diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 18918da..d0f23c2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -21,6 +21,36 @@ bash scripts/agent-check.sh full Follow `AGENTS.md` for authority-impact evidence, downstream acceptance, and the applicable contribution workflow. +These commands validate local repository contracts and the portable automation +profile; they do not launch a Coven daemon. Required current-checkout +compatibility and the scheduled canary remain work under #31. Use the +[delivery strategy](docs/strategy.md) for sequencing and owner-specific +acceptance rather than repeating a completed historical plan. + +## Solo-maintainer merge policy + +You can land an approved change without inventing a second reviewer. The +maintainer [authorized this policy](https://github.com/OpenCoven/coven-threads/issues/31#issuecomment-5642501227) +for the solo-maintainer repository on 2026-09-12 (UTC). + +Use a pull request, record the human approval and its scope on GitHub, resolve +review conversations with their actual disposition, and satisfy the required +checks against an up-to-date branch before merging. Agents need explicit human +authorization; a passing check, model review, or persona is not approval. +Material changes outside the approved scope need renewed authorization. + +Ruleset `22910327` requires no approving review and disables latest-push and +extra unattributed-change approvals. It retains pull requests, resolved review +threads, stale-review dismissal, four strict required GitHub Actions checks, +and deletion/non-fast-forward protection, with no bypass actors. GitHub +enforces those controls, but does not enforce the conversational human-approval +process or provide independent review. + +See the [governance ledger](docs/phases.md#repository-governance-baseline-active-boundary-enforcement-outstanding) +for exact checks and rollback. Reassess independent review when another +maintainer joins. This repository merge policy does not change protected-write +authority or waive the design gates below. + ## Design gates The Phase-0 design freeze is complete. Phase-5 remediation, Nova's independent coherence review, and Val's freeze remain outstanding. Agents may prepare evidence; they cannot replace either human decision. diff --git a/README.md b/README.md index db60259..4946991 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,14 @@ # coven-threads -**Status (2026-09-09):** Engineering phases 0โ€“4 are **frozen**. Phase 5 is **active**, with four unresolved implementation blockers and independent Nova/Val gates still outstanding. Coven `v0.4.3` includes the earlier daemon integration and pins Threads to `c102844`; release ancestry does not prove full Phase-5 conformance or current-checkout compatibility. See [the delivery ledger](docs/phases.md) for evidence, draft fixes, and the real-daemon work graph. -**License:** stated as Apache-2.0 (planned) in the design doc; the committed `LICENSE` file is currently MIT โ€” a known discrepancy pending reconciliation (see `docs/STATUS-2026-07-15.md` ยง6). +**Status (2026-09-11):** Engineering phases 0โ€“4 remain **frozen**. Phase 5 is **active**, with four unresolved remediation gates and independent Nova/Val decisions outstanding. Baseline protection now enforces reviews and four existing checks on `main`; required pinned-daemon acceptance is still missing. Coven `v0.4.3` includes the earlier integration, not proof of full Phase-5 conformance. Start with the [delivery strategy](docs/strategy.md), [evidence ledger](docs/phases.md), and [readiness review](docs/reviews/2026-09-11-landscape-and-readiness.md). +**License:** the committed `LICENSE` and Cargo package metadata specify MIT. The frozen design retains an older Apache-2.0 plan; reconciling that historical text requires a maintainer decision, not an inferred license change. **Owners (design phase):** Sage ๐ŸŒฟ + Echo ๐Ÿ”ฎ co-drive; Nova ๐Ÿ‘‘ + Sage on lane assignments; Cody โšก Phase 1+ crate lane --- ## What this is -`coven-threads` is OpenCoven's **authority-boundary gate layer**: the external, structural enforcement contract that sits *above* the `coven` Rust daemon's untrusted-client boundary, and *underneath* every familiar's protected memory surface. +`coven-threads` is OpenCoven's **protected-authority validator**, imported inside the trusted `coven` daemon. Threads defines typed validation contracts; the daemon owns authentication, protected writes, persistence, and recovery. In the vocabulary of the Familiar Contract (RFC-0001) and the Ward v0.2 spec: this is the *gate-shaped receiver* on which Ward's four validation gates sit. Ward specifies **what** the gates check; `coven-threads` specifies **how** they are enforced, by an authority outside familiar cooperation. @@ -30,6 +30,8 @@ User-facing docs live in [`docs/`](docs/README.md): - [Automation Authority Profile](docs/automation-authority-profile.md) โ€” operation-specific permit / approval / proposal / reject decisions, replay-safe approval evidence, and portable vectors. - [Channels and strands](docs/channels-and-strands.md) โ€” the four channels, the five strand kinds, WARD-C1โ€“C7. - [Phases](docs/phases.md) โ€” what is frozen, what is implemented, what is active, what is blocked. +- [Delivery strategy](docs/strategy.md): ordered workstreams, owners, acceptance evidence, and release gates. +- [Readiness review](docs/reviews/2026-09-11-landscape-and-readiness.md): the dated documentation audit and engineering recommendations for #13, #31, #40, and #46. - [FAQ](docs/faq.md) ยท [Glossary](docs/glossary.md) The frozen design doc is [`specs/PHASE-0-DESIGN.md`](specs/PHASE-0-DESIGN.md); the docs describe it and never amend it. @@ -52,7 +54,11 @@ replace its trust boundary or own filesystem and persistence effects. The remaining work is complete route, predicate, and replay enforcement, not the absence of any integration. -![The shipped Phase 2 enforcement flow: client request through Ward::evaluate, blocked proposals refused as a unit, the coven-threads gate validating each protected target fail-closed, and the three verdicts โ€” Reject (403), DegradeToProposal (staged at ~/.coven/pending/), Permit (Ward::apply) โ€” with every verdict appended to the append-only ward_audit table](docs/diagrams/enforcement.png) +![Historical Phase-2 enforcement flow, not current protected-proposal acceptance](docs/diagrams/enforcement.png) + +This historical diagram includes a staging branch that must not be read as +protected-write authority. The current contract rejects proposals touching +protected surfaces; see the [authority model](docs/authority-model.md). ## The weaving metaphor @@ -96,7 +102,7 @@ Honest labels; the detailed ledger is [docs/phases.md](docs/phases.md). ## Anti-goals - **Not a general-purpose policy engine.** This is a *typed* authority layer for OpenCoven familiar surfaces. Reusability is a nice-to-have; typed correctness is the goal. -- **Not a runtime-portability format.** That's Phase 3's job. Phase 0 is enforcement design, not export. +- **Not a runtime implementation.** Threads owns the `.weave` portability contract and lossy one-way `.af` export. Coven owns runtime adoption and effects; an imported artifact grants no authority by itself. - **Not `.af`-compatible.** Documented divergence, source-verified 2026-07-14: Letta's `CoreMemoryBlockSchema` has no protection field and runtime `read_only` is stripped at export โ€” silent downgrade on import is exactly what WARD-C7 refuses. See [docs/faq.md](docs/faq.md#why-isnt-it-af-compatible). ## Related diff --git a/SECURITY.md b/SECURITY.md index c5c19de..d612d9c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,19 +27,18 @@ pull requests and pushes to `main`. It needs no private stores, Beads database, credentials, or downstream checkout. Third-party Actions retain immutable commit pins and the existing explicit Rust toolchain parity checks. -**Separate privacy rollout (#39, #40):** the `Privacy policy guard` job runs on +**Separate privacy rollout (#39, #40; 2026-09-12 UTC):** the `Privacy policy guard` job runs on pull requests and pushes to `main`, separately from secret scanning. The maintainer-approved correction to the historical Phase-5 source reference -preserves provenance -without retaining the private runtime location; it changes no normative -authority decision and adds no scanner exemption. +preserves provenance without retaining the private runtime location; it changes +no normative authority decision and adds no scanner exemption. -Both guards passed at candidate `2a12c1ad6f813b636f49f1c17bbd3ff7cb65aaee` -in [CI run 34610860329](https://github.com/OpenCoven/coven-threads/actions/runs/34610860329). -That is evidence for the named revision, not every subsequent head. The landed -`Secret scanning` job remains unchanged. Privacy is not a required branch -check; activation requires a separate maintainer decision. Landing the job -does not change the ruleset. +#40 merged at `7168dae10f6b59bad8bc653b95f51911334ded74`, after +[combined-head CI](https://github.com/OpenCoven/coven-threads/actions/runs/34664678160) +passed at `2d17d0d4583801b1dfa831c7ca40a03930ceef80`. The correction and privacy +job are now on `main`. Privacy is not a required branch check; activation +requires a separate maintainer decision. The existing `Secret scanning` job +and required-check contexts are unchanged. From the repository root: @@ -97,10 +96,11 @@ not certify daemon authority, deployed behavior, branch protection, or human review. Pull-request code can modify CI, so maintainer review and required-check policy remain separate controls. -"Independent" means a separate privacy job, not an immutable checker that -PR authors cannot modify. A stronger enforcement policy must also govern the -calling workflow. Do not execute untrusted PR code in a privileged workflow -context as a shortcut. +"Independent" describes a separate privacy job, not a checker that PR authors +cannot modify. An immutable enforcement design must also govern the calling +workflow. Do not execute untrusted PR code in a privileged workflow context +as a shortcut. Current repository CI does not prove daemon authority or +current-checkout downstream compatibility; see the [delivery strategy](docs/strategy.md). Policy provenance: adapted the categories and separate default-secret scan from `OpenCoven/coven-memory` at diff --git a/docs/README.md b/docs/README.md index bc8896f..b1980c1 100644 --- a/docs/README.md +++ b/docs/README.md @@ -8,14 +8,24 @@ findings. If you are new here, read [concepts.md](concepts.md) first. Everything else assumes its vocabulary. -## Current status (2026-09-09) +## Current status (2026-09-12 UTC) - **Phase 0 (design) โ€” `[FROZEN]`.