exists (base seal 8564009 NOT accepted as final)
|
||||
|
||||
TOOLING_MUTATION = YES — scripts/research_gate_check.py as item 8 above.
|
||||
Two defects found in the 8564009 state:
|
||||
1. **Source-reference integrity:** the A3-15b → A3-16 rename in the evidence-depth repair created a DUPLICATE A3-16 (Framing Gap colliding with ClawSentry), skipped A3-17, left the shifted tail (A3-18–A3-24) with stale references, and three artifacts cited "noWorkflow/ProvBook (A3-17/18)" — a source that never existed in any ledger.
|
||||
2. **Post-freeze writes:** after mutation_audit.md + FINAL_CONTENT_GATE + seal 8564009 + pushes + Gitea receipts 6084/6086, the controller executed `memory_store.py add` and `memory_consolidation.py consolidate-fact` while recording `CANONICAL_MEMORY_WRITE_THIS_REPAIR = 0` and "all mutations complete BEFORE this audit" — both statements were FALSE as accounting. **FREEZE_STALE = TRUE.**
|
||||
|
||||
## Row truth at freeze (machine-derived)
|
||||
## Repair 1 — source-ID integrity (mandate §2–§6)
|
||||
|
||||
applicability 50 = ADOPT 19 · ADAPT 1 · EXPERIMENT 2 · FUTURE 3 · REJECT 24 · PARK 1 · qualification 94 = ADOPT 82 · ADAPT 4 · FUTURE 1 · REJECT 5 · PARK 2 · adversarial 170 = SUCCEEDS 30 · PARTIAL 30 · FAILS 110 · R0 5 = CONFIRMED 4 · REFINED 1 · preliminary 8 = CONFIRMED 6 · REFINED 2 · claims 15 = ADOPT 15 (IDs AA-R1-C001…C015) · evidence levels = RUNE_PROVEN 1 · RUNE_APPLICABLE 14 · sources 82 rows / 78 unique · depth = FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 38 · DOCUMENTATION_AUDITED 8 · CODE_AUDITED 1 · UNVERIFIED 5 (104 labels / 82 rows) · innovation 25 = ADOPT 22 · ADAPT 3 · PARK 0 · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS (re-earned) · nine honest gaps recorded.
|
||||
Ledger verified mechanically: 83 rows, **0 duplicate IDs after repair**, 4 deliberately recorded cross-arm identity duplicates counted once (FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10) → **79 unique**.
|
||||
|
||||
## Preserved (mandate §14 — verified unregressed)
|
||||
Canonical mapping (resolved by identity, not by blind renumbering):
|
||||
- A3-15 = ContextLeak/SkillWatermark (2608.27800 / 2608.16026) · **A3-16 = ClawSentry** (2608.21101) · **A3-17 = Framing Gap** (2608.27092, FULL_PAPER — renamed from the duplicate A3-16; the skipped slot taken) · A3-18 = Agent libOS · A3-19 = A-JWT · A3-20 = Multi-agent boundary verification · A3-23 = MCP spec · A3-24 = SLSA/Sigstore/SP 800-88r2/SP 800-53 · **A3-27 = noWorkflow/ProvBook (NEW)**.
|
||||
|
||||
All claim IDs AA-R1-C001…C015 · preliminary 6 CONFIRMED / 2 REFINED · applicability 50 (19/1/2/3/24/1) · R0 4 CONFIRMED / 1 REFINED · claims 15 all ADOPT (1 RUNE_PROVEN / 14 RUNE_APPLICABLE) · adversarial 170 (30/30/110) · substantive architecture untouched (content/control separation; authorize() choke point as POLICY DISCIPLINE; write-time origin binding + taint JOIN; quarantine; Sybil-resistant evidence-root counting; crypto by property; external monotonic counter; key-custody honesty; worker fencing; provider boundary + destination allow-lists; deterministic-violation vs anomaly split; typed compromise states; evidence-based clearance; safe rendering; bounded scope honesty).
|
||||
References re-pointed BY IDENTITY (24 substitutions, each asserted unique): load_bearing_evidence.md ×5 (C005→A3-27; C008 800-88r2→A3-24; C011 Framing Gap→A3-17; C012 A-JWT→A3-19 + Bappy→A3-20; C013 Agent libOS→A3-18) · claims.json ×7 · 03_applicability.md ×4 · 04_innovation.md ×8 (incl. the PHANTOM citation "arm-3 Sagas (A3-6)" removed — A3-6 is Uptane and no Sagas row exists; re-pointed to the #401 arm-3 ledger where the Sagas/Berlage/Sun anchors live) · 06_synthesis.md verified already-correct.
|
||||
|
||||
## Depth honesty statement
|
||||
New ledger row A3-27 (identity verified NOW, not guessed): noWorkflow = Murta/Chirigati/Koop, "noWorkflow: Capturing and Analyzing Provenance of Scripts", IPAW/LNCS 2015, **DOI 10.1007/978-3-319-16462-5_6 Crossref-verified 2026-09-22**; ProvBook = Samuel & König-Ries 2018, "ProvBook: Provenance-based Semantic Enrichment of Interactive Notebooks for Reproducibility", **OpenAlex W2898837379** (no DOI registered). Depth = METADATA_VERIFIED (metadata verified this session; full texts not read). noWorkflow/ProvBook is pattern evidence (provenance captured but shown separately), not an enforcement mechanism — recorded as such.
