From 2a13c9ef71c210e3332e7b9cdca79c9136a933a0 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 21 Sep 2026 11:33:06 +0200 Subject: [PATCH] Record the GH-DEC-2026-020 round and the detector divergence. Co-Authored-By: Claude Opus 5 --- .../2026-09-21-layer-declaration-boundaries.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/assessments/2026-09-21-layer-declaration-boundaries.md b/docs/assessments/2026-09-21-layer-declaration-boundaries.md index 7c994e5..c222ec3 100644 --- a/docs/assessments/2026-09-21-layer-declaration-boundaries.md +++ b/docs/assessments/2026-09-21-layer-declaration-boundaries.md @@ -245,3 +245,18 @@ disk. The repositories' own reports had suggested a 3–3 split on the versioned its deploy manifests. TEN-IN-0005; this needs an operator credential path. - **secrets-engine** surfaced a question: the service JWT design names `tenant:coulomb`, but the approval chain resolved to `tenant:platform`. + +## Third round, 2026-09-21: GH-DEC-2026-020 + +gate-house ruled what A12 reaches (GH-DEC-2026-020, A12 r2): +- **Reached:** a version in the `standard:` path, and `companion_version`. +- **Not reached:** stance, claims and classification maps. +- **Checkers:** a re-runnable checker is sufficient if every run prints the version it checked against and its scope. kings-guard's `VALIDATED_AGAINST` pattern is the reference. + +It is applied in eleven repositories. whitehat-security, which never received GH-DEC-2026-017 and which the custodian's rounds had also missed, applied both rulings. + +The round produced the same failure a third time, now in the checkers: each wrote its own version detector, and they disagree. Measured: +- **Prose citations:** eight declarations carry a prose version citation, including gate-house's own. Seven carry the same inherited sentence, "Outside §5 by the v0.5 scope rule". The repositories split four ways on handling it while gate-house's ruling is pending. +- **`VALIDATED_AGAINST`:** five checkers name the v0.7 text in force; tenant-engine and flex-auth name the held v0.8. + +ops-warden wrote one reference detector into its playbook (0f9ada0). All of this went to gate-house, with a proposed additional v0.8 flip condition.