runecore: construction-authority doors at mutation tools + typed wire-boundary argument validation (audit T12) #2619

Open

conductor wants to merge 2 commits from fix/tool-boundary-audits into master

pull from: fix/tool-boundary-audits

merge into: conductor:master

conductor:master

conductor:fix/shared-ci-unblock

conductor:fix/ci-concurrency-per-ref

conductor:fix/2552-handler-triage

conductor:feat/2618-context

conductor:fix/2604-scaffolding-surgical

conductor:feat/2618-provider-stack

conductor:feat/final-integration

conductor:feat/2618-safety-parity

conductor:feat/2609-integration-w6

conductor:feat/2618-audit-forge

conductor:feat/2618-background-memory

conductor:feat/2618-operator-residual

conductor:feat/2618-warm-recall

conductor:feat/2617-research-r3

conductor:feat/2606-spine-w4

conductor:feat/2617-research-r2

conductor:fix/2607-spine-dichotomy

conductor:feat/2609-go-interception-w3

conductor:feat/2618-memory-store

conductor:feat/2617-research-r1

conductor:feat/2609-go-interception-w2

conductor:fix/data-safety-audits

conductor:fix/integration-audits

conductor:fix/sqlite-floor-audits

conductor:feat/2617-research-r0

conductor:feat/2609-model-replay

conductor:feat/2609-go-interception-w1

conductor:fix/2582-release-final

conductor:fix/2613-self-hosting-gate

conductor:removal-prep/dead-superseded-pile

conductor:removal-prep/auto-context

conductor:removal-prep/reconcile-tools

conductor:removal-prep/openai-compat-transport

conductor:removal-prep/message-queue

conductor:removal-prep/forge-client

conductor:removal-prep/cache

conductor:removal-prep/paths

conductor:fix/2532-text-selection

conductor:throwaway-force-merge-test

conductor:fix/2582-namespace-cli-flag

conductor:feat/2582-release-reporting

conductor:fix/2535-pane-scrollback

conductor:dichotomy-gap-f0

conductor:gap-transport

conductor:gap-construction-commands

conductor:wave-ca-ms

conductor:tmp-detach

conductor:gap-ltr

conductor:backup-rune-as

conductor:wave-ax

conductor:feat/wave6-rust-backend

conductor:feat/wave4-consolidation-kernel

conductor:ci/build-cognition-core-unit

conductor:ci/register-w34-canaries

conductor:feat/wire-programme-continuation

conductor:feat/wire-construction-commands-dispatch

conductor:feat/wire-stage-guards-transition

conductor:feat/tui-pane-swap-chat-left

conductor:fix/operator-probe-tools-2468

conductor:r2-wave2-memory-retrieval

conductor:r2-wave2-memory-storage

conductor:phase-g-strangler-evidence-provenance

conductor:phase-g-strangler-retrieval-index

conductor:tranche-r1-wave-0

conductor:m10-derive-refresh

conductor:t22-scaffolding-default-path

conductor:research-depth-gate

conductor:fix-407-autolabel

conductor:fix-tui-banner-surface

conductor:r13-m9-pr-proof

conductor:gitea-internal-endpoint

conductor:auto-label-epic-kinds

conductor:issue-templates-heading

conductor:issue-templates

conductor:event-driven-clean

conductor:deadline-return-fix

conductor:hardening-live-proof

conductor:hardening-authority-identity

conductor:event-driven-final-metrics

conductor:event-driven-gates-evidence

conductor:event-driven-continuation

conductor:async-intent-live-proof

conductor:async-intent-normalization

conductor:memory-t0-external-report

conductor:memory-t0-asis-map

conductor:t21.5-pending-class-fix

conductor:t21.5-gate-evidence

conductor:t21.5-root-cause-continuation

conductor:t21.4-gate-evidence

conductor:t21.4-qualify-defaults-fix

conductor:t21.4-final-v1-proof

conductor:prototype/openai-compat-transport

conductor:wr-experiment

conductor:adapt2-route-authority

conductor:pl0-experience-ledger

conductor:d5-authority-audit

conductor:task-d-stage-contracts

conductor:b3v2-fresh

conductor:d5-tightening

conductor:d4d5-artifact-contract

conductor:correction-1-d2d3

conductor:adapt9-artifact-authority

conductor:prov1-source-ledger

conductor:infra1-accept

conductor:infra1-probe5

conductor:infra1-probe4

