Skip to content

Re-warrant dn-typed-workflow-registry: warrant-bearing artifacts, pointer-only hub, denylist scope, merge-gated ingestion - #3

Open
ascalva wants to merge 5 commits into
mainfrom
revise/dn-typed-workflow-registry
Open

Re-warrant dn-typed-workflow-registry: warrant-bearing artifacts, pointer-only hub, denylist scope, merge-gated ingestion#3
ascalva wants to merge 5 commits into
mainfrom
revise/dn-typed-workflow-registry

Conversation

@ascalva

@ascalva ascalva commented Jul 28, 2026

Copy link
Copy Markdown
Owner

What this PR is

The design note dn-typed-workflow-registry ("the typed workflow registry" — the design that replaces this repo's agent hooks with an event-log registry and hardware-signed state transitions) was ratified early on 2026-07-27, and the owner then ruled for several hours past it the same night. This PR edits the ratified note directly and resubmits it.

The mechanism is the point: under the owner's own ruling, editing a ratified artifact is a proposal, not a violation — the edit invalidates (lapses) the warrant that made it ratified, and the author resubmits for re-authorization. This PR is the resubmission; your merge is the re-ratification. The gate is not bypassed; it is relocated here, where only you can merge. This is also the first live exercise of the note's own §2.10 revision protocol, and the lettered A-series amendment ceremony dissolves with it — the diff below is the amendment.

Metadata

  • Base: main (branched from origin/main @ 1928f5c) · Branch: revise/dn-typed-workflow-registry
  • Files: docs/design-notes/dn-typed-workflow-registry.md (revised) · docs/design-notes/role-state-and-scoped-handoff.md (D4 revised) · docs/inbox/amendment-A11-draft.md (deleted — folded) · docs/findings/finding-0277.md, finding-0278.md (new)
  • Also carried: bfb0edc, the brainstorm capture of the final write_scope ruling (cited by line from the note).
  • Every ruling is cited to its verbatim capture in docs/brainstorms/the-typed-workflow-registry.md / study-not-product.md; [GROUNDED] / [INFERENCE] labels throughout.

The changes, enumerated

  1. §2.5.1 — ratified is warrant-bearing, not immutable. The warrant (signature over content hash), not the bytes, is what cannot survive an edit; a lapse is self-announcing by arithmetic. bp-145 (the signed-admission build plan) now owes a lapse-on-edit acceptance test, not only no-unsigned-path-in. New falsifier F13.
  2. §2.6 — write_scope superseded twice, halves separated. Credentials: dispatch-time capability stands (a worker is constructed without AWS keys / merge rights / signing material). File writes: unconstrained — a denylist (CONSTITUTION.md, eval/golden/**, eval/golden.py, .github/workflows/**) enforced by a GitHub Action on every PR, owner-only overrule; everything else is review judgement against the plan's declared intent. The Action denies writes to itself (the interlock). Knock-ons recorded: bp-146 (write_scope-as-enforcement-level plan) is obsolete; finding-0275's (red scope-guard enforcement tests) clearing condition re-points to the denylist check.
  3. §2.4.6 — the hub's single invariant: pointers only, never content. Three uses converged independently (seal request = hash + commit ref; merge→deploy = the ref; ingestion notice = head sha). Falsifier F10: any hub payload not resolvable-by-reference.
  4. §2.4.6 — pre/post hash comparison named as a TOCTOU defence, with the pre≠post refusal path a named acceptance criterion on bp-145. Falsifier F11.
  5. §2.4.5 — the notary is a courier, never an authority. Compromising the scheduler buys DoS, never forgery. Falsifier F9: any path to a valid transition signature without a hardware touch.
  6. §2.10 — the A-series amendment ceremony dissolves. The event log is the amendment history; until the registry exists, the PR is the venue. The obsolete amendment-A11-draft.md is deleted, its content folded (§2.6, §2.8, and the role-state note's D4).
  7. §2.11 — landing discipline. No local main-merges; the sub-orchestrator is the integrator (builders merge into it, it opens the PR, you merge); merge train where staging triggers everyone to rebase; honesty note that branch protection is currently absent (verified 404) and is your act.
  8. §2.11 — the PR is the audit venue. Review events enter the log as occurrence, not content; "there is no third place" (product or strata; between rots — the resume brief's autopsy, §2.7); consequence: the commit message is the only surviving record of why — this PR's own commit messages are written to that bar.
  9. §2.11 — deploy: plan : apply :: proposal : authorization; apply in GitHub Actions on merge; the agent holds no AWS credentials; retires mind-palace deploy as a discipline-held rule when the lane lands.
  10. §2.12 — ingestion becomes an edge fetch lane reading only origin/main, merge-triggered, deferred (night/on-demand), pull not push. NN-2 boundary drawn explicitly: edge fetches, core ingests. Falsifier F12.
  11. §2.13 — deskcheck gating: all-designs-merged, except long-running tracks (workflow) per design→merge; the parked deskcheck-verdict-signing decision is re-opened, not silently kept.
  12. §1.1 — reprioritization stated up front: corpus integrity IS identity integrity; merge-gated ingestion protects your self-model from a defective agent (measured: two later-corrected readings ingested unmarked). §1.2 non-goal 5 revised to match.
  13. role-state-and-scoped-handoff §2.6 D4 revised per your instruction: registry as source, files as its export; D4's four grounds kept and answered row by row; the write-scope clause folded at its post-denylist meaning.

