Clarify session-owner and zone-engine routes in knowledge 0.2.6.
The startup card names the session owner as the recipient of a provider switch or compaction reload. The zones card sends a live endpoint question to zone-engine. Informed Decision stays at b4f6373. The unsigned draft was regenerated and not submitted. No provider rerun is included, and RISK-F-0015 stays open. Assistant: grok Assistant-Session: 01a10286-9185-7bb2-b411-89cf6ab4c0c6
This commit is contained in:
parent
e32a9c5dfe
commit
f65d0e64bc
13 changed files with 167 additions and 24 deletions
|
|
@ -106,7 +106,7 @@ not cover this seal. See `docs/evidence/2026-10-03-024-offline-intake-repin.md`.
|
|||
|
||||
## Informed Decision re-pin — 0.2.5
|
||||
|
||||
The current unsigned draft binds 0.2.5, digest
|
||||
The 0.2.5 unsigned draft bound digest
|
||||
`9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`.
|
||||
It reviews published Informed Decision revision `b4f63732`: local delivery
|
||||
wiring, fresh-login/p01 acceptance, empty registries, and a dev forwarder that
|
||||
|
|
@ -114,3 +114,13 @@ preserves governed booleans. T08 still waits on the service account and
|
|||
T05/T06. No live listener or grant is claimed. 0.2.4 probes and Whitehat's
|
||||
0.2.3 library acceptance do not cover this seal. The draft is unsubmitted. See
|
||||
`docs/evidence/2026-10-03-025-informed-decision-repin.md`.
|
||||
|
||||
## Route clarification — 0.2.6
|
||||
|
||||
The current unsigned draft binds 0.2.6, digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.
|
||||
It keeps Informed Decision at `b4f63732`. The startup card names the session
|
||||
owner as the recipient of a provider switch or compaction reload, with
|
||||
glas-harness owning that boundary. The zones card sends a live zone-endpoint
|
||||
question to zone-engine. 0.2.4 probes do not cover this wording. The draft is
|
||||
unsubmitted. See `docs/evidence/2026-10-03-026-route-clarification.md`.
|
||||
|
|
|
|||
|
|
@ -139,11 +139,18 @@ and the refusal to retry a creating approval without a retained receipt.
|
|||
provider probes are recorded in `docs/evidence/2026-10-03-024-provider-probes.md`.
|
||||
Earlier provider reports do not certify that seal.
|
||||
|
||||
Current pilot **0.2.5** re-pins Informed Decision at `b4f63732`, digest
|
||||
Release **0.2.5** re-pins Informed Decision at `b4f63732`, digest
|
||||
`9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`.
|
||||
The decisions card records fresh-login/p01 acceptance, the open browser
|
||||
freshness error, empty registries, notification without a URL, local posed
|
||||
evidence, write-back left off, and boolean-preserving dev forwarding. T08
|
||||
still waits on the service account and T05/T06. The unsigned draft binds this
|
||||
digest and is unsubmitted. 0.2.4 probes, resumes, and pilots do not certify
|
||||
this seal. No listener or submitter route is claimed.
|
||||
still waits on the service account and T05/T06. At that release, the unsigned
|
||||
draft bound this digest. 0.2.4 probes, resumes, and pilots do not certify
|
||||
that seal. No listener or submitter route is claimed.