** The design doc `specs/PHASE-0-DESIGN.md` is frozen at v0.2 (2026-07-14, tag `v0.2-phase0-design`), with Nova sign-off and an RFC-0001 ยง5 round-trip verified. - **Phases 1โ€“2: `[FROZEN; IN RELEASE TAG]`; Phase 3: `[ENGINEERING FROZEN]`.** Coven `v0.4.3` includes the daemon integration and pins Threads to `c102844`. This is release-source provenance, not verification of deployed configuration or current-checkout compatibility. Phase 3 retains the decided `.weave` envelope and lossy one-way `.af` export semantics. - **Phase 4: `[FROZEN]` (2026-07-17).** The four Cave surfaces and their recorded human gates are complete under `threads-986.17`. The daemon-adapter follow-up `threads-v3g` and degraded-familiar follow-up `threads-k9s` are closed. See the delivery ledger for merge evidence. - **Phase 5: `[ACTIVE]`.** The earlier core, scheduler, Cave contract (`.7`), and RFC alignment (`.12`) implementation beads are closed. Four daemon-boundary blockers still prevent coherence sign-off. The shared harness and protected/terminal fixes are draft checkpoints, and neither Nova's review nor Val's freeze can be replaced by agent evidence. See [phases.md](phases.md) for the work graph and [the E2E contract](testing/e2e-contract.md) for closure requirements. -These docs describe the **frozen design**. Where implemented code goes beyond or refines the design, that is labeled explicitly. See [phases.md](phases.md) for the full breakdown. +Baseline `main` protection is active under the +[authorized solo-maintainer policy](../CONTRIBUTING.md#solo-maintainer-merge-policy). +The separate privacy job has landed, but is not a required check. The required +pinned-daemon check and scheduled canary are not wired. The Automation Authority Profile v1 is a +separate shipped schema/reference-validator contract, not evidence of daemon +adoption or a replacement for the Rust gate. + +These docs describe frozen and active contracts without amending them. Use the +[delivery strategy](strategy.md) for sequencing, the [ledger](phases.md) for +delivery evidence, and the [dated readiness review](reviews/2026-09-11-landscape-and-readiness.md) +for findings and remaining acceptance obligations. ## Who this is for @@ -33,6 +43,9 @@ These docs describe the **frozen design**. Where implemented code goes beyond or | [automation-authority-profile.md](automation-authority-profile.md) | Operation-specific automation authority, approvals, proposal-only downgrade, replay/TOCTOU, privacy, and portable vectors. | | [channels-and-strands.md](channels-and-strands.md) | The four channels of load, the five strand types, which strands each channel structurally requires, WARD-C1โ€“C7. | | [phases.md](phases.md) | Phase 0 โ†’ 5 with honest status labels: what is frozen, what is implemented, what is active, what is blocked. | +| [strategy.md](strategy.md) | Workstream order, canonical owners, closure evidence, and release prerequisites. GitHub issues and Beads retain task status. | +| [Readiness review](reviews/2026-09-11-landscape-and-readiness.md) | Dated landscape, documentation corrections, and engineering recommendations for the open review gates. | +| [E2E contract](testing/e2e-contract.md) | Real-daemon topology, eight required journeys, deterministic time, and blocker-closure evidence. | | [faq.md](faq.md) | Anticipated questions, answered honestly with sources. | | [glossary.md](glossary.md) | Every named term, one line each, alphabetical, with links to depth. | @@ -50,3 +63,11 @@ WARD-C1โ€“C7. `coven/docs/SAFETY-MODEL.md` describes the daemon boundary; it doe not replace the source precedence above. Diagrams in `diagrams/` are legibility aids derived from the design doc; they are not authoritative (see `diagrams/README.md`). + +## Historical plans and reports + +The [July status report](STATUS-2026-07-15.md), [ApplyAudit design](superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md), +and [ApplyAudit implementation plan](superpowers/plans/2026-07-19-apply-audit-migration-repair.md) +preserve earlier checkpoints. Do not execute their completed tasks or treat +their old counts as current acceptance. Rendered diagrams, the PDF, and slides +are explanatory snapshots, not release evidence. diff --git a/docs/architecture.md b/docs/architecture.md index f2f6a03..eb03d51 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -1,6 +1,6 @@ # Architecture -> Status: the enforcement flow on this page is `[DESIGNED]` (frozen, `specs/PHASE-0-DESIGN.md` ยง5) with the crate implementation in `coven-threads-core` and the daemon-side call site **merged to coven `main`** (PR https://github.com/OpenCoven/coven/pull/382, 2026-07-15). Daemons built from coven `main` route tier-0 protected-surface edits through this flow. +> Status: the Phase-0 contract is frozen, and the original daemon call site merged through OpenCoven/coven#382. The required flow below is not certification of every current route. Four Phase-5 remediation gates remain open; consult the [delivery ledger](phases.md). Vocabulary reminder (bound in full in [concepts.md](concepts.md)): a **Thread** is an authority relationship *surface โ†’ writer*; a **Weave** is the enforced pattern of threads across a familiar; a **Strand** is a fiber inside a thread (hash, signature, manifest entry, audit trail, serialization marker); a **Channel** is the axis of load a thread must hold under. @@ -20,7 +20,7 @@ The daemon imports Threads to validate requests against the typed authority stat Two structural facts follow from this placement: -1. **`coven-threads` is a crate, not a service.** It is imported into the daemon and reachable *only* by the privileged daemon process โ€” never by a familiar-controlled process. There is no socket to coven-threads, no separate process to restart, no config file a familiar could edit. This is how the layer satisfies RFC-0001 ยง5.1's three MUST-NOTs (a familiar must not modify the Ward file, must not restart the authority process, must not bypass gates): there is nothing familiar-reachable *to* modify, restart, or bypass. +1. **`coven-threads` is a crate, not a service.** Any program can call the public library, but a client-side result grants no authority. Only the trusted daemon's validation of authoritative inputs can govern its effects. There is no separate Threads socket or process. RFC-0001 ยง5.1's separation requirements depend on daemon authentication and deployment isolation, not on hiding the crate from familiar-controlled code. 2. **The wire format does not change.** Clients speak the same socket protocol before and after integration. The only client-visible difference (Phase 2) is a new possible outcome on mutation requests: `DegradeToProposal`. ## Relationship to RFC-0001 and to Ward @@ -38,7 +38,7 @@ The design doc's framing: the boundary (ยง5.1) was spec'd and the daemon existed ![Enforcement flow](diagrams/enforcement.png) -*Client โ†’ daemon โ†’ coven-threads validator โ†’ weave load โ†’ strand check under channel โ†’ Permit / DegradeToProposal / Reject โ†’ `ward.audit`.* +*Historical Phase-2 diagram. Its staging branch is not permission to stage or approve protected targets. The steps below state the current required contract.* The flow, step by step (design doc ยง5): @@ -79,7 +79,7 @@ The placement rule from the top of this page carries straight through. `coven-th - **`ProposalClassification`** โ€” the append-only record produced at intake: the channel the mutation arrived on, affected surfaces and semantic regions, the floor path tier, the required approval path (highest ceremony of everything touched wins, all-or-nothing โ€” matching existing Ward behavior), and the **`evidence_replay_hash`** committing to the gate evidence evaluated at classification. - **`WindowCloseReason`** and the audit-detail shapes for the lifecycle rows below. -The **daemon** owns proposal classification and the delayed-apply scheduler โ€” both landed in the coven daemon (PR #430, bead `threads-uqx.6`). This crate does not ship a scheduler; it defines the record the scheduler must honor. +The **daemon** owns proposal classification and the delayed-apply scheduler, initially merged through OpenCoven/coven#430 (`threads-uqx.6`). This crate defines the record the scheduler must honor. Initial delivery does not close the later route, identity, terminal, and recovery findings. ### The delayed-apply flow @@ -98,6 +98,13 @@ The flow (spec decision 2 โ€” delayed apply *only*): `AutoRegression { veto: None }` has no veto period. `HumanApproval` and `HumanApprovalWithRationale` wait for explicit approval rather than a veto-window deadline. These non-windowed paths still require final live revalidation. The flow above describes the required contract, not proof that every daemon route currently satisfies it. +The [2026-09-11 readiness review](reviews/2026-09-11-landscape-and-readiness.md#phase-5-engineering-review) +identifies two specific acceptance gaps at the inspected draft: its supported +scheduled producer cannot produce `AutoRegression` with the built-in region +floors, and the diff/region replay hash does not itself bind identity +predicate evidence at classification. Later live checks and final-commit +binding do not, by themselves, close those obligations. + There is **no provisional apply, ever**: the daemon never applies first and rolls back on veto. And Gate 4 keeps its fail-closed posture unweakened โ€” every path, windowed or not, ends in live daemon re-materialization before apply. One conflation to refuse, because it was a HIGH finding in the independent coherence review: **Channel and ApprovalPath are orthogonal axes**, both first-class. Channel remains the frozen Phase-0 load/enforcement axis; ApprovalPath is the promotion ceremony; **never derive ApprovalPath from Channel** (spec decision 1). The binding is spelled out in [concepts.md](concepts.md#channel-vs-approvalpath-two-orthogonal-axes). diff --git a/docs/automation-authority-profile.md b/docs/automation-authority-profile.md index e4c5c73..ed64d1e 100644 --- a/docs/automation-authority-profile.md +++ b/docs/automation-authority-profile.md @@ -14,6 +14,12 @@ semantically widened or forged decision authoritative. The profile deliberately does not schedule or run anything. Coven owns durable scheduler state, final revalidation, consumption, launch, and effects. +**Delivery:** #35 ships profile version `1.0.0` as a portable reference bundle, +separately from Rust package version `0.2.0`. Its four automation outcomes are +not additions to the Rust gate's three verdicts. Local CI exercises the bundle; +it does not establish daemon