Reviews security-layer-model v0.8 as text (net-kingdom@66eeaba), completing the
round this repo promised after sending only one finding and explicitly telling
gate-house to treat it as one finding rather than an assent.
Three findings. The substantive one is that §6.4 announces "Four obligations"
and lists five: v0.7 had four, v0.8 added obligation 5 and left the count. That
obligation is the one carrying correspondence-by-identity, the PIP/PDP
separation and the replay-identity property -- the whole GH-DEC-2026-003/005/008
chain, and the rule that binds this engine at issue time. A consumer
implementing "the four obligations of §6.4" can omit precisely the one governing
how it compares an approval to a decision. It has already propagated into
gate-house's own correspondence.
Second, §17 states four artifacts are required and owned by Taxonomy while its
body removes two from Taxonomy, then calls three artifacts' ownership "still
proposed" and settles one of them in the same sentence. Two are genuinely
unsettled. §15 claims §17's stale ownership paragraph was corrected; the
correction did not reach the count sentence or the closing status.
Third and minor, the §18-to-§20 numbering hole is explained only in a late §16
bullet.
The record is marked as a derived, dated artifact naming its source commit, per
§12's own rule -- the rule this repo proposed and asked to own none of.
Also records what was read and what was not, what was found sound, and two
candidate findings dropped after checking, since a finding count means nothing
without the count checked and discarded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PM5HnEAhokxdfcPqBNpT7D
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715850@bnt-lap001
Assistant-Session: eb557e93-7cb1-45d0-9e57-7d15b3edc60e
tegwick
f67e7a3566