Scope decision (mine, stated)

Pipeline items 7–11 are kept in this one note rather than a sibling: its subject is how work moves, and landing/deploy/ingestion/deskcheck are the same movement under the same act-based→sign-based frame. A sibling note would have split one ruling-set across two re-auth ceremonies.

Needs your judgement at merge

  • The §1.2 non-goals — you read these aloud; non-goal 5 changed (ingestion source), the rest stand. Inferred clauses carry [INFERENCE].
  • Deskcheck-verdict signing — deliberately re-opened in §Parked; your call, not defaulted.
  • Terraform plan output visibility on the public repo (accept / check-artifact / redact) — must be chosen before the first plan posts; parked, not defaulted.
  • "Blessings stay at the keyboard" — the reason it rested on has changed (remote verify is now possible); the rule stands until you rule.
  • Six recorded collisions in §2.5.3 (dn-autopilot-and-delegated-blessing mechanics ×4, warrant-bearing vs agent-immutability, role-state D4) — recorded, never resolved; the ratified texts govern until you re-warrant them. oq-0037 (who holds the autopilot MFA secret) stays parked.
  • Follow-ups proposed, not executed (§3): bp-146 supersession, finding-0275 re-point, delegate-skill rebase trigger, CLAUDE.md edits, marking the already-polluted corpus content.

Falsifiers added/changed (you ratify falsifiers, not proofs)

F7 (denylist merge without overrule / self-removable check / worker holding an unconstructed credential) · F8 (registry-less checkout can write, or fails silently) · F9 (signature without hardware touch) · F10 (hub payload not resolvable-by-reference) · F11 (stale-hash signing accepted) · F12 (one component fetches and ingests) · F13 (edit survives with warrant intact).

Findings filed (not note sections, per their nature)

  • finding-0277 — the drift gauge is act-based: it cannot distinguish a warranted change from decay; warrant-aware baselines proposed; verify gauge semantics against source before building.
  • finding-0278 — autopilot's purpose needs stating: "spend owner attention only where identity is at stake," not "reduce owner involvement." Owner-only close; proposes a §2.10-style edit to the autopilot note.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GTYQT2QsWskJW4HmgobyrV

ascalva added 5 commits July 27, 2026 21:09
@ascalva
capture(workflow): write_scope dies — an allowlist is a prediction, a…
bfb0edc 
… denylist is a bright line

Owner ruling. Supersedes even tonight's dispatch-time-capability answer, but only
for file writes — the halves separate now. Credentials stay constructed (no AWS
key, no merge ability, no legitimate need to overrule). File writes become
unconstrained: "let the builder do what it needs to do, don't limit it."

Why the allowlist was always going to fail: it is a PREDICTION about what the work
will need, predictions are wrong, and a wrong prediction blocks LEGITIMATE work —
mechanically how write_scope clogged the machinery it protected. Every denial it
produced was either a real violation or a graduation-time guess that ran too
narrow, and it could not tell those apart. A denylist encodes only what must never
happen: small, stable, actually knowable, and unchanged across the life of the repo
while write_scope was re-guessed for 137 plans.

The deeper diagnosis: write_scope encoded JUDGEMENT AS A LIST. "Should this unit
touch board.py?" has a reason behind it; a glob can only answer set membership, so
the information the check needed was never in the artifact it read. The new model
returns judgement to a reviewer who can ask why, and leaves absolutes to mechanism
— mechanism for the absolute, judgement for the contextual.

It is also the thesis applied: a GitHub Action on the PR does not share a principal
with what it binds, unlike scope-guard, which read a file the agent could write.
"Only I can overrule" makes it a required check the owner alone bypasses — the
notary pattern a fourth time.

Pins the self-protection interlock: if the check lives in .github/workflows and the
agent can write there, the agent can delete the check binding it. That path must be
on its own denylist. Third instance of the pattern, so generalized: every external
control must deny writes to itself.

Knock-ons: the write_scope FIELD survives as a declaration of intent the diff is
reviewed against — a hypothesis, not a fence, where divergence is a question rather
than a denial. bp-146 is largely obsolete and must be superseded explicitly rather
than left pointing at a retired mechanism. finding-0275's clearing condition
changes, since scope-guard is not coming back.
@ascalva
docs(dn-typed-workflow-registry): re-warrant against the post-ratific…
d38c445 
…ation rulings

The note was ratified early on 2026-07-27 and the owner then ruled for hours
past it. This edit deliberately lapses the warrant: under the owner's re-auth
model an edit to a ratified artifact is a proposal, the PR is the resubmission,
and the merge is the re-ratification. status stays `ratified` because the field
was never the warrant; the hash was.

What moved and why:
- §2.5.1 immutable → warrant-bearing: prevention was the wrong mechanism; the
  signature binding to the content hash means an edit self-announces by
  arithmetic, so nothing needs to detect tampering. bp-145 now owes the
  lapse-on-edit acceptance, not just no-unsigned-path-in.
- §2.6 write_scope superseded twice in one night, halves separated: credentials
  stay dispatch-time capability (never given, not forbidden); file writes go
  unconstrained behind a PR denylist Action only the owner can overrule — an
  allowlist is a prediction and blocks legitimate work, a denylist is a bright
  line. The Action denies writes to .github/workflows/** so it cannot be
  removed by what it binds. bp-146 obsoleted, finding-0275 re-pointed (recorded,
  not edited).
- §2.4.5/§2.4.6 the notary is a courier (compromise buys DoS, never forgery)
  and the hub carries pointers only — three uses converged on the wire format;
  pre/post hashing named as the TOCTOU defence it is.
- §2.10 the A-series amendment ceremony dissolves: the event log is the
  amendment history; until the registry exists the PR is the venue.
- §2.11–2.13 landing/deploy/ingestion/deskcheck under the same frame; §1.1
  states the reprioritization: corpus integrity is identity integrity, so
  merge-gated ingestion is protection of the owner's self-model, not hygiene.

Kept in this one note rather than a sibling: the subject is how work moves,
and the pipeline is the same movement under the same act-based→sign-based
frame. Collisions with dn-autopilot-and-delegated-blessing recorded in §2.5.3
(now six), never resolved; oq-0037 stays parked.

Claude-Session: https://claude.ai/code/session_01GTYQT2QsWskJW4HmgobyrV
@ascalva
docs(role-state): fold the A11 draft into D4 and delete the transitio…
117b104 
…nal artifact

The owner directed this note's amendment ("files are no longer the source of
truth, and an agent's write scopes could be forced by role, scope still plays a
part"). Under the old rules that produced docs/inbox/amendment-A11-draft.md — a
parallel artifact describing an edit it was not allowed to make. The revision
protocol (dn-typed-workflow-registry §2.10) dissolves that ceremony: the edit
is made directly, the warrant lapses, and this PR is the resubmission.

D4's ruling sentence inverts (registry as source, files as its export) while
the three grounds that were requirements all along are kept and answered row
by row — D4's error was one word, "source," where its premises only proved
"readable, and authoritative where the registry is absent." The write-scope
clause is folded at its post-denylist meaning, not the draft's: roles force
credential capability at dispatch; path allowlists are retired; what the role
still fixes is who is acting, which is this note's subject.

The draft file is deleted rather than kept as history: its content now lives
in the two notes it amended, and a third home for it is exactly the
neither-product-nor-strata rot the night diagnosed. The A1-A9 lettered
amendments remain untouched history; A11 was never landed, so nothing is
rewritten.

