coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the B1 survey a command, which immediately falsified B1.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m4s
Details

Browse source 
B1 was found with a shell pipeline and published as a finding. The review it
appeared in had already argued that a mechanical check nobody can re-run is an
assertion, and §11's entire claim is mechanical checkability — so asserting B1
unmechanically was that defect committed by the repository reporting it.

tools/survey_layer_declarations.go reads both §11 forms per repository, reports
intra-repository disagreement, and writes a receipt. Run once, it showed the
published B1 was wrong: the estate does not spell layer: three ways across
repositories. The original pipeline took the first ^layer: match per repository
without recording which file it came from, reporting one value where there were
two.

The corrected finding is stronger. Nine of nine repositories carrying both §11
forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml
says engine/staff. The disagreement is within each repository, between the two
forms §11 permits, and it is universal rather than careless — two generators, two
conventions. Nobody is inconsistent with anybody else.

That relocates the question from casing to precedence: §11 accepts either form
and does not say which governs when both exist and disagree, so a conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories while both follow §11. flex-auth is the only declared repository
that cannot exhibit this, and only because it never wrote the second file.

The correction is recorded in the review rather than edited away: a published
review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no
exception for the reviewer.

Four tests cover the disagreement case, the refusal to fold case, a missing
declaration, and the single-form shape that must not read as self-disagreement.
The survey checks only the §3 vocabulary and never applies flex-auth's house
rules to peers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 01:24:15 +02:00
parent 7e1bbaab6e
commit e8d6d08f79
7 changed files with 969 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

46
docs/conformance/boundaries-review.md
View file

@ -50,7 +50,7 @@ Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.
| # | Finding | Owner |
| --- | --- | --- |
| B1 | `layer:` casing is inconsistent across ten declarations; §11 calls the check mechanical, and flex-auth's own validator would fail eight of them | `gate-house` |
| B1 | **Corrected 2026-09-21.** Nine of nine repositories carrying both §11 forms declare a different `layer:` value in each. §11 does not say which form governs | `gate-house` |
| B2 | `gate-house`, `key-cape`, `ops-mason`, `net-kingdom` carry no machine-readable layer declaration | each named repository |
| B3 | flex-auth declares no emission guarantee; whether it owes one turns on an unruled boundary with `audit-core` | `gate-house`, `audit-core` |
| B4 | a layer declaration should not pin a standard version; if §11 agrees it should say so generally | `gate-house` |
@ -66,3 +66,47 @@ Full statements in `workplans/FLEX-WP-0030-boundary-declaration-cleanup.md` T04.
the thing that changes.
- **Not a grade.** §9.3's two-owner split is flex-auth's own finding and it cuts
here: the PDP does not get to score the repositories whose facts it consumes.
## Correction — B1, 2026-09-21
**The first published version of B1 was wrong, and it was wrong in a way this
review exists to prevent.**
It reported that the estate spelled `layer:` three ways *across* repositories,
and named eight as non-conformant on casing. That came from an ad-hoc shell
survey run while writing this document. The survey took the first `^layer:` match
per repository across two files without recording which file it came from, so it
reported one value where there were two.
Re-run mechanically (`tools/survey_layer_declarations.go`, receipt at
`docs/evidence/2026-09-21-layer-declaration-survey.json`), the finding is
different and stronger:
| | |
| --- | --- |
| Repositories carrying **both** §11 forms | 9 |
| Of those, forms that **disagree** | **9 of 9** |
| Shape | `INTENT.md` says `Engine` / `Staff`; `layer.yaml` says `engine` / `staff` |
| Repositories with only one form | 1 — `flex-auth`, which has no `layer.yaml` |
The disagreement is **within** each repository, between the two forms §11
permits, and it is universal rather than sloppy — two generators, two
conventions, no repository mixing them. Nobody is inconsistent with anybody else.
That relocates the question. §11 accepts *"a `layer:` key in the `INTENT.md`
frontmatter, **or** an equivalent declaration file"* and does not say which
governs when a repository carries both and they disagree. A conformance run
reading `INTENT.md` and one reading `layer.yaml` reach different answers for nine
repositories, and both are following §11.
flex-auth is the only declared repository that cannot exhibit this, and only
because it never wrote the second file — not a virtue.
**What this cost.** The wrong version went to `gate-house` and five engine
repositories before it was checked. Corrections were sent the same day. The
review had already said a mechanical check nobody can re-run is an assertion, and
then asserted B1 from a shell pipeline — which is why B1 is now a command with
tests and a receipt, and why this correction is recorded here rather than edited
away. A published review corrected silently is `FLEX-DEC-2026-008`'s defect, and
that rule does not have an exception for the reviewer.