or consumer adoption. See the +[delivery strategy](strategy.md) for those separate obligations. + Final revalidation consumes the raw signed approval-event chain plus a Threads-signed, revision-bound consumption snapshot. A client-authored `approved` summary is never authority. Human approval requires the authorized diff --git a/docs/channels-and-strands.md b/docs/channels-and-strands.md index b94fb6e..1b3af4b 100644 --- a/docs/channels-and-strands.md +++ b/docs/channels-and-strands.md @@ -16,6 +16,10 @@ The core insight of this page: a thread does not "hold" in the abstract. It hold Familiar-initiated, principal-gated compaction: memory promotion, dreaming, deliberate flush. This is the *consented* half of the two-compaction contract โ€” the familiar (or its person) chooses to consolidate scratch memory into durable memory, and the act flows through the Ward gates as a reviewable proposal. +> Runtime status: this is the channel contract, not a shipped promotion +> command. `threads-xpo` tracks daemon reachability; draft #25 describes the +> future seam. Neither makes `coven memory promote` an available command. + Because consent and review are present, `Deliberate` imposes **no structural strand floor** beyond an intact thread: the gate here is the principal's consent path, not a cryptographic survival requirement. That is not laxity โ€” it is a recognition that the protection on this channel is procedural (tiers, review, veto windows per RFC-0001 ยง5.3) rather than structural. Phase 5 (active, not frozen) defines `VetoWindow` in `coven-threads-core`. For windowed proposals, **delayed apply only** means no apply until the deadline and minimum-visible floor are satisfied, no veto exists, and live evidence revalidation succeeds. Non-windowed approval paths still require their applicable ceremony and final live revalidation. Protected targets are not proposal-eligible. Every opened window receives exactly one typed terminal close. See [the approval flow](architecture.md#phase-5-approval-semantics-and-delayed-apply). @@ -90,4 +94,4 @@ The composition rule is a single sentence from the design (ยง2.3): **a thread su - What happens when strands fail: [authority-model.md](authority-model.md) - Where the checks run and land: [architecture.md](architecture.md) -- The portability format that will wrap `Serialization` in practice: [phases.md](phases.md) (Phase 3) +- The implemented `.weave` portability contract: [Phase 3](phases.md#phase-3--portability-format-engineering-frozen-envelope-decided) diff --git a/docs/concepts.md b/docs/concepts.md index 416dd29..dc6a85f 100644 --- a/docs/concepts.md +++ b/docs/concepts.md @@ -21,7 +21,11 @@ A thread has **tension**: it either holds under load, or it degrades. Load means That question is what the metaphor buys us. It is the enforcement vocabulary of the whole layer, and it appears in the type sketch as `Thread::holds_under(channel)`. -Threads are first-class inspectable objects. The design requires that `coven-threads inspect ` return the thread's current tension state (Holds / Frayed / Snapped โ€” see [authority-model.md](authority-model.md) for the state machine). +Threads are first-class inspectable objects. The frozen design sketches +`coven-threads inspect `, but this repository ships a library, not +that executable. Inspection must use a supported daemon or Cave surface. +See the [tension state machine](authority-model.md#the-thread-tension-state-machine) +for `Holds`, `Frayed`, and `Snapped`. ## Weave โ€” the enforced pattern of threads diff --git a/docs/diagrams/README.md b/docs/diagrams/README.md index 7127f02..80cb581 100644 --- a/docs/diagrams/README.md +++ b/docs/diagrams/README.md @@ -1,12 +1,20 @@ # Architecture diagrams -Source-authoritative diagrams for `coven-threads`. Every rendered artifact -(`.svg`, `.png`) is generated from a committed source in [`src/`](src/) โ€” -rendered files are never hand-edited. If a diagram disagrees with +These diagrams explain `coven-threads`; they are not authority or current +acceptance evidence. Every rendered artifact (`.svg`, `.png`) is generated +from a committed source in [`src/`](src/). Rendered files are never +hand-edited. If a diagram disagrees with `specs/PHASE-0-DESIGN.md` (FROZEN v0.2), `specs/PHASE-5-APPROVAL-SEMANTICS.md` (decision record), or the shipped crate, the diagram is wrong; recreated 2026-07-15 against both (bead `threads-986.22`). +> Historical scope: `enforcement` depicts the original Phase-2 integration, +> including a staging branch that must not authorize protected proposals. +> `delayed-apply-scheduler` illustrates the intended windowed lifecycle, not +> complete acceptance of every approval path. Read the current +> [authority model](../authority-model.md) and [delivery ledger](../phases.md) +> alongside these snapshots. This audit does not certify the PDF or slide deck. + | Diagram | What it shows | Form (why) | Source of truth | |---|---|---|---| | `stack.{svg,png}` | Where the gate layer sits: familiar-controlled processes โ†’ daemon trust boundary (containing `coven-threads-core` as the imported validator crate) โ†’ protected surfaces, with the RFC-0001 ยง5.1 no-write-path cut drawn | flowchart with containment subgraph + forbidden edge โ€” the containment *is* the Phase 2 architecture | PHASE-0-DESIGN ยง1, ยง3.1โ€“3.2; RFC-0001 ยง5.1; `coven/docs/SAFETY-MODEL.md` | diff --git a/docs/faq.md b/docs/faq.md index 1db7fe0..897b768 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -69,7 +69,7 @@ Could you bend it into a general policy engine? Probably, and the design treats This is *the* right question, and the answer has two honest halves. -**Within the boundary the system defines:** no. RFC-0001 ยง5.1 requires that familiar-controlled processes have *no write path* to the daemon's authority surface, and the reference architecture runs familiars behind the daemon boundary โ€” the untrusted client speaks over the socket, the daemon revalidates everything, and coven-threads is a crate inside the daemon, unreachable from familiar-controlled code (design doc ยง3.2). A familiar cannot modify the Ward file, restart the authority process, or bypass the gates, because there is nothing familiar-reachable to modify, restart, or bypass. +**Within a conforming deployment:** RFC-0001 ยง5.1 requires that familiar-controlled processes have no write path to the authority surface, cannot restart the authority process, and cannot bypass the gates. The daemon must enforce those requirements with authentication, live validation, and process/filesystem isolation. Calling the public Threads library from familiar-controlled code grants no daemon authority. Library placement alone does not establish isolation, and the [Phase-5 findings](phases.md) remain relevant to runtime conformance. **Outside that boundary:** physics still applies. If a familiar-controlled process runs with raw OS write access to the protected files โ€” same user, no sandbox โ€” then yes, it can write the bytes, and no userspace gate can stop it. RFC-0001 is explicit that convention-based protection *is not* a protected surface (ยง5.1); the flip side is that the enforcement claim is only as strong as the actual process isolation underneath it. What the thread layer guarantees in that case is **detection, not prevention**: the out-of-band write breaks the `ContentHash` strand's commitment, the thread frays or snaps on next verification, the surface degrades to read-only through the gate, and the event is legible in `ward.audit` โ€” tampering is caught by re-derivation from source, not silently absorbed (ยง3.3.1). @@ -107,9 +107,20 @@ Deriving one from the other would collapse *where a write lands* with *which cer ## How do veto windows preserve Gate-4 fail-closed? -By writing nothing before the deadline, and trusting nothing staged before it (decisions 2 and 8). - -Phase 5 permits exactly one veto-window semantics: **delayed apply**. A proposal that passes its gates does not get written โ€” it stages *pending-visible* through a `VetoWindow`, which carries both a `duration` and a `min_visible` floor guaranteeing the pending state was actually reachable by a human long enough to act on (same shape as the two-compaction contract's minimum-visibility requirement). At the deadline the daemon applies only if (a) no veto exists and (b) **live evidence replay matches**: it re-materializes the gate evidence and re-derives the classification's `evidence_replay_hash`. If the result differs, the proposal is rejected (`evidence_diverged`); if replay cannot produce authoritative evidence at all, it is rejected fail-closed (`revalidation_failed`). This is WARD-C7 generalized: evidence must survive the time gap, and a proposal whose evidence cannot be replayed at deadline fails closed โ€” Gate 4's "final canonical check before apply" posture is preserved because *every* apply still happens after a live daemon re-materialization, never off a stale snapshot. +The contract permits **delayed apply** only: a windowed proposal cannot write +before its deadline and minimum-visible floor. The daemon must keep it +pending-visible long enough for a human to act, then require no veto, matching +live evidence, and final Gate-4 revalidation before committing. + +`VetoWindow` represents the timing constraints; its presence alone does not +prove UI reachability. Likewise, `evidence_replay_hash` commits materialized +diff and region evidence, not every identity or runtime binding. The inspected +draft reconstructs that hash at scheduled-envelope load and performs live +checks at apply. Classification-time identity binding remains an explicit +[acceptance gap](reviews/2026-09-11-landscape-and-readiness.md#phase-5-engineering-review). +These implementation details do not narrow the required live-evidence +contract. Divergence requires `evidence_diverged`; unavailable authoritative +evidence requires `revalidation_failed`. Provisional apply โ€” write now, roll back on veto โ€” is explicitly forbidden until Val/Nova accept rollback semantics as a distinct threat model. And the window is a first-class audit interval, not a gap: every close event carries a typed `WindowCloseReason` (`applied | vetoed | evidence_diverged | revalidation_failed | superseded`). Deadline expiry is a trigger for revalidation, not a terminal state โ€” there is no `proposal_expired`. diff --git a/docs/glossary.md b/docs/glossary.md index 2753c2b..627a59b 100644 --- a/docs/glossary.md +++ b/docs/glossary.md @@ -8,14 +8,14 @@ One line per term; the link points at the doc that defines it in depth. Where a - **AuditTrail (strand)** โ€” provenance strand: first-seen timestamp plus a