|
||||
|
||||
FULL_PAPER = exactly two academic papers genuinely read in full (Axelsson 2000; Framing Gap 2608.27092), both added during this repair's bounded top-up. Kernel/systemd/man pages and the Kleppmann practitioner essay are DOCUMENTATION_AUDITED — fully read, honestly labeled; source TYPE and DEPTH are separate and no mechanism's confidence was lowered by correct classification. The DO-NOT-CITE register (8 items) is preserved. Zero FULL_PAPER for the injection/poisoning arms remains honest: 2025-26 preprints are abstract-verified.
|
||||
Depth-label normalization completed (evidence-depth repair residue): A3-24's standards row carried the non-canonical label "V1/V2" → DOCUMENTATION_AUDITED. Depth counts legitimately altered by exact repair: **FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5 = 106 labels / 83 rows / 79 unique**. No mechanism's confidence was lowered.
|
||||
|
||||
## Process truth (this repair)
|
||||
Stale accounting prose repaired: sources.md "## Depth summary" claimed "~128 rows; 127 unique" against an 83-row ledger — rewritten to per-arm mechanical truth (A1=25, A2=31, A3=27; adversarial introduced no new sources).
|
||||
|
||||
AA_EVIDENCE_DEPTH_REPAIR_CONTINUOUS_EXECUTION = PASS — zero user continuations; MAX_CONCURRENT_SUBAGENTS = 1 (exactly one bounded actor, general-16); no provider-capacity faults; negative controls restored byte-identically. Original #402 process truth PRESERVED (not rewritten): CONTINUOUS_EXECUTION = PASS, four serial actors (general-12→15), zero user continuations.
|
||||
## Repair 2 — gate hardening (mandate §5–§7)
|
||||
|
||||
## Canonical memory
|
||||
`scripts/research_gate_check.py`: NEW `check_source_reference_resolution` (AA-scoped) — (a) any citation token carrying a suffix (e.g. A3-17b) that is not an exact ledger ID FAILS (no truncation); (b) any token not resolving exactly to one row FAILS (explicit cross-domain pointers "(A3-16 from #401)" exempted); (c) duplicate ledger IDs FAIL; (d) identity adjacency — a citation "NAME <arXiv/DOI> … (A3-NN)" must resolve to a row whose identity cells contain that identifier. The pre-existing `check_load_bearing_depth_map` anchor extraction hardened from partial `A\d+-\d+` to exact `\b(A\d+-\d+[a-z]?)\b`. NEW `check_post_freeze_protocol`: every AA- closeout audit must encode the FORBIDDEN post-freeze write classes and the automatic FREEZE_STALE rule.
|
||||
|
||||
Original verified receipt PRESERVED: 192685, decision = SUPERSEDED, prior_id = 192393, similarity 0.79. **CANONICAL_MEMORY_WRITE_THIS_REPAIR = 0** — read-depth labels/arithmetic are evidence governance, not a substantive architecture conclusion; no collapse target invented.
|
||||
**Negative controls (all run, restored byte-identically):** NC-E suffix (A3-17b) **CAUGHT** · NC-F stale-old-ID (Framing Gap → A3-15; identity 2608.27092 absent from that row) **CAUGHT** · NC-G duplicate ID (two A3-16 rows) **CAUGHT** · NC-H valid exact references (Framing Gap A3-17 + Axelsson A3-8) **PASS**.
|
||||
|
||||
## Encryption wording (mandate §15)
|
||||
## Repair 3 — post-freeze write verification (mandate §8–§11, observed persisted state, read-only)
|
||||
|
||||
Made exact, not redesigned: full-disk encryption primarily protects powered-off/stolen media; field/envelope encryption may add confidentiality depending on key separation (different-uid broker, external custody, hardware backing); encryption never protects data already decrypted for or legitimately accessible to a compromised principal.
|
||||
**memory_store.py add (executed 2026-09-22T19:20:52Z, AFTER seal 8564009):** DURABLE CANONICAL MUTATION CONFIRMED — entry **194015 created, status active**, topic project, importance 0.8; dedupe receipt **1515**, decision **superseded**, prior_id **193729**, similarity 0.80; prior entry 193729 (#395 T distributed/multi-instance summary) **flipped active → superseded**. Note: the write superseded the WRONG prior entry's slot (#395's summary, not #402's own canonical row) — the similarity threshold matched across domains; recorded, not repaired (§11: no write-after-write cleanup loop). #402's canonical entry 192685 was NOT touched by this write.
|
||||
|
||||
**memory_consolidation.py consolidate-fact (executed 2026-09-22T19:22:57Z, AFTER seal 8564009):** DURABLE DERIVED-STATE MUTATION CONFIRMED — record **fact-9293** created in `~/.rune/consolidation/knowledge.json` (7978 → 7979 records), category "fact", confidence 0.7, content = the #402 evidence-depth-repair summary; knowledge.json mtime 19:22:57Z matches. This is a derived projection, not canonical evidence — but the freeze protocol counts durable state/accounting writes, so it counts as a post-freeze write.
|
||||
|
||||
**Accounting correction (mandate §12):** the 8564009 audit's "CANONICAL_MEMORY_WRITE_THIS_REPAIR = 0" was true only of the repair window and INCOMPLETE as closeout accounting — both post-seal writes are now recorded above with exact receipts.
|
||||
|
||||
## Canonical/derived write ledger (exact counts)
|
||||
|
||||
- ORIGINAL #402 canonical write: receipt **192685**, decision superseded, prior_id 192393, similarity 0.79 — PRESERVED historical fact, untouched.
|
||||
- EVIDENCE-DEPTH REPAIR (8564009) claimed write count: **0** — now recognized as INCOMPLETE closeout accounting (see Repair 3).
|
||||
- POST-SEAL memory_store.py result: entry 194015 created active; entry 193729 superseded; dedupe receipt 1515.
|
||||
- POST-SEAL consolidate-fact result: fact-9293 created in knowledge.json (derived projection).
|
||||
- **CANONICAL_MEMORY_WRITE_THIS_FINAL_REPAIR = 0** — no canonical Memory writer called during this repair.
|
||||
- **DERIVED_MEMORY / CONSOLIDATION_WRITE_THIS_FINAL_REPAIR = 0** — no consolidation writer called during this repair.
|
||||
- Per mandate §11: the stale 194015/fact-9293 entries keep their provenance; NO cleanup write was performed.
|
||||
|
||||
## Gap-count terminology (mandate §13 — exact populations, no forced single number)
|
||||
|
||||
- **EVIDENCE_SATURATION_TYPED_GAPS = 8** — canonical rows: evidence_saturation.md "Late-search checks" (5 research-space gaps: FIDO2/WebAuthn agent approval; policy-as-code for agents; approval-habituation study; agent-memory deletion semantics; signed model releases + 3 do-not-cite/unverifiable citation outcomes: Pyshield; "Trust No Bot"/"SPA 0–0.2%"; CAPTURE 24.7%).
|
||||
- **HONEST_GAPS = 9** — the master aggregate: the same 5 research-space gaps + 4 unverified-in-this-run normative/documentation items (MCP OAuth 2.1 draft details; MITRE ATLAS tactic IDs; IMA/EVM specifics; provider retention behavior).
|
||||
- **REMAINING_UNKNOWNS = 14** — canonical rows: master §49 bullets (superset; adds the measured-impossible items — same-uid boundary, FPR/FN calibration, clearance evidence, legacy-row migration, quota calibration — and 2 additional unverifiables).
|
||||
- **PARKED_TO_LATER_DOMAIN = 2** — subset of §49: multimodal content security → #403; hardware isolation (TPM/HSM/namespaces) → #405.
|
||||
Master aggregate, registry, and this audit now name which population each number refers to.
|
||||
|
||||
## Preserved (verified unregressed)
|
||||
|
||||
Substantive architecture (all 25 listed elements) · applicability 50 = 19/1/2/3/24/1 · qualification 94 = 82/4/1/5/2 · adversarial 170 = SUCCEEDS 30 · PARTIAL 30 · FAILS 110 · R0 5 = 4C/1R · preliminary 8 = 6C/2R · claims 15 all ADOPT (AA-R1-C001…C015; elevels 1 RUNE_PROVEN / 14 RUNE_APPLICABLE) · innovation 25 = ADOPT 22 · ADAPT 3 (T, U, W) · PARK 0 · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS (re-earned at 8564009, re-verified this repair) · encryption wording exact · batched preliminary byte-preserved (sha 97a4c051…79f4581).
|
||||
|
||||
## Process truth
|
||||
|
||||
**AA_FINAL_CLOSEOUT_CONTINUOUS_EXECUTION = PASS** — controller-only (mandate §17: MAX_CONCURRENT_SUBAGENTS = 0; no research actor dispatched; the only external calls were Crossref/OpenAlex identity verifications for the A3-27 row); zero user continuations; no provider-capacity faults. Original #402 process truth and the 8564009 repair's process truth PRESERVED, not rewritten.
|
||||
|
||||
## Freeze declaration
|
||||
|
||||
All mutations complete BEFORE this audit. This audit is the ACTUAL LAST write. Next: FINAL_CONTENT_GATE (AA + Z/Y/X/W regression) → SEAL COMMIT → push/mirror/verify → corrected Gitea #402 receipt + #375 → token. No post-freeze content/session/tooling write.
|
||||
All mutations complete BEFORE this audit: sources.md (A3-17 rename, A3-27 row, A3-24 label, depth summary) · load_bearing_evidence.md · claims.json · 03_applicability.md · 04_innovation.md · master (§1 aggregate, §50, §53, gap terminology) · domain_registry.md · reconciliation_arithmetic_check.txt (+ final-closeout addendum) · gate tooling (2 new checks). **This audit is the ACTUAL LAST write.** Next: FINAL_CONTENT_GATE (AA + Z/Y/X/W regression) → seal commit → push/mirror/verify → corrected Gitea #402 + #375 receipts → STOP. No post-freeze canonical/derived Memory write, session note, artifact edit, registry edit, or tooling edit.
|
||||
+7
-2
@@ -7,5 +7,10 @@ preliminary: 8 rows — CONFIRMED 6 · REFINED 2 — Sum 8
|
||||
adversarial: 170 rows — SUCCEEDS 30 · PARTIAL 30 · FAILS 110 — Sum 170 (arm-4 fresh-context; mandated A-EZ + fresh F1-F12)
|
||||
claims: 15 rows — ADOPT 15 — Sum 15
|
||||
evidence levels: RUNE_PROVEN 1 · RUNE_APPLICABLE 14 — Sum 15
|
||||
source ledger: 82 rows — 78 unique
|
||||
source depth labels (machine-derived): ABSTRACT_ONLY 41 · CODE_AUDITED 1 · DOCUMENTATION_AUDITED 8 · METADATA_VERIFIED 39 · RELEVANT_SECTIONS 9 · UNVERIFIED 5 — label total 103 across 81 rows.