|
||||
|
||||
Current pilot **0.2.6**, digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
|
||||
keeps the `b4f63732` pin. A provider switch or compaction reload goes to the
|
||||
session owner, and glas-harness owns that boundary. A live zone-endpoint
|
||||
question goes to zone-engine. The unsigned draft binds this digest and is
|
||||
unsubmitted. 0.2.4 route results do not certify this wording.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"kind": "informed-decision.memo-intake",
|
||||
"version": 1,
|
||||
"idempotency_key": "emergent-profile-9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f",
|
||||
"idempotency_key": "emergent-profile-8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"memo_class": "knowledge-profile",
|
||||
"review_group": "net-kingdom-admins",
|
||||
"drafted_by": "codex@emergent-security (asserted)",
|
||||
|
|
@ -14,15 +14,15 @@
|
|||
"principal": "emergent-security",
|
||||
"purpose": "Accept only the non-normative knowledge profile boundary",
|
||||
"target": {
|
||||
"id": "emergent-security:knowledge:0.2.5:9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f",
|
||||
"id": "emergent-security:knowledge:0.2.6:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"type": "knowledge-profile",
|
||||
"system": "emergent-security"
|
||||
}
|
||||
},
|
||||
"memo": {
|
||||
"id": "emergent-profile-adoption-0-2-5",
|
||||
"id": "emergent-profile-adoption-0-2-6",
|
||||
"version": 1,
|
||||
"question": "Accept Emergent Security knowledge 0.2.5 as a non-normative NetKingdom agent orientation profile?",
|
||||
"question": "Accept Emergent Security knowledge 0.2.6 as a non-normative NetKingdom agent orientation profile?",
|
||||
"requested_act": "approve",
|
||||
"binding_level": "organizational",
|
||||
"brief": "Accept only the orientation boundary of this exact release; operational authority and remaining review gates stay with their owners.",
|
||||
|
|
@ -35,7 +35,7 @@
|
|||
"identifiers": []
|
||||
},
|
||||
"target": {
|
||||
"id": "emergent-security:knowledge:0.2.5:9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f",
|
||||
"id": "emergent-security:knowledge:0.2.6:8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"kind": "knowledge-profile",
|
||||
"label": "Non-normative security orientation",
|
||||
"environment": "rehearsal",
|
||||
|
|
@ -49,7 +49,7 @@
|
|||
{
|
||||
"item_id": "emergent-profile-packet",
|
||||
"label": "Profile boundary and limitations",
|
||||
"hash": "sha256:0ede0384f381085b256bd1273e8aa19909129dc05c760f5f7348b3763090076a"
|
||||
"hash": "sha256:c5a7eab7312e053cb1caeefb623619fe4c626fd56559fadce9195bb9e103fd18"
|
||||
}
|
||||
],
|
||||
"highlights": [
|
||||
|
|
@ -76,7 +76,7 @@
|
|||
{
|
||||
"item_id": "emergent-profile-packet",
|
||||
"media_type": "text/markdown",
|
||||
"content": "# Knowledge profile adoption request\n\nAdopt Emergent Security knowledge 0.2.5, release digest 9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f, as a\nnon-normative orientation profile for coding agents in NetKingdom.\n\nThe profile points to existing owners, withholds stale guidance, and separates\nhuman decisions, runtime approvals, PDP decisions, credentials and procedure\nrecords. This asks only to accept that orientation boundary. It does not amend\nowner contracts or authorize operational effects, autonomous execution, root,\ncredential changes or fleet rollout.\n\nAlternatives: return for wording/source corrections; decline this profile;\naccept this exact orientation boundary with the documented evidence limits.\nChanging the reviewed package requires a new review, not reuse of this answer.\n\nEvidence: knowledge/sources.yaml; docs/decision-runbook-integration.md;\ndocs/operational-contracts.md; docs/adoption-review.md; docs/evidence/.\nEarlier provider reports and owner reviews retain their original release pins.\nWhitehat's offline review accepted remediation of the two loaded-package library\nfindings on the 0.2.3 digest, with disclosed shared-session limits. That\nacceptance does not extend to this seal. Continuity and harness proof remain open.\nA fresh 0.2.4 Codex, Claude, and Grok session each answered all 28 scenarios.\nImplementing review found no unsafe authority recommendation. Recipient\nqualifications remain, and that review is not independent ratification.