reference into the `ward.audit` event log. โ†’ [channels-and-strands.md](channels-and-strands.md#audittrail) - **Channel** โ€” (*axis of load a thread must hold under*): `Deliberate`, `Forced`, `Serialization`, or `Mutation`. โ†’ [concepts.md](concepts.md#channel--the-axis-of-load) - **ContentHash (strand)** โ€” hash commitment to a protected surface's content; structural floor on `Mutation` and `Forced`. โ†’ [channels-and-strands.md](channels-and-strands.md#contenthash) -- **Coven Cave** โ€” the cockpit UI that renders weaves, threads, and strands, and hosts the proposal approval flow (Phase 4, complete and frozen 2026-07-17; merged via coven-cave PR #3223). โ†’ [phases.md](phases.md#phase-4--coven-cave-ux-complete-frozen-2026-07-17) +- **Coven Cave**: the cockpit UI that renders weaves, threads, and strands, and forwards proposal approvals (Phase 4, frozen 2026-07-17; OpenCoven/coven-cave#3223). It is not approval authority. See [Phase 4](phases.md#phase-4--coven-cave-ux-complete-frozen-2026-07-17). - **`coven` daemon** โ€” the shipped Rust trust boundary; every client is untrusted for enforcement purposes (`coven/docs/SAFETY-MODEL.md`). โ†’ [architecture.md](architecture.md#where-coven-threads-sits) - **`DegradeToProposal` (verdict)**: a fray on a covered channel or a missing required strand kind; no direct write. The daemon may stage proposal-eligible targets, but MUST reject proposals touching protected surfaces. โ†’ [Authority model](authority-model.md#degradetoproposal) - **Delayed apply** โ€” the only permitted veto-window semantics: the proposal stages pending-visible, and the daemon writes only after the deadline passes with no veto *and* a matching live evidence replay; provisional apply (write-then-rollback) is forbidden (Phase 5). โ†’ [PHASE-5-APPROVAL-SEMANTICS.md](../specs/PHASE-5-APPROVAL-SEMANTICS.md#4-veto-windows-vs-synchronous-gates) - **Deliberate (channel)** โ€” familiar-initiated, principal-gated compaction (promotion, dreaming, flush); the consented half of the two-compaction contract. โ†’ [channels-and-strands.md](channels-and-strands.md#deliberate) - **Descriptor** โ€” see *PatternDescriptor*. - **Dreaming sweep** โ€” the consented, curated memory consolidation that flows through the gates as a proposal; contrast auto-compact. โ†’ [concepts.md](concepts.md#the-two-compaction-contract) -- **`evidence_replay_hash`** โ€” Blake3 commitment on `ProposalClassification` over the materialized diff and region evidence; the daemon re-materializes and re-derives it live at the delayed-apply deadline and rejects on divergence โ€” Gate-4 fail-closed, WARD-C7 generalized (Phase 5). โ†’ [PHASE-5-APPROVAL-SEMANTICS.md](../specs/PHASE-5-APPROVAL-SEMANTICS.md#4-veto-windows-vs-synchronous-gates) +- **`evidence_replay_hash`**: Blake3 commitment on `ProposalClassification` over materialized diff and region evidence. Matching this field alone does not prove identity binding or final live authority; those remain daemon obligations. See [replay requirements and implementation limits](faq.md#how-do-veto-windows-preserve-gate-4-fail-closed). - **Fail-closed** โ€” every unknown (surface, thread, channel, panic) resolves to `Reject`; a conformance requirement per RFC-0001 ยง5.4, not a feature. โ†’ [authority-model.md](authority-model.md#fail-closed-is-a-conformance-requirement-not-a-feature) - **Forced (channel)** โ€” runtime-initiated context compaction with no familiar cooperation available; governed by WARD-C1โ€“C6. โ†’ [channels-and-strands.md](channels-and-strands.md#forced) - **`Frayed` (tension state)**: a recorded strand failure, repairable in place; MUST surface to the operator. It yields `DegradeToProposal` on a covered channel; an uncovered channel rejects. โ†’ [Frayed threads](authority-model.md#frayed) diff --git a/docs/phases.md b/docs/phases.md index e0be918..7b2fd36 100644 --- a/docs/phases.md +++ b/docs/phases.md @@ -2,7 +2,28 @@ > This page separates design approval, merged implementation, release provenance, and end-to-end proof. `[FROZEN]` means design complete and change-controlled; `[MERGED]` means present on downstream `main`; `[IN RELEASE TAG]` means included in a published release's source revision, not a claim about any running installation; `[ENGINEERING FROZEN]` means implementation complete at the recorded checkpoint. `[ACTIVE]`, `[BLOCKED]`, and `[NOT STARTED]` describe remaining work. > -> **As of 2026-09-12 (UTC): phases 0โ€“4 remain frozen, and Phase 5 remains active with four unresolved remediation gates.** Daemon and Cave release tags include the earlier integration. The latest recorded draft checkpoint passes native Windows journeys, but earlier startup failures remain unexplained; green observations are not a reliability repair. Two bounded production fixes have landed independently. Full boundary acceptance and independent coherence/freeze decisions remain outstanding. +> **As of 2026-09-12 (UTC): phases 0โ€“4 remain frozen, and Phase 5 remains active with four unresolved remediation gates.** Baseline `main` protection is active under the authorized solo-maintainer policy. The latest recorded daemon draft passes native Windows journeys, but earlier startup failures remain unexplained and the required current-checkout compatibility lane is absent. Full boundary acceptance and independent coherence/freeze decisions remain outstanding. + +Read the [delivery strategy](strategy.md) for the order of work and the +[2026-09-11 readiness review](reviews/2026-09-11-landscape-and-readiness.md) +for exact-head findings. This page preserves historical evidence with its +original dates; a later observation does not transfer acceptance between heads. + +## Current decision + +The engineering recommendation is to keep Phase 5 active, not to freeze it. +OpenCoven/coven#931 remains an unmerged draft at +`8576f41e6d622f63a3576b85bd2d3142776e59ca`; the 2026-09-11 refresh reports +merge conflicts with current `main`. Resolve and review the combined head +before relying on its earlier green result. + +Two source-level acceptance gaps need explicit treatment: the supported +scheduled producer cannot produce `AutoRegression` with the built-in region +floors, and its classification replay hash covers diff/region evidence rather +than the identity predicate/evidence digest required by OpenCoven/coven#885. +Later live identity checks and final-commit binding are progress, not proof of +that earlier commitment. The readiness review maps these limits to all eight +#13 checklist items without checking any human gate. Vocabulary (bound in [concepts.md](concepts.md)): **Thread** = authority relationship *surface โ†’ writer*; **Weave** = enforced pattern of threads; **Strand** = fiber inside a thread; **Channel** = axis of load. @@ -88,7 +109,7 @@ establish that every proposal, replay, or recovery route satisfies Phase 5. - **Classification and scheduling are daemon-owned.** The crate defines the types and predicates; the daemon classifies, schedules, and applies. - **Identity invariants are predicate-authoritative** (the descriptor-vs-predicate rule from [concepts.md](concepts.md) applies here too). -**Ledger, as of 2026-09-09:** +**Initial implementation ledger, reconciled 2026-09-11:** - **Closed:** `.3` core approval types โ€” `ApprovalPath`, `ApprovalPathKind`, `VetoWindow`, `ProposalClassification` (`approval.rs`); `.4` identity invariant predicates + advisory probes (`identity_invariants.rs`); `.5` `SurfaceRegionPredicate` + Gate-4 replay (`surface_regions.rs`); `.6` delayed-apply scheduler + audit โ€” implemented **daemon-side in OpenCoven/coven#430** (daemon-owned classification and scheduler, deadline/minimum-visible revalidation, fail-closed committed-evidence replay, cross-platform conditional atomic writes, startup recovery); `.11` authority review findings resolved; `.2` RFC closure/provenance amendments; `.7` Cave veto-window contract; `.8` implementation and migration fidelity; `.12` RFC-0001 approval-tier alignment; `.13` authorized retired-Ward migration fixture. The proposal/decision-record PR #6 merged 2026-07-27 as `091607f`. - **Open human gates:** `.9` Nova coherence sign-off and `.10` Val freeze. They are not the whole remaining implementation scope: the four remediation beads below still block sign-off. Agents must never simulate either decision. @@ -107,7 +128,7 @@ establish that every proposal, replay, or recovery route satisfies Phase 5. confirmed the four findings then. It is not a current test result and cannot waive independent review of subsequent changes. -**Current delivery, as of 2026-09-09:** the runtime prerequisites this section +**Draft prerequisite checkpoint, 2026-09-09:** the runtime prerequisites this section previously described as missing are now implemented as unmerged drafts, not absent: identity-predicate activation is draft OpenCoven/coven#969 (`0e94e9c`), supported canonical scheduled publication with an explicit minimum-visibility @@ -231,9 +252,15 @@ reliability or closes a Phase-5 remediation gate. Native Windows executed 20 target cases: 15 daemon journeys and five artifact regressions, plus 152 selected feature-unit cases. Artifact `10157780426` contains 28 passed scenario manifests, all identifying the -clean synthetic merge `0d8ccfca1725475b5e45f2ec47d8c4c2c45bc89d`. +synthetic merge `0d8ccfca1725475b5e45f2ec47d8c4c2c45bc89d`. +The Coven checkout was recorded clean, but the manifests record +`threads_dirty=true` and `local_threads_override_active=false`. The dirty flag +does not establish tracked source changes; its cause needs explanation. Hosted Windows uses committed Threads `c3bd46b`, not a local-checkout override. Earlier local override evidence remains separately scoped to its recorded head. +The manifests also omit `--features threads-test-clock` from their recorded +command, although the job log includes it. Preserve the actual invocation and +dependency state before using this as release-grade provenance. OpenCoven/coven#1000 isolates evidence outside the build cache and qualifies both storage roots and uploaded names by workflow run and attempt. Earlier @@ -301,16 +328,18 @@ upstream work reference and `threads-lm4` tracking runtime conformance. `threads-76z` was reopened because its purported fix, #27, was closed **without merge** and superseded by stricter terminal-close work. Do not resurrect its null-close bypass. `threads-bnu` is closed via #28; `threads-t6t` now tracks -the remaining privacy-enforcement ruling after secret scanning landed in #41. +privacy required-check activation after secret scanning landed in #41 and the +separate privacy job and source-reference correction landed in #40. `threads-5rr` is an unratified design proposal, not authorization to add an audit event. -### Repository governance still outstanding +### Repository governance: baseline active, boundary enforcement outstanding #31 tracks required pinned daemon checks, deterministic time, OS/Cave acceptance, Action SHA pins, and measured coverage/flake targets. The 2026-09-10 GitHub snapshot reported `main` as unprotected and no repository rulesets. -On 2026-09-11, active ruleset `22910327` ("Threads main authority baseline") +On 2026-09-11, active [ruleset `22910327`](https://github.com/OpenCoven/coven-threads/rules/22910327) +("Threads main authority baseline") enabled protection for `refs/heads/main`. Its original independent-review requirement could not be fulfilled by the sole maintainer, who authored the pending PRs. On 2026-09-12 (UTC), the maintainer explicitly authorized a @@ -332,9 +361,11 @@ set `required_approving_review_count` to `1`, `require_last_push_approval` to `true`, and `require_extra_approval_for_unattributed_changes` to `true`. The effective branch-rules API and `main.protected=true` confirm activation. +#46 merged this policy ledger at `91ff511609cfb717bf71c3cafe07c0cbb2a2a317`. This is baseline governance, not completion of #31: the reviewed pinned daemon E2E check is not yet available to require, privacy is not a required check, -and coverage remains informational. The solo-maintainer policy does not waive +the scheduled latest-main canary is not wired, and coverage remains +informational. The solo-maintainer policy does not waive the separate Nova coherence or Val freeze gates, or their engineering prerequisites. [The authorization and exact policy change](https://github.com/OpenCoven/coven-threads/issues/31#issuecomment-5642501227) are recorded on #31. @@ -349,14 +380,35 @@ add branch protection, a coverage ratchet, or a reviewed downstream gate. reachable `HEAD`-history scanning, sanitized diagnostics, and synthetic regressions. Actual PR CI `34465028325` and merged-main CI `34465519559` passed. The separate Copilot review workflow `34465035137` is not CI evidence. -PR #40 adds a separate privacy CI job and its rollout documentation. -The 2026-09-11 approved source-reference correction removes a private runtime -location from the Phase-5 historical sources while preserving its provenance -role. It does not weaken the guard or change a normative decision. #39 tracks -landing; required-check activation remains a separate authorized step. -Secret-scanning success is not privacy acceptance. The checker and calling -workflow remain PR-controlled; this separate job does not provide immutable -enforcement against their authors. +PR #40 at `2a12c1ad6f813b636f49f1c17bbd3ff7cb65aaee` proposed a separate privacy +job and a maintainer-approved, provenance-preserving source-reference +correction. Its [CI run 34610860329](https://github.com/OpenCoven/coven-threads/actions/runs/34610860329) +passes both guards at that named head. Follow-up +`4fce2d9525cc966febb1a8db82587664a5a11c9a` corrects the stale `SECURITY.md` +rollout text and explicitly documents the checker-trust limitation. +The #40 follow-up passes [CI run 34647137078](https://github.com/OpenCoven/coven-threads/actions/runs/34647137078); +the #46 date correction passes [CI run 34647134180](https://github.com/OpenCoven/coven-threads/actions/runs/34647134180). +These results apply to their named heads. The combined privacy head +`2d17d0d4583801b1dfa831c7ca40a03930ceef80` subsequently passed +[CI run 34664678160](https://github.com/OpenCoven/coven-threads/actions/runs/34664678160). +#40 merged at `7168dae10f6b59bad8bc653b95f51911334ded74`; the job and +source-reference correction are now on `main`. Required-check activation +remains separate. "Independent" means a separate job from secret scanning, +not an immutable checker that PR authors cannot modify. No guard exemption or +normative authority change is implied. + +### Automation Authority Profile v1 + +The profile merged in #35 (`c3bd46b`). Profile version `1.0.0` is separate +from the Rust package's `0.2.0` version. Its schemas, Node-core reference +validator, exact conformance manifest, and vectors live under +`profiles/automation-authority/v1/`. It answers operation-specific automation +authority questions with four outcomes, separately from the Rust gate's three +verdicts. See the [profile guide](automation-authority-profile.md). + +This is a shipped contract/reference implementation, not daemon scheduler, +credential-issuance, trusted-runtime, or consumer-adoption acceptance. Keep +those owner-specific integrations separate from Phase-5 closure. ## Summary table @@ -373,7 +425,10 @@ enforcement against their authors. Tracked in `docs/STATUS-2026-07-15.md` and worth knowing when reading the repo: -- **License mismatch:** the design doc and README say *Apache-2.0 (planned)*; the committed `LICENSE` file is MIT (with a separate `PATENTS` file). Needs a deliberate reconciliation; until then, treat the license as unsettled. +- **Historical license-plan drift:** `LICENSE` and Cargo package metadata + specify MIT; the frozen design retains Apache-2.0 as its earlier plan. + Reconcile that text through a maintainer decision before release. This audit + changes neither the committed license nor the separate `PATENTS` file. - **Historical Phase-0 planning:** `PHASE-0-DESIGN.md` Sections 7-9 retain the pre-freeze checklist and questions. Their historical-status annotation distinguishes them from current blockers without rewriting the decisions. @@ -382,4 +437,9 @@ Tracked in `docs/STATUS-2026-07-15.md` and worth knowing when reading the repo: `specs/PHASE-3-PORTABILITY.md` Section 6, and Section 9.4 by the Phase-4 contract and its recorded 2026-07-17 freeze. Section 9.1, whether federation needs a fourth `fabric` level, remains open and deferred. -- **`Channel::Deliberate` is specified but unreachable.** `PHASE-0-DESIGN.md` ยง2.4 and non-negotiable #4 (the two-compaction contract) treat `Deliberate` and `Forced` as distinct channels with distinct survival requirements. `Forced` is woven into the daemon's `PROTECTED_CHANNELS`; `Deliberate` is referenced nowhere in coven, and every channel value the daemon constructs is a hardcoded `Channel::Mutation`. Tracked as `threads-xpo`. Relevant when reading ยง2.4 or the promotion-write seam contract, both of which describe intent that no code path can currently express. +- **`Channel::Deliberate` runtime reachability remains open.** The channel is + specified in `PHASE-0-DESIGN.md` and implemented in the library, but + `threads-xpo` still tracks the supported daemon promotion path. Draft #25 + explicitly labels `coven memory promote` as planned, not available. Do not + turn the earlier daemon-wide symbol snapshot into an undated claim about + every current code path. diff --git a/docs/reviews/2026-09-11-landscape-and-readiness.md b/docs/reviews/2026-09-11-landscape-and-readiness.md new file mode 100644 index 0000000..55e37b5 --- /dev/null +++ b/docs/reviews/2026-09-11-landscape-and-readiness.md @@ -0,0 +1,312 @@ +# Repository landscape and readiness review + +The repository has substantial contract implementation, but Phase 5 is not +ready to freeze. Baseline branch protection is active; reviewed daemon +integration and required current-checkout acceptance remain missing. + +**Date:** 2026-09-11. **Tracking:** #31, #13, `threads-9nf`; publication +follow-through `threads-ufe`. +This is Nova-lane engineering evidence, not the independently attributable +Nova coherence decision, Val's freeze, or permission to bypass review. + +## Decisions and publication at the original review + +| Review target | Engineering recommendation | Published evidence | +| --- | --- | --- | +| #46, governance documentation | No blocking finding in the delta; eligible independent review still required | [Exact-head review](https://github.com/OpenCoven/coven-threads/pull/46#pullrequestreview-5182694841) | +| #40, privacy rollout | Stale candidate text corrected in follow-up `4fce2d9`; eligible independent review and required-check activation remain separate | [Original exact-head finding and replacement text](https://github.com/OpenCoven/coven-threads/pull/40#pullrequestreview-5182694836) | +| #13, Phase-5 coherence | Keep blocked while the source and acceptance gaps below remain open | [Published engineering blocker list](https://github.com/OpenCoven/coven-threads/issues/13#issuecomment-5639655226), not a checked human checklist | +| #31, boundary strategy | Finish the reviewed daemon boundary before broadening acceptance claims | [Published strategy update](https://github.com/OpenCoven/coven-threads/issues/31#issuecomment-5639663138) and [delivery strategy](../strategy.md) | + +Both PR reviews are `COMMENTED`, not `APPROVED`. They were published through +the authenticated PR-author account at the user's request. That account cannot +supply the independent approval required by the original policy. Neither review +edited the PR branch or unlocked a protected merge. + +**Publication follow-through:** at the user's explicit request, subsequent +documentation-only commits corrected #40 at +`4fce2d9525cc966febb1a8db82587664a5a11c9a` and aligned #46's date at +`d51d40a72a2bda92827fdfe00cdab02408e95e1f`. The original review citations below +remain bound to their original heads. No independent approval is inferred +for either follow-up, and this audit's broader documentation is proposed on +`docs/repository-landscape-strategy`. + +Both follow-ups passed exact-head hosted CI: [#40 run 34647137078](https://github.com/OpenCoven/coven-threads/actions/runs/34647137078) +and [#46 run 34647134180](https://github.com/OpenCoven/coven-threads/actions/runs/34647134180). +These are repository checks, not new daemon acceptance or independent reviews. + +### Authorized landing follow-through, 2026-09-12 UTC + +The maintainer approved the documentation work, confirmed the solo-maintainer +setup, and explicitly authorized a [review-policy change](https://github.com/OpenCoven/coven-threads/issues/31#issuecomment-5642501227). +Ruleset `22910327` now requires zero approving reviews and disables latest-push +and extra unattributed-change approvals. Required PRs, resolved conversations, +stale-review dismissal, all four strict required checks, branch safeguards, and +the absence of bypass actors are unchanged. This is a real policy revision, +not an independent approval supplied by an agent. + +#46 merged at `91ff511609cfb717bf71c3cafe07c0cbb2a2a317`, following +[CI at `caf0683`](https://github.com/OpenCoven/coven-threads/actions/runs/34664611356). +#40 merged at `7168dae10f6b59bad8bc653b95f51911334ded74`, following +[CI at `2d17d0d`](https://github.com/OpenCoven/coven-threads/actions/runs/34664678160). +The checker-trust conversation was resolved by narrowing the enforcement claim, +not making the checker immutable. Privacy required-check activation remains +separate. #47 reconciles this audit with both landings. + +This update supersedes the original pending-landing and repository-review +requirements below, not the source findings, daemon acceptance limits, or +Phase-5 coherence/freeze prerequisites. The [contributor policy](../../CONTRIBUTING.md#solo-maintainer-merge-policy) +and [ledger](../phases.md#repository-governance-baseline-active-boundary-enforcement-outstanding) +record the current process and rollback. + +## Identified baseline + +| Surface | Revision and observed state | +| --- | --- | +| Threads audit baseline/main | `5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd`; the audit branch proposes documentation changes, not a merged-main claim | +| #46 at original review | `6265ca718dec658b03d614ecca4c048b1c15c205`; follow-up head recorded above | +| #40 at original review | `2a12c1ad6f813b636f49f1c17bbd3ff7cb65aaee`; follow-up head recorded above | +| OpenCoven/coven#931 | `8576f41e6d622f63a3576b85bd2d3142776e59ca`, open draft; latest query reports merge conflicts and no submitted reviews | +| Coven main | `066727f1a34377f4dfff0f5a7f80898a3a1c1ea5`; CLI manifest requests Threads `c102844`; no `threads_e2e` target | +| Stable compatibility pin | `39feb6de98816d10b490091e918f62035e6ce0df`; no `threads_e2e` target; `harness-required` remains accurate | +| Latest recorded hosted daemon merge | `0d8ccfca1725475b5e45f2ec47d8c4c2c45bc89d`, not current Coven main | + +The audit covered the root documentation, `docs/*.md`, E2E contract, +diagram documentation, historical ApplyAudit plans, repository manifest, and +relevant decision records. It also inspected current issue/PR/governance state, +the exact downstream scheduled producer and loader, the core replay hash and +region floors, and hosted artifact provenance. The earlier same-day detailed +coherence mapping is carried forward only at its unchanged immutable daemon +head. + +This is a bounded documentation and engineering-readiness review, not an +exhaustive code/security audit. Frozen specifications, the PDF, rendered +diagrams, and slides were not rewritten or recertified. Existing historical +wording is not a current acceptance claim merely because it remains committed. + +## Documentation audit + +**Summary:** eight actionable findings, four high and four medium. The main +problem is mixing design intent, historical implementation, and present +acceptance. Style review is scoped to revised prose, not a wholesale rewrite +of frozen or archival text. + +Line references below use the Threads baseline above, except where the #40 +candidate is explicitly identified. Quotes preserve the original wording. + +### High: authority or current-state clarity + +1. `docs/architecture.md:23` [Terminology]: public-library access is confused + with daemon authority. **Offending:** "reachable *only* by the privileged + daemon process". **Rewrite:** "Any program can call the public library, + but a client-side result grants no authority." Applied to the architecture + explanation and the FAQ's corresponding isolation claim. + +2. `docs/phases.md:312` [Structure]: an obsolete governance observation reads + as current. **Offending:** "snapshot reports `main` as unprotected and no + repository rulesets." **Rewrite:** "The September 10 snapshot reported + `main` as unprotected. Active ruleset `22910327` enabled baseline protection + on September 11; required pinned-daemon acceptance remains absent." + Applied to the ledger, with the four required contexts and review rules. + +3. `docs/glossary.md:18` [Terminology]: the replay mechanism is described more + broadly than the inspected implementation proves. **Offending:** "the + daemon re-materializes and re-derives it live at the delayed-apply deadline". + **Rewrite:** "`evidence_replay_hash` commits materialized diff and region + evidence. Matching it alone does not prove identity binding or final live + authority." Applied to the glossary, with the FAQ distinguishing load-time + reconstruction, live checks, and the open identity commitment. + +4. `SECURITY.md:40-42` at #40's reviewed head [Structure]: rollout text + contradicts the same candidate's source correction and hosted result. + **Offending:** "Draft #40 adds a separate `Privacy policy guard` job that + currently fails on that documented conflict." **Rewrite:** "This candidate + adds the separate privacy job and approved source-reference correction; + both guards pass at the recorded head. Reviewed landing and required-check + activation remain separate." Published as a required candidate correction, + then applied with explicit user authorization in follow-up `4fce2d9`, + including the surrounding stale paragraphs and command comment. The audit + branch separately distinguishes candidate evidence from the not-yet-landed + job and source correction. + +### Medium: reader guidance and historical scope + +5. `docs/concepts.md:24` [Code]: a design sketch resembles an available + executable. **Offending:** "The design requires that `coven-threads inspect + ` return the thread's current tension state". + **Rewrite:** "The frozen design sketches this command, but this repository + ships a library, not that executable." Applied with a pointer to supported + daemon/Cave inspection and the tension contract. + +6. `README.md:99` [Structure]: a Phase-0 anti-goal is presented as current + repository scope after Phase 3. **Offending:** "**Not a runtime-portability + format.** That's Phase 3's job. Phase 0 is enforcement design, not export." + **Rewrite:** "Threads owns the `.weave` portability contract and lossy + one-way `.af` export. Coven owns runtime adoption and effects." Applied + without changing the frozen design. + +7. `docs/diagrams/README.md:3` [Terminology]: the introduction suggests the + diagrams are authority. **Offending:** "Source-authoritative diagrams for + `coven-threads`." **Rewrite:** "These diagrams explain `coven-threads`; + they are not authority or current acceptance evidence." Applied with + explicit historical scope for the original staging diagram and windowed + lifecycle illustration; root and architecture captions now carry the warning. + +8. `docs/channels-and-strands.md:93` [Structure]: implemented portability is + still future tense. **Offending:** "The portability format that will wrap + `Serialization` in practice". **Rewrite:** "The implemented `.weave` + portability contract." Applied; a separate callout keeps the still-planned + deliberate-channel promotion command from appearing shipped. + +**Patterns:** current claims need dated evidence and an owner, not stronger +adjectives. The new strategy separates work order from the historical ledger. +Completed ApplyAudit plans now link to that strategy and explicitly retire +their old commit instruction. License reconciliation remains a maintainer +decision, not a wording fix that can choose a license on its own. + +## Implementation inventory + +| Surface | Source-backed inventory | Limit | +| --- | --- | --- | +| Rust package | One workspace crate, `coven-threads-core` `0.2.0`, MIT metadata, 15 public modules; `Cargo.toml:4-10`, `crates/coven-threads-core/src/lib.rs:56-116` | `CHANGELOG.md:5` still labels `0.2.0` unreleased; the frozen Apache-2.0 plan does not change the current MIT files | +| Rust integration targets | `rfc0001_s5_conformance`, `c7_roundtrip`, and `phase5_retired_ward_corpus` under `crates/coven-threads-core/tests/` | In-process contracts, not a daemon process boundary | +| Automation profile | Profile `1.0.0`, 18 manifest categories, 130 vectors, and 11 schemas under `profiles/automation-authority/v1/` | Independent version line and reference bundle, not proof of production adoption | +| CI | Five jobs in `.github/workflows/ci.yml:15-112`: secret scanning, quality, Cargo baseline, Nextest, and informational coverage | Four are required by the active ruleset; no daemon checkout, required E2E, or scheduled canary | +| Bootstrap/checks | `scripts/agent-bootstrap.sh` and `scripts/agent-check.sh` supply the documented pinned bootstrap and local gates, including Node profile checks | They do not satisfy the independent human decisions | + +The contributor and profile guides now make these limits explicit. No +executable implementation was changed or runtime result inferred from a file +count. + +## Phase-5 engineering review + +### Two source-confirmed acceptance gaps + +**Supported auto-path reachability:** the [scheduled producer][producer] +requires region evidence and combines path and region floors. The +[built-in regions][regions] assign floors 0 or 1, while the +[scheduled loader][scheduler] rejects floor 0 and auto approval at floor 1. +Thus this producer cannot supply either `AutoRegression` variant with those +regions. Identify and prove a supported route; do not lower a protected floor +or use a test-only constructor to satisfy the checklist. + +**Classification-time identity binding:** the producer sets its replay hash +using the [diff/region hash function][hash]. This does not separately commit +the identity predicate/configuration or unedited candidate identity sources +required by OpenCoven/coven#885. Later live predicate evaluation and +[final applying/recovery binding][binding] are useful but do not establish the +intake-to-deadline commitment. Prove changed-but-still-valid identity evidence +cannot reuse stale authority. This is a source/acceptance finding, not a newly +executed unauthorized-write counterexample. + +### Eight-item coherence mapping + +| #13 obligation | Evidence and remaining acceptance | +| --- | --- | +| RFC round-trip | [Recorded defaults][decisions] map substantially to [approval types][approval], predicates, and audit contracts. Source gaps above prevent a complete runtime claim. | +| Every approval path revalidates | Familiar-review and human-review process evidence exists; supported auto and full rationale-required process acceptance remain open. [Apply ceremony][ceremony] is not proof of every producer route. | +| Descriptor is not authority | Inspected [validator][validator] and materialization chain use predicates and authoritative bytes. No exhaustive Cave/client conformance is claimed. | +| Audit completeness: `proposal_submitted -> window_opened -> close(reason)` | The [retired-corpus journey][corpus] binds submission detail to the pending classification; its [terminal helper][terminal-helper] asserts one opening and one typed close for the same proposal. These cases do not establish gap-free ordering and correspondence across every route or crash boundary. Full-chain acceptance, failure/recovery coverage, and explicit ambiguous-applying resolution remain open. | +| Replay hash enforced | [Scheduled load][scheduler] reconstructs diff/region evidence; live apply checks follow. The complete classification-time identity commitment is still unresolved. | +| Minimum visibility | [Real retired-corpus journey][corpus] observes pending/restart and time advancement. Exact deadline, publication visibility, and browser reachability need distinct evidence. | +| Label/variant load contract | [Typed envelope][wire] and negative core cases exist. A real-daemon malformed-load case must substantiate the boundary claim. | +| Advisory separation | [Model-advisory types][advisory] remain separate; inspected daemon probes are deterministic. An unimplemented model-probe integration is not certified. | + +For **audit completeness**, #13's `window_opened` shorthand denotes the +canonical `proposal_window_opened` event. Each link has its own evidence limit: + +| Link | Source-backed observation | Remaining proof | +| --- | --- | --- | +| Submission to opening | The corpus journey reads `proposal_submitted` by proposal ID and compares its classification with the durable pending envelope. The [opening writer][opening-writer] derives interval and replay fields from the scheduled proposal. | The inspected journey does not independently assert event ordering, complete submission/opening correspondence, or absence of a gap at every publication/crash boundary. | +| Opening to typed close | The terminal helper requires one opening and one terminal record under the same proposal ID, then checks the terminal family, reason, and replay result. [SQL guards][audit] enforce typed terminal constraints. | Cover every failure/recovery route, preserve linkage after restart, and resolve ambiguous applying state without inventing a receipt. | + +This mapping retains the full obligation rather than reducing it to terminal +multiplicity. These are source and previously hosted observations at the +recorded daemon revision, not new execution or a checked human decision. + +All four remediation issues remain open: OpenCoven/coven#885 (`threads-okc`), +OpenCoven/coven#886 (`threads-980`), OpenCoven/coven#887 (`threads-dgg`), and +OpenCoven/coven#888 (`threads-zav`). The [E2E contract](../testing/e2e-contract.md) +requires attributable pre-fix red, production fix, exact-head green, +lower-level regression, and rollback evidence for each. Branch conflicts, +incomplete route/recovery matrices, signed principal/trusted-runtime proof, +and OpenCoven/coven-cave#5256's browser acceptance are not closed by this review. + +## Hosted evidence and governance + +[Coven run 34489425644][daemon-run] passed at the recorded draft head. +Its native Windows target has 15 daemon journeys plus five artifact +regressions. Artifact `10157780426` was re-read in memory: all 28 manifests +pass, with 23 distinct scenario names, the recorded synthetic merge above, +older Threads `c3bd46bcadb6396db8436c47411a4d0eac17192b`, +`coven_dirty=false`, `threads_dirty=true`, and override false. Repeated scenario +manifests are not independent acceptance journeys. + +The dirty flag does not prove tracked source modification; explain it rather +than labeling the whole dependency tree clean. The artifact records a generic +command without `--features threads-test-clock`; the earlier job-log inspection +records the feature-enabled invocation. Preserve the actual command in future +evidence. Earlier startup failures in run `34482201141` remain unexplained. +No fresh daemon run or 30-day reliability measurement was performed here. + +At the original review, [ruleset `22910327`][ruleset] enforced one approval, latest-push approval, +stale-approval dismissal, resolved review threads, up-to-date branches, four +GitHub Actions-bound checks, and deletion/non-fast-forward protection with no +bypass actors. The authorized follow-through above changes only the three +approval settings. It still does not require daemon E2E or privacy. Neither the current +workflow nor a TOML schedule declaration supplies the missing nightly canary. + +The #40 checker-trust comment is a documented boundary limitation, not a newly +introduced functional blocker for separate-job rollout: PRs can modify both +checker and workflow. An immutable enforcement policy needs an explicit +governance design, not a privileged workflow shortcut. + +## Impact, verification, and rollback + +The audit changes are explanatory Markdown only. They do not modify Rust, SQL, +migrations, fixtures, dependency pins, workflows, frozen specifications, +identity definitions, or human-gate status. Historical source correction in +#40 was reviewed and subsequently merged separately, not introduced by this +audit. The later server-side policy change is recorded in the follow-through +above; it is not a claim that the original audit changed governance. + +Read-only evidence commands included: + +```bash +gh pr diff 46 +gh pr view 40 --json headRefOid,files,reviews,statusCheckRollup +gh pr view 931 -R OpenCoven/coven --json headRefOid,isDraft,mergeStateStatus,reviews +gh api repos/OpenCoven/coven-threads/rulesets/22910327 +gh api repos/OpenCoven/coven-threads/rules/branches/main +gh run view 34489425644 -R OpenCoven/coven --json headSha,event,status,conclusion +git diff --check +``` + +The API also supplied exact-revision source, target-directory listings, issue +acceptance text, and the hosted ZIP inspected in memory. PR reviews were +published as comments bound to their exact commit IDs, not approvals. +Whitespace and local-link checks cover this documentation change; no fresh +build, full Rust suite, or daemon result is claimed. + +Rollback is a reviewed documentation correction. It cannot undo server-side +protection or establish runtime safety. Preserve recorded contradictory +evidence, Ward backups, and unresolved applying claims; do not downgrade into +the original authority defects. Remaining work follows [the strategy](../strategy.md). + +[producer]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/src/threads_gate.rs#L1318-L1425 +[scheduler]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/src/proposal_scheduler.rs#L51-L220 +[regions]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/surface_regions.rs#L306-L545 +[hash]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/surface_regions.rs#L185-L249 +[binding]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/src/api.rs#L12667-L12844 +[decisions]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/specs/PHASE-5-APPROVAL-SEMANTICS.md#L311-L435 +[approval]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/approval.rs#L82-L431 +[validator]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/validate.rs#L130-L195 +[audit]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/audit.rs#L1307-L1449 +[ceremony]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/src/api.rs#L7468-L7600 +[corpus]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/tests/threads_e2e.rs#L302-L402 +[terminal-helper]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/tests/threads_e2e.rs#L1473-L1511 +[opening-writer]: https://github.com/OpenCoven/coven/blob/8576f41e6d622f63a3576b85bd2d3142776e59ca/crates/coven-cli/src/api.rs#L12126-L12222 +[wire]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/approval.rs#L571-L677 +[advisory]: https://github.com/OpenCoven/coven-threads/blob/5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd/crates/coven-threads-core/src/identity_invariants.rs#L770-L915 +[daemon-run]: https://github.com/OpenCoven/coven/actions/runs/34489425644 +[ruleset]: https://github.com/OpenCoven/coven-threads/rules/22910327 diff --git a/docs/strategy.md b/docs/strategy.md new file mode 100644 index 0000000..3c07a61 --- /dev/null +++ b/docs/strategy.md @@ -0,0 +1,177 @@ +# Delivery strategy + +Finish the real-daemon authority boundary before declaring Phase 5 complete +or expanding its authority claims. + +**Planning baseline: 2026-09-11; repository rollout updated 2026-09-12 (UTC).** +This is an explanatory delivery strategy, +not a new normative contract, task tracker, or approval. [GitHub #31](https://github.com/OpenCoven/coven-threads/issues/31) +and its linked issues own cross-repository work; Beads owns local task status. +The [delivery ledger](phases.md) records implementation evidence, and the +[readiness review](reviews/2026-09-11-landscape-and-readiness.md) records the +findings behind this sequence. + +## Starting position + +| Surface | Present in the repository | Not established by that fact | +| --- | --- | --- | +| Rust core | Typed validation, approvals, identity predicates, audit schema/migrations, `.weave` portability, and conformance suites | Authentication, filesystem effects, or every daemon route | +| Automation Authority Profile v1 | Schemas, reference validator, signed evidence contracts, and exact vectors | Production scheduler, credential issuance, runtime-adapter adoption, or Rust API integration | +| Repository quality | Pinned toolchain/actions, Cargo baseline, Nextest, informational coverage, secret scanning, and a separate privacy job | Required daemon compatibility, privacy as a required check, or a coverage ratchet | +| Governance | Authorized solo-maintainer policy, required PRs, resolved conversations, and four strict required checks | GitHub-enforced independent review, a required pinned-daemon check, or either Phase-5 human decision | +| Downstream integration | Earlier release-source integration and substantial draft process-boundary evidence | Reviewed landing of the four remediations, full acceptance, or installed-binary conformance | + +The core's three verdicts and the automation profile's four outcomes answer +different questions. Do not add an automation approval outcome to the Rust +gate or infer daemon adoption merely because a reference vector passes. + +## Sequence and exit evidence + +### 1. Finish the bounded documentation and privacy landing + +**Owner:** authenticated maintainer under the [solo-maintainer merge policy](../CONTRIBUTING.md#solo-maintainer-merge-policy). +**Public tracking:** [governance ledger #46](https://github.com/OpenCoven/coven-threads/pull/46), +[privacy rollout #40](https://github.com/OpenCoven/coven-threads/pull/40), and +[remaining rollout issue #39](https://github.com/OpenCoven/coven-threads/issues/39). +**Beads:** `threads-6qw` records initial governance; `threads-1e9` records the +authorized