conductor:infra1-probe3

conductor:infra1-probe2

conductor:infra1-probe

conductor:obs1-telemetry

conductor:rp13-metrics

conductor:rp12-rerun-163

conductor:rp11-retirement

conductor:issue161-harness-v2

conductor:issue161-harness

conductor:rp2-canonical-stage-model

conductor:sweep-live

conductor:umbrella-rewire

conductor:trigger-bump-2

conductor:release-token-fix

conductor:trigger-bump

conductor:version-reconcile

conductor:umbrella-pipeline

conductor:pinned-live

conductor:research-structuralization

conductor:merge-robot-checkout

conductor:p1-03-memory-selection

conductor:coverage-ratchet

conductor:failure-auto-filing

conductor:release-safety-net

conductor:ci-dependency-lock

conductor:bugfix-contract

conductor:merge-robot-fix

conductor:adversarial-gates

conductor:merge-robot

conductor:runner-desktop-gate

conductor:research-gate-evidence

conductor:backup/pinned-20260908-035000

conductor:release-tui-footer

Conversation 2 Commits 2 Files Changed 8

+1265 -7

conductor commented 2026-10-26 00:31:27 +00:00

Owner

Copy link

Copy source

Summary

Repairs the two HIGH tool-boundary defects from the owner code audit T12 (reproduced on frozen master a52624b3, re-verified on current master 79ff61b3 before any repair):

1. Mutation family ran with no construction authority. runecore.ExecuteGatedTool now crosses two doors before write_file/edit_file/run_command effects (internal/runecore/authority.go): wire-boundary argument validation, then the construction-authority consult — Go I/O reads the nearest construction store walking up from the mutation site (run_command's door is its workdir); scope matching mirrors the parity-frozen CheckScope mechanics (D33 research verdict: no Rust crate provides the runtime path-scope decision — construction_decision resolves need→surface at adoption only — so the existing Go-side mechanics are reused verbatim, no new Go↔Rust crossing); draft is not authority, closed/failed/abandoned are expired; missing/broken/uncovered authority fails closed with the typed envelope the model reads: no open construction contract covers this path — open one via the construction interface.
2. Destructive default truncated files. argStr("content","") turned missing/null/numeric/bool content into a 0-byte overwrite reported as success. Required-field presence + string-type is now enforced exactly where the schema advertises it (write_file content/path, edit_file search/replace, run_command command); an explicitly-supplied empty string stays legal.

Constraints honored

• D49: no tool is removed from any mode; the consent card stays work-promotion — the gate adds the scaffolding authority at mutation doors, it does not gate capability (D49's own "real safety layer" text).
• D57: refusal wording is action-directive; refusal.go untouched (interplay flagged in the plan's FOL).
• Scaffolding law: contract-first — ADMIT-tool-boundary-audits-20261025 minted via the real construction interface (scripts/admit_wave_tool_boundary.py) naming every surface; the pre-commit landing gate verified coverage.

Verification

• Red-first: new tests failed against unpatched master with the defect signatures verbatim ("wrote … (0 bytes)", shell executed, file clobbered) — then green after the repair; go test ./..., go test -race ./internal/runecore, go vet, gofmt all clean.
• Mutation spot-check on the new gate (draft marked authoritative → draft test RED → restored).
• Engine-level fake-model tests cover absent/draft/expired/out-of-scope/corrupt authority incl. shell-mediated mutation; argument tests pin byte-for-byte file preservation.
• Plan + discharge table: plans/2026-10-25-tool-boundary-audits.md.

Follow-ups (out of scope here, recorded in the plan)

• refusal.go tier-2 can classify a truthful authority paraphrase as a false capability claim (spurious correction turn).
• run_command authority is workdir-anchored — the law is the door, not a sandbox.