\nThose 0.2.4 answers, resume reloads, and four Claude pilots stay pinned to\nthat digest. They are not evidence for this seal. 0.2.5 reviews Informed\nDecision at b4f63732. That revision records local intake delivery,\nfresh-login/p01 acceptance, and a dev forwarder that preserves governed\nbooleans. No listener, submitter grant, custody, or live route is claimed.\nA creating approval without a retained receipt is not retried.\n\nThe draft is unsubmitted. The proposed memo class and review group must be\nconfirmed by the owner; a synthetic test grant proves format only. INFD-WP-0005\nintake rollout remains unfinished. This draft resolves no Statehub decision.\n"
|
||||
"content": "# Knowledge profile adoption request\n\nAdopt Emergent Security knowledge 0.2.6, release digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, as a\nnon-normative orientation profile for coding agents in NetKingdom.\n\nThe profile points to existing owners, withholds stale guidance, and separates\nhuman decisions, runtime approvals, PDP decisions, credentials and procedure\nrecords. This asks only to accept that orientation boundary. It does not amend\nowner contracts or authorize operational effects, autonomous execution, root,\ncredential changes or fleet rollout.\n\nAlternatives: return for wording/source corrections; decline this profile;\naccept this exact orientation boundary with the documented evidence limits.\nChanging the reviewed package requires a new review, not reuse of this answer.\n\nEvidence: knowledge/sources.yaml; docs/decision-runbook-integration.md;\ndocs/operational-contracts.md; docs/adoption-review.md; docs/evidence/.\nEarlier provider reports and owner reviews retain their original release pins.\nWhitehat's offline review accepted remediation of the two loaded-package library\nfindings on the 0.2.3 digest, with disclosed shared-session limits. That\nacceptance does not extend to this seal. Continuity and harness proof remain open.\nA fresh 0.2.4 Codex, Claude, and Grok session each answered all 28 scenarios.\nImplementing review found no unsafe authority recommendation. Recipient\nqualifications remain, and that review is not independent ratification.\nThose 0.2.4 answers, resume reloads, and four Claude pilots stay pinned to\nthat digest. They are not evidence for this seal. 0.2.5 reviews Informed\nDecision at b4f63732. That revision records local intake delivery,\nfresh-login/p01 acceptance, and a dev forwarder that preserves governed\nbooleans. No listener, submitter grant, custody, or live route is claimed.\nA creating approval without a retained receipt is not retried.\n0.2.6 names the session owner as the recipient of a provider switch or\ncompaction reload. glas-harness owns that session boundary. A live\nzone-endpoint question goes to zone-engine. 0.2.4 route results do not\ncertify this wording. No provider rerun is included in this draft.\n\nThe draft is unsubmitted. The proposed memo class and review group must be\nconfirmed by the owner; a synthetic test grant proves format only. INFD-WP-0005\nintake rollout remains unfinished. This draft resolves no Statehub decision.\n"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,10 @@
|
|||
# Informed Decision re-pin — knowledge 0.2.5
|
||||
|
||||
Live pilot: **0.2.5**, manifest digest
|
||||
The live seal is now 0.2.6. See
|
||||
`docs/evidence/2026-10-03-026-route-clarification.md`. This 0.2.5 record
|
||||
stays historical.
|
||||
|
||||
Historical pilot: **0.2.5**, manifest digest
|
||||
`9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`.
|
||||
Release 0.2.4, digest
|
||||
`025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3`,
|
||||
|
|
|
|||
51
docs/evidence/2026-10-03-026-route-clarification.md
Normal file
51
docs/evidence/2026-10-03-026-route-clarification.md
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# Route clarification — knowledge 0.2.6
|
||||
|
||||
Live pilot: **0.2.6**, manifest digest
|
||||
`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.
|
||||
Release 0.2.5, digest
|
||||
`9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f`,
|
||||
remains the historical seal for the Informed Decision re-pin. This release
|
||||
does not extend 0.2.4 provider probes, resume reloads, pilots, or Whitehat's
|
||||
0.2.3 library acceptance.
