From 19104a9629eae669fd9f979114ad958696331a5c Mon Sep 17 00:00:00 2001 From: "K. Isom" Date: Thu, 17 Sep 2026 01:09:08 -0700 Subject: [PATCH] Mark per-milestone review as an M1 experiment Co-Authored-By: Claude Fable 5.1 --- docs/decisions.md | 2 +- docs/specs/2026-09-17-pre-m1-design.md | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/decisions.md b/docs/decisions.md index 509cb2a..9175c5a 100644 --- a/docs/decisions.md +++ b/docs/decisions.md @@ -6,7 +6,7 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit | Date | Decision | Reason | |---|---|---| -| 2026-09-17 | Tool results are untrusted by default: each grant has `untrusted`, default true, and `brokerd` tracks a per-session untrusted flag beside taint. Review of Laguna's work is once per milestone, and Laguna keeps `docs/implementer-log.md`. | Owner's choices during the pre-M1 design review. Details in `docs/specs/2026-09-17-pre-m1-design.md`. | +| 2026-09-17 | Tool results are untrusted by default: each grant has `untrusted`, default true, and `brokerd` tracks a per-session untrusted flag beside taint. Review of Laguna's work is once per milestone, as an experiment for M1 to be revisited after the M1 review. Laguna keeps `docs/implementer-log.md`. | Owner's choices during the pre-M1 design review. Details in `docs/specs/2026-09-17-pre-m1-design.md`. | | 2026-09-17 | Threat model: the main adversary is injected text steering the model. Secondary: any one role process or tool container is compromised, and the goal is containment. `brokerd` trusts nothing `loopd` reports beyond the request itself and tracks session taint on its own. | Owner's choice. It matches the role split the brief already has. | | 2026-09-17 | Mattermost and the tailnet are trusted. A Mattermost compromise presumes the whole machine is compromised and is out of scope. Forged approvals are therefore out of scope, and there is no per-grant approval-path field. An accidental secret or PII leak into Mattermost is an accepted risk in v0. | Owner: Mattermost sits behind a single-user tailnet with ACLs. | | 2026-09-17 | Data classes: every session starts at `private`. A `secret` result raises it to `secret`. `public` is a provenance label and never lowers a session. The grant that authorises a call names the class of its results (default `private`); tools never label their own output. A grant's allowed data classes are the highest session taint under which it applies. Unattended egress is controlled by grant mode, not by lowering the floor. | `memory/core.md` is in every baseline, so no session is really public. Job-scoped grants are left to M5. | diff --git a/docs/specs/2026-09-17-pre-m1-design.md b/docs/specs/2026-09-17-pre-m1-design.md index 9bcbe3b..ac1efa3 100644 --- a/docs/specs/2026-09-17-pre-m1-design.md +++ b/docs/specs/2026-09-17-pre-m1-design.md @@ -270,9 +270,14 @@ Builds are deployed to straylight afterwards. the plan. For the security-critical parts of M3 the tests are too. 5. Laguna keeps `docs/implementer-log.md`: one row per task with the date, how many gate runs it took, whether the first run passed, any deviation from the task, and anything it stopped on. -6. Review is once per milestone, by the design model: the branch is checked against the plan, and - the gate is run on the development machine. Findings go back as follow-up tasks for Laguna. - Trivial or blocking findings may be fixed directly, and the log says so. +6. Review is once per milestone, by the design model. This is an experiment for M1: after the M1 + review the owner decides whether to keep it or go back to reviewing each task. The review + checks the branch against the plan and runs the gate on the development machine. Findings go + back as follow-up tasks for Laguna. Trivial or blocking findings may be fixed directly, and the + log says so. +7. Because nobody checks the work between tasks in M1, each task's "done when" list ends with + `make gate` passing, and a task that cannot reach that state stops and reports instead of + moving on. ## 10. Not covered here