## Summary Repairs the two HIGH tool-boundary defects from the owner code audit **T12** (reproduced on frozen master a52624b3, re-verified on current master 79ff61b3 before any repair): 1. **Mutation family ran with no construction authority.** `runecore.ExecuteGatedTool` now crosses two doors before write_file/edit_file/run_command effects (`internal/runecore/authority.go`): wire-boundary argument validation, then the construction-authority consult — Go I/O reads the nearest construction store walking up from the mutation site (run_command's door is its **workdir**); scope matching mirrors the parity-frozen `CheckScope` mechanics (D33 research verdict: no Rust crate provides the runtime path-scope decision — construction_decision resolves need→surface at adoption only — so the existing Go-side mechanics are reused verbatim, no new Go↔Rust crossing); `draft` is not authority, `closed/failed/abandoned` are expired; **missing/broken/uncovered authority fails closed** with the typed envelope the model reads: `no open construction contract covers this path — open one via the construction interface`. 2. **Destructive default truncated files.** `argStr("content","")` turned missing/null/numeric/bool content into a 0-byte overwrite reported as success. Required-field presence + string-type is now enforced exactly where the schema advertises it (write_file `content`/`path`, edit_file `search`/`replace`, run_command `command`); an explicitly-supplied empty string stays legal. ## Constraints honored - **D49**: no tool is removed from any mode; the consent card stays work-promotion — the gate adds the scaffolding authority at mutation doors, it does not gate capability (D49's own "real safety layer" text). - **D57**: refusal wording is action-directive; refusal.go untouched (interplay flagged in the plan's FOL). - **Scaffolding law**: contract-first — `ADMIT-tool-boundary-audits-20261025` minted via the real construction interface (`scripts/admit_wave_tool_boundary.py`) naming every surface; the pre-commit landing gate verified coverage. ## Verification - Red-first: new tests failed against unpatched master with the defect signatures verbatim (`"wrote … (0 bytes)"`, shell executed, file clobbered) — then green after the repair; `go test ./...`, `go test -race ./internal/runecore`, `go vet`, `gofmt` all clean. - Mutation spot-check on the new gate (draft marked authoritative → draft test RED → restored). - Engine-level fake-model tests cover absent/draft/expired/out-of-scope/corrupt authority incl. shell-mediated mutation; argument tests pin byte-for-byte file preservation. - Plan + discharge table: `plans/2026-10-25-tool-boundary-audits.md`. ## Follow-ups (out of scope here, recorded in the plan) - refusal.go tier-2 can classify a truthful authority paraphrase as a false capability claim (spurious correction turn). - run_command authority is workdir-anchored — the law is the door, not a sandbox.

conductor added 1 commit 2026-10-26 00:31:28 +00:00

feat(runecore): construction-authority doors at the mutation family + wire-boundary argument validation (audit T12) ... be625b7f90

Two HIGH tool-boundary findings from the owner code audit (base
a52624b3, re-verified on current master 79ff61b3 before repair:

1) ExecuteGatedTool dispatched write_file/edit_file/run_command with
   NO construction-authority consult. Mutation calls now cross two
   doors before effects (authority.go): required-argument validation
   at the wire boundary — the argStr("content","") destructive
   default turned missing/null/numeric content into a 0-byte overwrite
   reporting success (explicit empty string stays legal) — then the
   construction-authority consult: Go I/O reads the nearest
   store/.rune store walking up from the mutation site (run_command's
   door is its workdir), scope matching mirrors the parity-frozen
   CheckScope mechanics (D33 verdict: no Rust crate provides the
   runtime path-scope decision; no new crossing invented), draft/
   closed/failed/abandoned authority refuses, missing/broken authority
   FAILS CLOSED with the typed envelope the model reads: 'no open
   construction contract covers this path — open one via the
   construction interface'. D49 holds: no tool is removed from any
   mode and the consent card stays work-promotion.

2) args validation: presence + string type enforced exactly where the
   schema advertises it (write_file content/path, edit_file
   search/replace/path, run_command command).

Red-first evidence: engine-level fake-model tests (absent/draft/
expired/out-of-scope/corrupt authority incl. shell-mediated
run_command) plus argument-type cases with byte-for-byte file
preservation; mutation spot-check (draft marked authoritative ->
draft test RED -> restored). Admission
ADMIT-tool-boundary-audits-20261025; plan:
plans/2026-10-25-tool-boundary-audits.md

gitea-actions Bot added the P1 — highbuggovernancememoryperception labels 2026-10-26 00:31:33 +00:00

gitea-actions Bot commented 2026-10-26 00:34:48 +00:00

Copy link

Copy source

🤖 Headless spec gate (non-blocking, #204 first slice)

Spec-gate agent produced no text output — check runner logs.

Deterministic floors still govern the merge

This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.