|
||||
|
||||
## What changed
|
||||
|
||||
The owner pins are unchanged. Informed Decision remains
|
||||
`b4f637326ba3c2526f4648c4c90544948408d53f`.
|
||||
|
||||
The startup card now says an earlier knowledge receipt does not carry
|
||||
authority into a resumed, compacted, or provider-switched session. The next
|
||||
recipient is the session owner, and glas-harness owns that boundary. A
|
||||
provider change alone is not a question for the delegator. The startup card
|
||||
is 5301 bytes, under the 5500-byte cap.
|
||||
|
||||
The zones card now sends a question about a live zone authorization endpoint
|
||||
to zone-engine. That endpoint is absent. Offline conformance is the whole
|
||||
answer. The PEP owner keeps the stance when an actual allow or deny is
|
||||
requested.
|
||||
|
||||
## Why
|
||||
|
||||
On sealed 0.2.4, Codex, Claude, and Grok each named `delegator` for
|
||||
model-switch. The fixture route is `session-owner` and the source is
|
||||
`glas-harness`. Grok named `pep-owner` for zones while denying a live zone
|
||||
API. The fixture route is `zone-engine`. Those reports stay historical.
|
||||
This wording is the package change. It is not a new provider result, and it
|
||||
does not close RISK-F-0015. T07 has not accepted it.
|
||||
|
||||
## Checks
|
||||
|
||||
[Source check](2026-10-03-026-source-check.json): 24 owners `verified-files`,
|
||||
`ok: true`, `live_state_verified: false`. Startup retrieves as
|
||||
`verified-files`. Seal and unsigned-draft checks pass. Portable tests:
|
||||
332 passed, 9 skipped. With `EMERGENT_OWNER_ROOT=/home/worsch`, the 9
|
||||
owner-contract tests passed. The unsigned adoption draft was regenerated
|
||||
for this digest and was not submitted. Decision
|
||||
`d20a9750-2b29-534e-8227-fb866581a6ca` remains open.
|
||||
|
||||
## Still open
|
||||
|
||||
A failed-case rerun of model-switch and zones on this seal is not in this
|
||||
record. Compaction, a governed harness session, owner feedback, human
|
||||
adoption, and fleet reach remain open. EMERGENT-WP-0002 stays blocked.
|
||||
No DoD-Ok is claimed.
|
||||
33
docs/evidence/2026-10-03-026-source-check.json
Normal file
33
docs/evidence/2026-10-03-026-source-check.json
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{
|
||||
"schema": "emergent.knowledge-check.v1",
|
||||
"version": "0.2.6",
|
||||
"package_digest": "8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02",
|
||||
"sources": {
|
||||
"net-kingdom": "verified-files",
|
||||
"gate-house": "verified-files",
|
||||
"ops-warden": "verified-files",
|
||||
"ops-mason": "verified-files",
|
||||
"access-engine": "verified-files",
|
||||
"security-canon": "verified-files",
|
||||
"user-engine": "verified-files",
|
||||
"tenant-engine": "verified-files",
|
||||
"zone-engine": "verified-files",
|
||||
"whitehat-security": "verified-files",
|
||||
"kings-guard": "verified-files",
|
||||
"secrets-engine": "verified-files",
|
||||
"key-cape": "verified-files",
|
||||
"approval-engine": "verified-files",
|
||||
"informed-decision": "verified-files",
|
||||
"audit-core": "verified-files",
|
||||
"risk-nexus": "verified-files",
|
||||
"info-tech-canon": "verified-files",
|
||||
"ops-bridge": "verified-files",
|
||||
"railiance-master": "verified-files",
|
||||
"glas-harness": "verified-files",
|
||||
"the-custodian": "verified-files",
|
||||
"emergent-security": "verified-files",
|
||||
"runbook-tutorials": "verified-files"
|
||||
},
|
||||
"live_state_verified": false,
|
||||
"ok": true
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue