coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rule on unknown and the scoping axis as GH-DEC-2026-009

Browse source 
access-engine exercised the divergence capability it claimed in the v0.6
round, on the first occasion §13.1 held two rows. ops-warden resolves
unknown to fail_open, secrets-engine to fail_closed; both conformant,
both total, both test-pinned, disagreeing about the one case that by
construction nobody planned for. They also scope over different axes, so
the register cannot answer what an inventory exists to answer.

Ruling 1: unknown is not a zone and MUST fail closed. §9.3 permits
trading availability for openness per zone — and that trade requires
knowing the zone. Where the scope is unknown the trade cannot have been
made for it, so a permissive unknown does not extend a considered
decision, it invents the most permissive one. An unreachable engine is a
known request in a degraded system; an unclassified subject is not.
unknown is the cheapest state for an attacker to induce, so failing open
on it makes being unclassifiable a privilege escalation requiring no
credential, which §8's asymmetry forbids wherever it appears.

Ruling 2: each map declares its scoping axis and its relation to zone.
Forcing everyone onto zones would make secrets-engine assert a zone it
cannot know, and a fiction in a runtime-read test-pinned file is worse
than an honest incommensurability. The register records the axes and
states that cross-axis aggregation is unavailable.

ops-warden acquires one non-conformant cell at v0.8. It did everything
asked — published first, built the reference form, offered it estate-wide
— so this goes to the assent round rather than being imposed quietly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
This commit is contained in:
tegwick 2026-09-06 14:18:36 +02:00
parent 45a65c0748
commit 22915cf2a0
3 changed files with 187 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/GH-WP-0003-statute-v08-amendment-set.md
View file

@ -183,3 +183,23 @@ them and no staleness marker on the derivatives.
Drafted as A7 — a §11 marking obligation on the publisher and a §12 paragraph on the
consumer. The limit is stated in the draft: marking makes staleness visible, it does
not detect a marked derivative that is still wrong.
```task
id: GH-WP-0003-T09
status: done
priority: high
```
**`unknown` and the scoping axis (A8).** `access-engine` exercised the divergence
capability it claimed in the v0.6 round, on the first occasion §13.1 held two rows.
`ops-warden` resolves `unknown` to `fail_open` and `secrets-engine` to `fail_closed`;
both maps are conformant, total and test-pinned, and they disagree about the case
nobody planned for. The two maps also scope over different axes, so the register
cannot answer the question an inventory exists to answer.
Settled as `GH-DEC-2026-009` and drafted as A8: `unknown` is not a zone and fails
closed, because the §9.3 trade requires knowing the zone and a permissive `unknown`
makes being unclassifiable a privilege escalation needing no credential; and each map
declares its axis and its relation to zone, with the register stating what it cannot
answer rather than implying it can. `ops-warden` acquires one non-conformant cell at
v0.8 and it goes to the assent round rather than being imposed.