|
||||
source ledger: 83 rows — 79 unique (4 cross-arm identity duplicates counted once)
|
||||
source depth labels (machine-derived): FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5 — label total 106 across 83 rows.
|
||||
|
||||
FINAL CLOSEOUT ADDENDUM (2026-09-22, provenance repair):
|
||||
- innovation total DERIVED from 04_innovation.md rows: 25 = ADOPT 22 · ADAPT 3 · PARK 0 (no hard-coded totals)
|
||||
- all load-bearing source references resolve EXACTLY to one ledger row (A3-17 Framing Gap; A3-16 ClawSentry; shifted tail re-pointed by identity; noWorkflow/ProvBook added as A3-27)
|
||||
- gap-count populations: EVIDENCE_SATURATION_TYPED_GAPS = 8 (evidence_saturation.md Late-search checks) · HONEST_GAPS = 9 (5 bounded-search + 4 unverified-this-run) · REMAINING_UNKNOWNS = 14 (master §49, incl. 2 PARKED_TO_LATER_DOMAIN: multimodal→#403, hardware isolation→#405)
|
||||
@@ -79,7 +79,7 @@ Read-depth values: FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE
|
||||
| A3-13 | FLOWSEAL (detailed) | — | 2025/26 | arXiv:2609.14003 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 new attacks bypass prompt-based privacy defenses; leak 52.2%→0.5% | high | — |
|
||||
| A3-14 | Claw in Plain Sight (tool-argument disclosure measurement) | — | 2026 | arXiv:2608.20658 | measurement | ABSTRACT_ONLY + METADATA_VERIFIED | session-level policy-violating disclosure 20.8-75.0% across pressure/policy levels | high | prompt-level privacy instructions are NOT a portable boundary |
|
||||
| A3-15 | ContextLeak / SkillWatermark | — | 2026 | arXiv:2608.27800 / 2608.16026 | attacks/measurement | ABSTRACT_ONLY + METADATA_VERIFIED | RL-crafted tool names induce context leakage; skill descriptions encode private info in traffic patterns | medium-high | — |
|
||||
| A3-16 | The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents | — | 2026 | arXiv:2608.27092v1 (HTML full text read 2026-09-22 repair top-up; 6 models incl. gpt-4o/llama3.1:8b/qwen2.5:7b; 10 overt frames all 0% on gpt-4o; reframing J4 integrity-sig 100%/J7 config-block 100% on gpt-4o-mini; destination allow-list 0% by construction; planner/reader CaMeL-core split 0% at 90% utility; SecAlign 32.5% fails; channel separation 38.8% fails; limitations: single decision step, synthetic canary, no scaling ladder) | attacks/measurement | FULL_PAPER | model-side recognition fails 0%→100% under reframing; destination allow-lists close to 0%; payload-blind defenses are the demonstrated near-zero exfil defense | high | robust checks read destination/provenance, not content — mirror of Axelsson's FPR-first principle |
|
||||
| A3-17 | The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents | — | 2026 | arXiv:2608.27092v1 (HTML full text read 2026-09-22 repair top-up; 6 models incl. gpt-4o/llama3.1:8b/qwen2.5:7b; 10 overt frames all 0% on gpt-4o; reframing J4 integrity-sig 100%/J7 config-block 100% on gpt-4o-mini; destination allow-list 0% by construction; planner/reader CaMeL-core split 0% at 90% utility; SecAlign 32.5% fails; channel separation 38.8% fails; limitations: single decision step, synthetic canary, no scaling ladder) | attacks/measurement | FULL_PAPER | model-side recognition fails 0%→100% under reframing; destination allow-lists close to 0%; payload-blind defenses are the demonstrated near-zero exfil defense | high | robust checks read destination/provenance, not content — mirror of Axelsson's FPR-first principle |
|
||||
| A3-16 | ClawSentry / Locate-and-Judge | — | 2026 | arXiv:2608.21101 / 2606.23416 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | 4-locus progressive monitoring; contextual ASR 39.55%→2.61% with utility ~83.8%; found live malicious skills commercial scanners miss | high | progressive layered detection |
|
||||
| A3-18 | Agent libOS | — | 2026 | arXiv:2606.03895 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 planes (operation admission/IFC admission/durable evidence); Task Authority ceilings; one-shot Human release; disclaims prompt-injection prevention/kernel sandboxing/external-effect rollback | high | honest scope statement |
|
||||
| A3-19 | A-JWT per-agent proof-of-possession | — | 2025 | arXiv:2509.13597 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | per-agent keys + chained delegation + one-way identity hashes; blocks replay/in-process impersonation, sub-ms | medium-high | — |
|
||||
@@ -87,9 +87,10 @@ Read-depth values: FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE
|
||||
| A3-21 | AgentGuard (typosquatting) | — | 2026 | arXiv:2604.16309 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | hybrid metadata+content detection improves precision 12-49% over lexical-only | medium | lexical-only detection has structurally high FPR |
|
||||
| A3-22 | EchoLeak CVE-2025-32711 / xz CVE-2024-3094 | Microsoft/M365 Copilot; Lasse Collin ecosystem | 2025/2024 | NVD | CVE | METADATA_VERIFIED | EchoLeak: M365 Copilot AI command injection, CWE-74, CVSS 9.3/7.5, zero-privilege network attack; xz: CWE-506, CVSS 10.0, maintainer grooming | high | hash/pinning useless against a poisoned upstream release |
|
||||
| A3-23 | MCP Specification 2025-06-18 (Security and Trust & Safety section) | Anthropic et al. | 2025 | modelcontextprotocol.io | standard | ABSTRACT_ONLY + METADATA_VERIFIED | tool descriptions/annotations UNTRUSTED unless from a trusted server; 'MCP itself cannot enforce these security principles at the protocol level' | high | enforcement pushed to hosts |
|
||||
| A3-24 | SLSA v1.2 / Sigstore / SP 800-88r2 / SP 800-53 | SLSA/Sigstore/NIST | 2024-26 | slsa.dev; sigstore.dev; csrc.nist.gov | standards | V1/V2 | SLSA v1.0 RETIRED → v1.2; SP 800-88r1 withdrawn → r2; 800-53 AC-4/SC-7/AU-* | medium | normative not effectiveness |
|
||||
| A3-24 | SLSA v1.2 / Sigstore / SP 800-88r2 / SP 800-53 | SLSA/Sigstore/NIST | 2024-26 | slsa.dev; sigstore.dev; csrc.nist.gov | standards | DOCUMENTATION_AUDITED | SLSA v1.0 RETIRED → v1.2; SP 800-88r1 withdrawn → r2; 800-53 AC-4/SC-7/AU-* | medium | normative not effectiveness |
|
||||
| A3-25 | restic (client-side encryption, append-only delegated to server) | restic | current | restic.readthedocs.io | tool doc | ABSTRACT_ONLY + METADATA_VERIFIED | repo password mandatory; append-only enforcement lives SERVER-side; check --read-data | medium | immutability must live outside the client |
|
||||
| A3-26 | Negative space (FIDO2-as-agent-approval; policy-as-code-for-agents; approval-habituation-for-agents; agent-memory deletion semantics; signed-model-release standard) | — | 2025/26 | arXiv cs.CR (0 hits) | gap | UNVERIFIED (0 hits recorded) | NO published work found on any of the five | high | honest negative space; routes to innovation |
|
||||
| A3-27 | noWorkflow / ProvBook (script/notebook provenance captured but shown separately) | Murta et al.; Samuel & König-Ries | 2015/2018 | DOI 10.1007/978-3-319-16462-5_6 (Crossref-verified 2026-09-22: IPAW/LNCS, Murta/Chirigati/Koop); OpenAlex W2898837379 (ProvBook: Provenance-based Semantic Enrichment of Interactive Notebooks, Samuel & König-Ries 2018) | mechanism | METADATA_VERIFIED | provenance captured as first-class data alongside the artifact, displayed/queryable separately from content — the pattern quarantine-as-first-class-state reuses | medium | provenance systems show capture+separate-display is a workable pattern; NOT an enforcement mechanism |
|
||||
|
||||
Cross-arm note: arm-4 grounded all verdicts in the arm-1/2/3 ledger above plus the verified inward facts (01_inward.md); it did not introduce new sources. Negative-space searches (A3-25) are recorded as honest gaps, not fabricated findings.
|
||||
|
||||
@@ -106,9 +107,9 @@ Cross-arm note: arm-4 grounded all verdicts in the arm-1/2/3 ledger above plus t
|
||||
|
||||
## Depth summary
|
||||
|
||||
Arm 1: DOCUMENTATION_AUDITED 4 · ABSTRACT_ONLY+METADATA_VERIFIED 8 · METADATA_VERIFIED 6 · UNVERIFIED 2 · CODE_AUDITED 1 (25 rows; documentation correctly labeled, not FULL_PAPER).
|
||||
Arm 2: RELEVANT_SECTIONS 6 · DOCUMENTATION_AUDITED 3 · ABSTRACT_ONLY ~23 · METADATA_VERIFIED 2 · UNVERIFIED 1 (~35 rows).
|
||||
Arm 3: DOCUMENTATION_AUDITED 1 (Kleppmann, fully read but practitioner) · ABSTRACT_ONLY+METADATA_VERIFIED ~20 · METADATA_VERIFIED ~8 · UNVERIFIED ~5 (~35 rows).
|
||||
Arm 1 (A1, 25 rows): DOCUMENTATION_AUDITED 4 · ABSTRACT_ONLY+METADATA_VERIFIED 8 · METADATA_VERIFIED 6 · UNVERIFIED 2 · CODE_AUDITED 1 (documentation correctly labeled, not FULL_PAPER).
|
||||
Arm 2 (A2, 31 rows): RELEVANT_SECTIONS 6 · DOCUMENTATION_AUDITED 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~21 · UNVERIFIED 1.
|
||||
Arm 3 (A3, 27 rows): FULL_PAPER 2 (Axelsson A3-8; Framing Gap A3-17 — both read in full during the 2026-09-22 evidence-depth repair top-up) · DOCUMENTATION_AUDITED 2 (Kleppmann practitioner essay; SLSA/Sigstore/NIST standards row) · RELEVANT_SECTIONS 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~15 · METADATA_VERIFIED ~5.
