kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark per-milestone review as an M1 experiment

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-17 01:09:08 -07:00
co-authored by Claude Fable 5.1
parent bafe3f9fff
commit 19104a9629
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decisions.md
+1 -1
View File
@@ -6,7 +6,7 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit
| Date | Decision | Reason |
|---|---|---|
| 2026-09-17 | Tool results are untrusted by default: each grant has `untrusted`, default true, and `brokerd` tracks a per-session untrusted flag beside taint. Review of Laguna's work is once per milestone, and Laguna keeps `docs/implementer-log.md`. | Owner's choices during the pre-M1 design review. Details in `docs/specs/2026-09-17-pre-m1-design.md`. |
| 2026-09-17 | Tool results are untrusted by default: each grant has `untrusted`, default true, and `brokerd` tracks a per-session untrusted flag beside taint. Review of Laguna's work is once per milestone, as an experiment for M1 to be revisited after the M1 review. Laguna keeps `docs/implementer-log.md`. | Owner's choices during the pre-M1 design review. Details in `docs/specs/2026-09-17-pre-m1-design.md`. |
| 2026-09-17 | Threat model: the main adversary is injected text steering the model. Secondary: any one role process or tool container is compromised, and the goal is containment. `brokerd` trusts nothing `loopd` reports beyond the request itself and tracks session taint on its own. | Owner's choice. It matches the role split the brief already has. |
| 2026-09-17 | Mattermost and the tailnet are trusted. A Mattermost compromise presumes the whole machine is compromised and is out of scope. Forged approvals are therefore out of scope, and there is no per-grant approval-path field. An accidental secret or PII leak into Mattermost is an accepted risk in v0. | Owner: Mattermost sits behind a single-user tailnet with ACLs. |
| 2026-09-17 | Data classes: every session starts at `private`. A `secret` result raises it to `secret`. `public` is a provenance label and never lowers a session. The grant that authorises a call names the class of its results (default `private`); tools never label their own output. A grant's allowed data classes are the highest session taint under which it applies. Unattended egress is controlled by grant mode, not by lowering the floor. | `memory/core.md` is in every baseline, so no session is really public. Job-scoped grants are left to M5. |
docs/specs/2026-09-17-pre-m1-design.md
+8 -3
View File
@@ -270,9 +270,14 @@ Builds are deployed to straylight afterwards.
the plan. For the security-critical parts of M3 the tests are too.
5. Laguna keeps `docs/implementer-log.md`: one row per task with the date, how many gate runs it
took, whether the first run passed, any deviation from the task, and anything it stopped on.
6. Review is once per milestone, by the design model: the branch is checked against the plan, and
the gate is run on the development machine. Findings go back as follow-up tasks for Laguna.
Trivial or blocking findings may be fixed directly, and the log says so.
6. Review is once per milestone, by the design model. This is an experiment for M1: after the M1
review the owner decides whether to keep it or go back to reviewing each task. The review
checks the branch against the plan and runs the gate on the development machine. Findings go
back as follow-up tasks for Laguna. Trivial or blocking findings may be fixed directly, and the
log says so.
7. Because nobody checks the work between tasks in M1, each task's "done when" list ends with
`make gate` passing, and a task that cannot reach that state stops and reports instead of
moving on.
## 10. Not covered here