solo-maintainer revision; `threads-chk` records the landed ledger; +`threads-t6t` retains the separate privacy required-check decision. GitHub +records remain usable without access to a local Beads database. + +#46 merged at `91ff511609cfb717bf71c3cafe07c0cbb2a2a317`, recording active +protection and its authorized solo-maintainer revision. #40 merged at +`7168dae10f6b59bad8bc653b95f51911334ded74`, adding the separate privacy job and +approved historical source correction. Their final heads passed required +checks before normal merges. No independent GitHub review is claimed. + +#47 reconciles their overlapping `SECURITY.md` and `docs/phases.md` wording +with the broader audit. Keep the original dated evidence distinct from later +landing and policy changes, and preserve the remaining acceptance gates. + +Exit evidence is recorded human authorization, resolved conversations, and +normal landing after the required checks at the accepted head. Adding +`Privacy policy guard` to the ruleset remains a separate authorized +administrative change; it is not included in the solo-maintainer policy +change. A separate scanner job is not tamper-proof enforcement against +changes to the checker or calling workflow. + +### 2. Close the implementation and acceptance gaps in Coven + +**Owners:** daemon integration lane and Cody for implementation; Echo for +predicate/audit/replay review; Sage for evidence mapping. +**Tracking:** OpenCoven/coven#931, OpenCoven/coven#976, +OpenCoven/coven#977; `threads-8pz`. + +Resolve the shared draft's merge conflicts before collecting final evidence. +Reconcile overlapping component commits; do not merge every historical branch +or restore #27's rejected null-close approach. + +| Obligation | Existing work owner | Required closure evidence | +| --- | --- | --- | +| Identity binding from classification through replay | OpenCoven/coven#885; `threads-okc` | Bind supported predicate/candidate evidence at intake; prove changed-but-still-valid evidence cannot reuse stale authority, including restart | +| Every approval ceremony reaches supported intake | Coven daemon lane: producer OpenCoven/coven#972 and harness OpenCoven/coven#884; integrated in draft OpenCoven/coven#931 | Prove both auto variants and the human paths through supported production routes; do not lower protected region floors or insert test-only envelopes. #13 is the downstream acceptance gate, not the implementation owner | +| Exactly one typed close per opened window | OpenCoven/coven#886; `threads-980` | Complete terminal/recovery matrix, duplicate prevention, and explicit resolution of ambiguous applying state without fabricated receipts | +| Protected proposals never become writes | OpenCoven/coven#887; `threads-dgg` | Full known-route, retry, cross-familiar, stale-claim, and recovery refusal matrix with persisted effects | +| Retired-Ward schedulability | OpenCoven/coven#888; `threads-zav` | Supported migration/intake, observable minimum visibility, exact time boundaries, restart, and unsupported-input refusal | +| Final authority snapshot matches committed bytes | OpenCoven/coven#977; `threads-8pz.13` | Named authority-change interleavings, intended-file atomicity, audit agreement, and recovery/rollback evidence | +| Native startup reliability and artifact provenance | OpenCoven/coven#1001, OpenCoven/coven#1000 | Explain retained startup failures and dependency state; record actual command, exact merge, run/attempt, and override mode | + +The all-ceremony proof above is broader than OpenCoven/coven#888's requirement +for a minimal valid retired-Ward case. Keep the corpus remediation in +`threads-zav`; do not silently expand its acceptance criteria or assign +implementation work to the human gate. The shared daemon lane owns the +broader route coverage needed for #13. + +For each of the four root blockers, retain a pre-fix red, the production fix, +an exact-head green, a lower-level regression, and migration/rollback notes. +Test existence, a serialized diagnostic retry, or an engineering recommendation +does not close the blocker. If supporting every ceremony requires changing a +canonical contract, obtain that decision rather than silently narrowing #13. + +### 3. Establish current-checkout compatibility + +**Owners:** Sage and the release/governance maintainer. +**Tracking:** #31 and [`e2e/compatibility.toml`](../e2e/compatibility.toml). + +After the daemon target and fixes land through review, propose a full-SHA pin +to that accepted downstream revision. Keep the current pin unchanged until +then; `status = "harness-required"` is honest today. + +The required topology is: + +```text +current Threads checkout -> reviewed Coven SHA -> supported daemon request + -> ephemeral files / SQLite / pending state -> scheduler / replay / restart +``` + +Prove the Cargo override is active before running J1-J8, and fail the job when +it is not. Retain exact invocation, dependency state, sanitized artifacts, and +run/attempt identity. A committed historical Threads dependency cannot stand +in for the pull request's checkout. + +Follow the [E2E rollout contract](testing/e2e-contract.md#10-ci-rollout): +observe the non-required lane, prove intentional red cases and stable +diagnostics, then require pinned Linux daemon acceptance. Implement the +non-blocking scheduled `coven/main` canary separately. The TOML declaration +alone does not schedule it. + +### 4. Complete resilience and human acceptance + +**Owners:** daemon lane for native processes; Charm for Cave; maintainer for +measurement and enforcement. +**Tracking:** #31 and OpenCoven/coven-cave#5256. + +Run the scheduled native OS matrix and real-daemon Cave project. Browser +acceptance must cover stale/disconnected state, reconnect, and daemon-owned +approval outcomes without optimistic client authority. A disappearing pending +item is not proof of a committed write. + +Use the existing targets: 8/8 critical journeys, 4/4 remediation dossiers, +99.5% first-attempt success over 30 days, and the documented latency budgets. +These are acceptance targets, not measured accomplishments. Retry-success +must not erase a failed first attempt. Introduce a coverage floor only from +observed data. + +### 5. Request the reserved decisions and reconcile release metadata + +**Owners:** Nova's independently attributable coherence gate, then Val's +freeze decision; maintainer for release metadata. +**Tracking:** #13; `threads-uqx.9`, `threads-uqx.10`. + +Present the eight-item coherence mapping, accepted commits, remaining +exceptions, and rollback evidence. Nova's decision must identify its accepted +scope; Val decides after that gate. An agent persona, author-side comment, +commit trailer, or green check cannot supply either decision. + +Before publishing a Threads release, reconcile the license texts and package +metadata through an explicit maintainer decision, and distinguish the +`0.2.0` unreleased changelog from downstream release ancestry. Do not rewrite +frozen decisions or promise Cargo `0.1.x` compatibility for exhaustive public +changes. + +## Keep adjacent work separate + +Draft #25 is language-only promotion-seam work. `threads-xpo` owns deliberate +channel reachability, `threads-55s` owns admission-channel audit follow-through, +and `threads-lm4` owns runtime conformance. `threads-5mn` retains the unresolved +upstream mirror reference; do not invent an ID or a promotion command. + +Automation-profile consumers need their own owner-specific adoption evidence. +The trusted runtime adapter remains Coven-owned. Neither this work nor +`threads-5rr` authorizes a new identity model, audit store, or audit event. +Independent planning can proceed, but it cannot bypass an unresolved phase +freeze or expand protected-write authority. + +## Documentation and rollback discipline + +Keep source precedence unchanged: RFC-0001, decision records, public contracts +and vectors, then explanatory docs. Update current status at the top of the +ledger; retain historical results with dates and exact revisions instead of +relabeling them as current. Link completed plans to this strategy and leave +them historical. + +Document each boundary-changing PR's objective, non-goals, canonical sources, +authority/privacy/compatibility impact, exact commands/results, downstream +status, and rollback. Preserve Ward backups and ambiguous pending/applying +evidence. A downgrade must not restore unvalidated writes, discard unresolved +claims, or weaken typed terminal evidence. diff --git a/docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md b/docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md index b61d312..2c7ed42 100644 --- a/docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md +++ b/docs/superpowers/plans/2026-07-19-apply-audit-migration-repair.md @@ -3,7 +3,8 @@ > **Historical implementation plan.** The repair merged through #23 > (`8e2de93ca3a311c46f2d4a6a0da7be0dd6ad7edc`). The tasks below record that > implementation, not an open work queue. `CHANGELOG.md` still marks `0.2.0` -> unreleased. See [the delivery ledger](../../phases.md) for current work. +> unreleased. See the [delivery strategy](../../strategy.md) for current +> sequencing and the [delivery ledger](../../phases.md) for evidence. > The 2026-09-11 documentation correction (#44) reconciles the object list > with the implemented classifier; it does not change SQL or migration policy. @@ -225,9 +226,10 @@ For this semver-corrected follow-up, the repair delta relative to - `git diff --check` - stale-wording searches for the old partial-gate terminology. -## Commit +## Historical commit instruction -Create a new commit (no amend) with: +The completed plan prescribed this message. It is not an instruction to create +another commit or repeat the version bump: ```text fix(audit): release ApplyAudit as v0.2.0 diff --git a/docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md b/docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md index 3741d0d..393843d 100644 --- a/docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md +++ b/docs/superpowers/specs/2026-07-19-apply-audit-migration-repair-design.md @@ -2,7 +2,8 @@ > **Historical implementation design.** The repair merged through #23 > (`8e2de93ca3a311c46f2d4a6a0da7be0dd6ad7edc`). See [the delivery -> ledger](../../phases.md) for current work. The 2026-09-11 documentation +> ledger](../../phases.md) for evidence and the [delivery strategy](../../strategy.md) +> for current work. The 2026-09-11 documentation > correction (#44) reconciles this description with the implemented > classifier; it does not change SQL, transaction ownership, or human gates.