🤖 **Headless spec gate (non-blocking, #204 first slice)** Spec-gate agent produced no text output — check runner logs. <details><summary>Deterministic floors still govern the merge</summary> This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>

conductor referenced this issue from a commit 2026-10-26 00:41:10 +00:00

docs(plans): CI observation + refusal TUI-visibility for PR #2619 (audit T12)

conductor added 1 commit 2026-10-26 00:41:10 +00:00

docs(plans): CI observation + refusal TUI-visibility for PR #2619 (audit T12) 70e6c72fb4

gitea-actions Bot commented 2026-10-26 00:42:05 +00:00

Copy link

Copy source

🤖 Headless spec gate (non-blocking, #204 first slice)

Spec-gate agent produced no text output — check runner logs.

Deterministic floors still govern the merge

This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.

🤖 **Headless spec gate (non-blocking, #204 first slice)** Spec-gate agent produced no text output — check runner logs. <details><summary>Deterministic floors still govern the merge</summary> This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>

Some required checks failed

Hide all checks

CI Pipeline / lint (push) Canceled after 0s

Details

CI Pipeline / unit-tests (push) Canceled after 0s

Details

CI Pipeline / go-surface (push) Canceled after 0s

Details

CI Pipeline / rust-surface (push) Canceled after 0s

Details

CI Pipeline / canary (push) Canceled after 0s

Details

CI Pipeline / best-practices (push) Canceled after 0s

Details

CI Pipeline / documentation (push) Canceled after 0s

Details

CI Pipeline / type-check (push) Canceled after 0s

Details

CI Pipeline / gitea-offline (push) Canceled after 0s

Details

CI Pipeline / required-checks (push) Canceled after 0s

Details

CI Pipeline / CI Pipeline / notify-event-bridge (push) Canceled after 0s

Details

deploy / deploy (push) Skipped

Details

Local-Model First-Pass Review (#131) / first-pass-review (pull_request) Successful in 24s

Details

Spec gate (headless) / spec-gate (pull_request) Successful in 27s

Details

CI Pipeline / lint (pull_request) Failing after 53s

Details

CI Pipeline / go-surface (pull_request) Failing after 24s

Details

CI Pipeline / rust-surface (pull_request) Failing after 10s

Details

CI Pipeline / unit-tests (pull_request) Failing after 1m25s

Details

CI Pipeline / best-practices (pull_request) Successful in 3s

Details

CI Pipeline / documentation (pull_request) Successful in 3s

Details

CI Pipeline / canary (pull_request) Failing after 1m5s

Details

CI Pipeline / type-check (pull_request) Failing after 48s

Details

CI Pipeline / gitea-offline (pull_request) Successful in 14s

Details

CI Pipeline / required-checks (pull_request) Failing after 1s

Required

Details

CI Pipeline / CI Pipeline / notify-event-bridge (pull_request) Failing after 11s

Details

Some required checks were not successful.

This pull request is blocked because it's outdated.

You are not authorized to merge this pull request.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/tool-boundary-audits:fix/tool-boundary-audits

git checkout fix/tool-boundary-audits

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0 — critical

Spine/core correctness or blocks other work — do first

P1 — high

Material user value or real defect (money, bugs, next-stage dep)

P2 — medium

Quality/consolidation improvement

P3 — low

Measurement / benchmark / deferred policy

blocked

Dependencies open

bug

Confirmed defect or regression

custodian

epic

Rune v1 course-correction issue graph

feature

New capability or improvement

governance

growth

identity

in-progress

Currently being worked on by Rune

incomplete

Incomplete work — draft PR with ledger, awaiting resume

infrastructure

life

memory

memory-atlas

Memory Research Atlas child domain

needs-testing

Needs manual testing with dumbed-down steps before close

perception

ready

Order satisfied - Rune may start

release-drift

research

Research jobs — spikes, watchlists, evidence work

rune

rune

scaffolding

scaffolding

spine,correction

spine,correction

spine,deferred

spine,deferred

spine,resolved

spine,resolved

strangler,burn,endgame,deferred

strangler,burn,endgame,deferred

strangler,burn,endgame,inventory,epic

strangler,burn,endgame,inventory,epic

tui

tui

tui,epic

tui,epic

tui,openspec

tui,openspec

v1-course-correction

Rune v1 course-correction issue graph

No labels P1 — high bug governance memory perception

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

conductor

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: conductor/rune#2619