|
||||
Adversarial: no new sources (grounded in the ledger + inward).
|
||||
|
||||
Total: ~128 rows; 127 unique (Broder/Charikar counted once). No FULL_PAPER for the injection/poisoning arms — arXiv V1 abstract-verified is the honest depth for 2025-26 preprints; the batched artifact's own claims were corrected against it.
|
||||
Total: 83 rows / 79 unique (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). FULL_PAPER = exactly 2, both academic papers read in full. The injection/poisoning arms remain abstract-verified — 2025-26 preprints with honest ABSTRACT/METADATA labels; the batched artifact's own claims were corrected against them.
|
||||
@@ -28,7 +28,7 @@
|
||||
| 399 | X: Persona / Identity | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-21; batched preserved as preliminary; lineage-based identity + kernel/persona/state strata + model-as-substrate + experience-gated evolution + grounded self-report + branching discipline + narrative-as-projection + relational non-fabrication + governed self-change; Shumailov DOI corrected) | — (no dup) | families/user_modelling_persona_identity.md | memory-atlas-r1/X-*/ |
|
||||
| 400 | Y: Metacognition | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-22; bounded evidence-depth/semantic-precision/gate repair RESEALED 2026-09-22: 4 anchors deepened FULL_PAPER (Huang/Kamoi/Snell/GRAB-RAG exact scopes), Koriat 1995 secondary-verified (primary closed), novelty wording → bounded-search NOVELTY_UNPROVEN, reflection A/B/C regimes, verbal confidence advisory-ranking-only, Snell design-vs-external split, typed-discrepancy surprise, reconciler backstop + timer-never-triggers-LLM invariant, C001 observed-facts scope, in-benchmark attribution framing, SEARCH_SATURATION vs LOAD_BEARING_DEPTH split, load_bearing_evidence.md per-claim support map, gate +3 Y checks 4/4 negative controls; batched preserved byte-for-byte as preliminary (5C/3R); monitoring/control split (N&N anchor) + typed negative retrieval states + metamemory projection + reflection gate on external verifiability + anti-rumination governor + baseline reconciler channel + capability awareness from runtime truth + progress truth (9 statuses) + recovery priors (★ build-preconditions: attempt logging, recovery history); adversarial 73 (5/20/48); claims 16 (12/4); sources 97/97; FAILED_ONCE; single routing authority — #400 proposes, ADAPT-2 disposes) | — (no dup) | families/metamemory_security.md | memory-atlas-r1/Y-*/ |
|
||||
| 401 | Z: HCI / Mind Palace | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-22; evidence-governance/classification repair RESEALED 2026-09-22: HYPOTHESIS loophole closed (ADOPT requires DEEP_EXTERNAL/RUNE_DIRECT/DESIGN_INVARIANT — HYPOTHESIS-only claims must be EXPERIMENT/ADAPT), C004 first-contact audit mode ADOPT→EXPERIMENT (RUNE_HYPOTHESIS preserved), three anchors deepened FULL_PAPER (Saredakis OA 55 studies/3,016 participants pooled SSQ 28.001 [24.656–31.345] with cutoff framing attributed externally to Kennedy 2003; Data Navigator arXiv:2308.08475 CC-BY — mechanism established, benefit unvalidated, no user study; Akhawe & Felt figures verbatim-verified), zero-hit wording swept to bounded-search phrasing, LOAD_BEARING_DEPTH re-earned PASS; batched preserved byte-for-byte as preliminary (3C/6R/3SU); Mind Palace = project name NOT data model; federated read-only projection + routed writes + governed search/browse split + local-graph default + provenance on demand + attention≠truth + patched layout contract + deterministic explanations + compensating-event undo + soft-delete + keyboard substrate; adversarial 85 (8/16/61); claims 22 (20/1/1; elevels 1/13/2/6); applicability 56 (29/3/1/2/20/1); sources 128/128 (FP 3 · RS 2 · ABS 83 · MV 41 · DOC 17); CONTINUOUS_EXECUTION=PASS + REPAIR_CONTINUOUS_EXECUTION=PASS; nine gaps as bounded-search findings) | — (no dup) | families/mind_palace_hci_multimodal.md | memory-atlas-r1/Z-*/ |
|
||||
| 402 | AA: Security / Poisoning | research-complete | R1_QUALIFIED (R1_FULL — deep requalified + expanded Rune-security scope 2026-09-22; batched preserved byte-for-byte as preliminary (4C/1R R0; 6C/2R prelim); INWARD: no authorization/integrity/confidentiality/security-state/quarantine/taint/content-control enforcement; audit_ledger.py HARDCODED HMAC key (tamper-evidence forgeable); hard delete no tombstone; --no-dedupe unprivileged bypass; memory.db 0644 world-readable; provider keys plaintext auth.json + /proc environ; workers ambient authority; ufw default-deny with narrow allows; ARCHITECTURE: content/control separation enforced OUTSIDE model at effect sink; deterministic authorize() choke point (policy discipline, relabeled); write-time origin binding + taint JOIN (TMA-NM machine-checked T1/T2/T3); quarantine first-class; Sybil-resistant elevation (count evidence ROOTS — 2609.01873); crypto by property with external monotonic floor for anti-rollback; key-custody honesty (same-uid malware defeats all); fencing tokens for workers; provider least-context + destination allow-lists (Framing Gap: model-side recognition fails 0%→100%, allow-lists close to 0%); detection discipline deterministic-vs-anomaly, FPR-first (Axelsson); typed compromise states + evidence-based clearance; safe rendering; scope honesty (root/kernel out of T1; bounded > omniscient); adversarial 170 attacks (SUCCEEDS 30 · PARTIAL 30 · FAILS 110; three sharpest: enforcement-claims-vs-honesty contradiction, recovery-demands-unproducible-evidence, bootstrapping/availability erosion; seven corrections applied incl. policy-discipline relabel + safe rendering + quotas + loopback auth + migration story); claims 15 (all ADOPT; elevels 1/14; threat_model per claim); sources 82/78 unique (FP 5 · RS 9 · ABS 41 · MV 39 · DOC 3 · CODE 1 · UNV 5); 20+ citation corrections incl. 4 batched defects; 9 honest gaps; SEARCH_SATURATION=REACHED + LOAD_BEARING_DEPTH=PASS; CONTINUOUS_EXECUTION=PASS; canonical receipt 192685 (superseded prior 192393) | — (no dup) | families/metamemory_security.md | memory-atlas-r1/AA-*/ |
|
||||
| 402 | AA: Security / Poisoning | research-complete | R1_QUALIFIED (R1_FULL — deep requalified + expanded Rune-security scope 2026-09-22; batched preserved byte-for-byte as preliminary (4C/1R R0; 6C/2R prelim); INWARD: no authorization/integrity/confidentiality/security-state/quarantine/taint/content-control enforcement; audit_ledger.py HARDCODED HMAC key (tamper-evidence forgeable); hard delete no tombstone; --no-dedupe unprivileged bypass; memory.db 0644 world-readable; provider keys plaintext auth.json + /proc environ; workers ambient authority; ufw default-deny with narrow allows; ARCHITECTURE: content/control separation enforced OUTSIDE model at effect sink; deterministic authorize() choke point (policy discipline, relabeled); write-time origin binding + taint JOIN (TMA-NM machine-checked T1/T2/T3); quarantine first-class; Sybil-resistant elevation (count evidence ROOTS — 2609.01873); crypto by property with external monotonic floor for anti-rollback; key-custody honesty (same-uid malware defeats all); fencing tokens for workers; provider least-context + destination allow-lists (Framing Gap: model-side recognition fails 0%→100%, allow-lists close to 0%); detection discipline deterministic-vs-anomaly, FPR-first (Axelsson); typed compromise states + evidence-based clearance; safe rendering; scope honesty (root/kernel out of T1; bounded > omniscient); adversarial 170 attacks (SUCCEEDS 30 · PARTIAL 30 · FAILS 110; three sharpest: enforcement-claims-vs-honesty contradiction, recovery-demands-unproducible-evidence, bootstrapping/availability erosion; seven corrections applied incl. policy-discipline relabel + safe rendering + quotas + loopback auth + migration story); claims 15 (all ADOPT; elevels 1/14; threat_model per claim); sources 83 rows / 79 unique, 4 cross-arm identity duplicates counted once (FP 2 · RS 9 · ABS 41 · MV 39 · DOC 9 · CODE 1 · UNV 5; 106 labels); 20+ citation corrections incl. 4 batched defects; 9 honest gaps (5 bounded-search + 4 unverified-this-run — distinct from evidence_saturation's 8 typed outcomes and master §49's 14 remaining unknowns, 2 parked); SEARCH_SATURATION=REACHED + LOAD_BEARING_DEPTH=PASS; CONTINUOUS_EXECUTION=PASS; canonical receipt 192685 (superseded prior 192393) | — (no dup) | families/metamemory_security.md | memory-atlas-r1/AA-*/ |
|
||||
| 403 | AB: Multimodal / Artifacts | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/mind_palace_hci_multimodal.md | memory-atlas-r1/AB-*/ |
|
||||
| 404 | AC: Local / Offline Intelligence | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/offline_intelligence_resource_placement.md | memory-atlas-r1/AC-*/ |
|
||||
| 405 | AD: Hardware / Resource Placement | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/offline_intelligence_resource_placement.md | memory-atlas-r1/AD-*/ |
|
||||
|
||||
@@ -984,6 +984,84 @@ def check_load_bearing_depth(domain_dir, findings):
|
||||
# arithmetic, process continue-count vs raw evidence, claim evidence-level
|
||||
# split, ownership-collapse phrases. Research-only checks; X-scoped.
|
||||
|
||||
_EXACTREF_DOMAINS = ("AA-",)
|
||||
|
||||
|
||||
def check_post_freeze_protocol(domain_dir, findings):
|
||||
"""#402 final closeout (mandate §15/§16): the mutation audit must
|
||||
explicitly encode the post-freeze allowed/forbidden state machine and
|
||||
the automatic FREEZE_STALE invalidation rule."""
|
||||
if not os.path.basename(domain_dir.rstrip("/")).startswith(_EXACTREF_DOMAINS):
|
||||
return
|
||||
p = os.path.join(domain_dir, "mutation_audit.md")
|
||||
if not os.path.exists(p):
|
||||
return
|
||||
text = open(p, encoding="utf-8", errors="replace").read().lower()
|
||||
if "forbidden" not in text or "freeze_stale" not in text:
|
||||
findings.append(
|
||||
"mutation_audit.md: post-freeze protocol missing — audit must encode the "
|
||||
"FORBIDDEN post-freeze write classes and the automatic FREEZE_STALE rule")
|
||||
|
||||
|
||||
def check_source_reference_resolution(domain_dir, findings):
|
||||
"""#402 final-closeout repair (mandate §5-§6): source IDs are foreign
|
||||
keys. A citation token must resolve EXACTLY to one source-ledger row —
|
||||
no prefix truncation, no suffix tolerance, no duplicate IDs — and a
|
||||
citation's adjacent arXiv/DOI identifier must appear in the resolved
|
||||
row's identity cells (title/author/year/identifier)."""
|
||||
if not os.path.basename(domain_dir.rstrip("/")).startswith(_EXACTREF_DOMAINS):
|
||||
return
|
||||
src = os.path.join(domain_dir, "sources.md")
|
||||
if not os.path.exists(src):
|
||||
return
|
||||
ids = []
|
||||
row_ident = {}
|
||||
for ln in open(src, encoding="utf-8", errors="replace"):
|
||||
if not ln.strip().startswith("|"):
|
||||
continue
|
||||
cells = [c.strip() for c in ln.strip().strip("|").split("|")]
|
||||
if cells and re.fullmatch(r"A\d+-\d+[a-z]?", cells[0] or ""):
|
||||
ids.append(cells[0])
|
||||
row_ident[cells[0]] = " ".join(cells[1:5])
|
||||
dups = sorted({i for i in ids if ids.count(i) > 1})
|
||||
if dups:
|
||||
findings.append(
|
||||
f"source ledger: DUPLICATE source IDs {dups} — reference resolution is ambiguous")
|
||||
idset = set(ids)
|
||||
for fname in ("load_bearing_evidence.md", "claims.json"):
|
||||
fp = os.path.join(domain_dir, fname)
|
||||
if not os.path.exists(fp):
|
||||
continue
|
||||
text = open(fp, encoding="utf-8", errors="replace").read()
|
||||
# (a) suffix tolerance forbidden: A3-16b must never parse as A3-16
|
||||
for m in re.finditer(r"\b(A\d+-\d+[a-z]+)\b", text):
|
||||
if m.group(1) not in idset:
|
||||
findings.append(
|
||||
f"{fname}: source reference '{m.group(1)}' carries a suffix and does not "
|
||||
f"resolve exactly to any source-ledger row (no truncation allowed)")
|
||||
# (b) exact existence
|
||||
for m in re.finditer(r"\b(A\d+-\d+[a-z]?)\b", text):
|
||||
tok = m.group(1)
|
||||
if tok in idset:
|
||||
continue
|
||||
# exempt explicit cross-domain pointers: "(A3-16 from #401)"
|
||||
tail = text[m.end():m.end() + 12]
|
||||
if re.match(r"\s+from\s+#", tail):
|
||||
continue
|
||||
findings.append(
|
||||
f"{fname}: source reference '{tok}' does not resolve to any source-ledger row")
|
||||
# (c) identity adjacency: "NAME <arXiv/DOI> ... (A3-NN)" must match the row
|
||||
for m in re.finditer(
|
||||
r"([\w./& -]{2,60}?)\s(10\.\d{4,9}/[\w.\-()]+|\b\d{4}\.\d{4,5}\b)"
|
||||
r"[^.|\n]{0,40}?\((A\d+-\d+)\b", text):
|
||||
ident, tok = m.group(2), m.group(3)
|
||||
row = row_ident.get(tok, "")
|
||||
if row and ident not in row and f"arXiv:{ident}" not in row:
|
||||
findings.append(
|
||||
f"{fname}: reference ({tok}) resolves to a source row whose identity "
|
||||
f"does not contain '{ident}' — identity conflict")
|
||||
|
||||
|
||||
_REPAIR_DOMAINS = ("W-", "X-", "Y-", "Z-")
|
||||
_LBM_DOMAINS = ("Y-", "Z-", "AA-")
|
||||
|
||||
@@ -1243,7 +1321,7 @@ def check_load_bearing_depth_map(domain_dir, findings):
|
||||
f"claim {cid}: ADOPT lacks DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT support "
|
||||
f"(found '{support}') — a HYPOTHESIS-only claim must be EXPERIMENT or ADAPT")
|
||||
if support == "DEEP_EXTERNAL":
|
||||
anchors = re.findall(r"(A\d+-\d+)", " ".join(cells))
|
||||
anchors = re.findall(r"\b(A\d+-\d+[a-z]?)\b", " ".join(cells))
|
||||
if not any(src_rows.get(a) for a in anchors):
|
||||
findings.append(
|
||||
f"claim {cid}: DEEP_EXTERNAL support but no cited anchor ({anchors}) is FULL_PAPER/RELEVANT_SECTIONS in sources.md")
|
||||
@@ -1412,6 +1490,8 @@ def check_repair_hardening(domain_dir):
|
||||
check_ownership_collapse_phrases(domain_dir, findings)
|
||||
check_drift_crypto_split(domain_dir, findings)
|
||||
check_load_bearing_depth_map(domain_dir, findings)
|
||||
check_source_reference_resolution(domain_dir, findings)
|
||||
check_post_freeze_protocol(domain_dir, findings)
|
||||
check_zero_hit_novelty(domain_dir, findings)
|
||||
check_rune_proven_scope(domain_dir, findings)
|
||||
check_registry_master_convergence(domain_dir, findings)
|
||||
|
||||
Reference in new issue
Block a user