Claude-Session: https://claude.ai/code/session_01GTYQT2QsWskJW4HmgobyrV
@ascalva
docs(findings): finding-0277 — the drift gauge cannot see warrants
f21a45c 
The act-based → sign-based reframe was assumed to govern enforcement; the
owner's "a drift, if you will" joke exposed that it reaches measurement too.
The drift instrument observes that state changed with no notion of whether a
warrant accompanied the change, so a deliberate ruling and decay read
identically — its loudest false alarms land exactly when the project is most
alive. Filed as a finding rather than a note section because the gauge's
semantics were read from purpose, not source, and the fix (warrant-aware
baselines) needs its own design pass.

Claude-Session: https://claude.ai/code/session_01GTYQT2QsWskJW4HmgobyrV
@ascalva
docs(findings): finding-0278 — autopilot needs its purpose stated
12110c8 
Recorded consequence of the identity reframe, routed as a finding because
dn-autopilot-and-delegated-blessing stays ratified and authoritative: read as
"reduce owner involvement" autopilot drifts toward what the project opposes;
read as "spend owner attention only where identity is at stake" it is the
correct instrument. The distinction decides how autopilot scope evolves and is
currently inferable only from a brainstorm, which is how purposes get
re-derived wrongly. Owner-only close; oq-0037 untouched.

Claude-Session: https://claude.ai/code/session_01GTYQT2QsWskJW4HmgobyrV
@ascalva ascalva added the documentation Improvements or additions to documentation label Jul 28, 2026
ascalva added a commit that referenced this pull request Jul 28, 2026
@ascalva
graduate(dn-typed-workflow-registry): mint bp-140..150, status proposed
00d0e13 
Decomposition of the ratified registry note into eleven session-sized plans,
following its §3 five graduation licenses as the spine. All `status: proposed` —
proposed->ready is the owner's hand.

140 store+minting+refs+idempotency (root, unblocked) · 141 degraded mode · 142
export renderer + idempotence pin + ratchet · 143 front-matter migration · 144
signed transition (independent of the registry per §2.5.2) · 145 signed admission ·
146 land-time admission · 147 journal-gate clause map · 148 resume-brief
deprecation · 149 staged hook retirement · 150 derived views re-pointed.

Verified before commit: all eleven `proposed`, and all 61 write_scope entries parse
as bare globs through _lib.plan_write_scope — the inline-comment trap that silently
breaks scope matching did not recur.

Committed late and separately from the graduation run: they sat untracked while a
Fable revision occupied the shared checkout, which is its own lesson about spawning
a file-writing agent without worktree isolation.

⚑ Two of these are already stale against rulings made hours after they were
minted — bp-146 (write_scope as a per-unit enforcement level) is superseded by the
denylist+review model, and bp-145 is owed a lapse-on-edit acceptance criterion.
Both are addressed in PR #3; committing the plans as minted so the supersession is
visible as a diff rather than hidden by a silent edit.
@ascalva

ascalva commented Jul 28, 2026

Copy link
Copy Markdown
Owner Author

Orchestrator note — one commit in this PR is not Fable's

bfb0edc ("capture(workflow): write_scope dies…") is mine, not the design agent's. It landed here by accident: the agent was spawned without worktree isolation, so it created and checked out this branch in the main checkout, which switched my branch too — and my next commit followed it here.

I'm leaving it in deliberately rather than surgically removing it, for two reasons:

  1. The revised note cites that capture by line number. Stripping the commit would leave those citations pointing at a pre-capture version of the file during your review.
  2. It's the reasoning behind the largest change in this PR (write_scope retired in favour of a denylist + review). Reasoning and change belong in the same re-auth, not split across two.

So this PR contains the ruling and its implementation together, which is arguably the correct shape — it just wasn't the intended mechanism.

What is not here: bp-140–bp-150 (the eleven graduated plans) and docs/brainstorms/the-attributed-transcript.md were committed straight to main where they belong, and are not part of this diff.

Lesson recorded: any agent that writes files needs worktree isolation, "design-only" included. I had been treating isolation as a concurrency optimisation for parallel builders; it's the same containment principle as everything else in this PR, and I under-applied it in the one case where I was the other party sharing the tree.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ascalva