From f68ebc74f23ca9624fa7da46f8a234f9a65c3138 Mon Sep 17 00:00:00 2001 From: Aaron Stainback Date: Fri, 24 Apr 2026 23:35:44 -0400 Subject: [PATCH] drain(#405 + #411 + #413 post-merge): empty-cone fail-YELLOW + GITHUB_TOKEN header doc + grammar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - **#405 P1 (Codex):** empty provenance cone now FAILS G_carrier_overlap (treats missing-lineage as suspicious, not best-case). Prior fix made overlap=0 which let provenance-empty + advisory-evidence-v0 stack into GREEN — the carrier-laundering safeguard would have missed exactly the records that should trigger review. Now the gate definition reads: fail-RED on (overlap > θ_high) OR (cone empty); fail-YELLOW on (overlap > θ_med). - **#411 P1 (Copilot):** gate.yml header 'No secrets referenced' was inaccurate after I added the workflow-level GITHUB_TOKEN env. Updated the header bullet to name the token explicitly + reference its read-only inheritance from permissions: contents: read + the workflow-vs-step-scope trade-off (DRY for ~7 install steps). - **#413 P2 (Copilot):** 'requires any modify' → 'requires any add-or-modify on' grammar fix. Note on #411 P2 (restrict GITHUB_TOKEN to install steps): trade-off documented in the header bullet rather than refactoring 7 install steps to per-step env. Reply explains. Note on #415 (name attribution in drain-log): docs/pr-preservation/ is a HISTORY surface per Otto-279 — names are policy-correct there. Reply explains. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/gate.yml | 9 ++++++++- docs/BACKLOG.md | 4 ++-- ...rovenance-aware-claim-veracity-detector-2026-04-23.md | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index e98e652e..e057892c 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -14,7 +14,14 @@ # - Third-party actions SHA-pinned by full 40-char commit SHA; # trailing `# vX.Y.Z` comments for humans. # - permissions: contents: read at the workflow level; no job -# elevates. No secrets referenced. +# elevates. The only secret referenced is the auto-generated +# per-run secrets.GITHUB_TOKEN (see workflow-level env: block +# below) — needed because mise's aqua: backend authenticates +# to the GitHub API for release-tag lookups. The token +# inherits the read-only permissions; no write escalation. +# Workflow-level scope chosen over per-step for DRY (~7 +# install-toolchain steps would otherwise repeat the env); +# trade-off documented at the env: block. # - Concurrency: workflow-scoped; cancel-in-progress only for PR # events (main pushes queue so every main commit gets a record). # - fail-fast: false so one OS failure doesn't hide another. diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 271a18a1..54a965e0 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -10703,8 +10703,8 @@ systems. This track claims the space. - [ ] **Exempt `memory/CURRENT-*.md` from memory-index- integrity paired-edit trigger.** The `memory-index-integrity.yml` workflow (NSA-001 guard) - requires any modify to a top-level `memory/*.md` file - to be paired with a `memory/MEMORY.md` edit in the same + requires any add-or-modify on a top-level `memory/*.md` + file to be paired with a `memory/MEMORY.md` edit in the same PR. The intent is real — new session memories must have index pointers — but the trigger-exemption list (`memory/README.md`, `memory/persona/*`, `memory/MEMORY.md` diff --git a/docs/research/provenance-aware-claim-veracity-detector-2026-04-23.md b/docs/research/provenance-aware-claim-veracity-detector-2026-04-23.md index 29716744..dbec1cc3 100644 --- a/docs/research/provenance-aware-claim-veracity-detector-2026-04-23.md +++ b/docs/research/provenance-aware-claim-veracity-detector-2026-04-23.md @@ -153,7 +153,7 @@ output.** |---|---|---| | G_similarity | `sim(e_q, e_y) < τ_low` — below retrieval-noise floor | `sim < τ_med` — weak match only | | G_evidence_independent | `y` has no independent-oracle-verified evidence | `y` has evidence but only self-attested | -| G_carrier_overlap | `overlap(q, y) > θ_high` where `overlap(q, y) = 0` when `size(cone(y)) = 0`, else `size(cone(q) ∩ cone(y)) / size(cone(y))` — majority of y's provenance shared with q | `overlap(q, y) > θ_med` | +| G_carrier_overlap | `overlap(q, y) > θ_high` (majority of y's provenance shared with q) **OR** `size(cone(y)) = 0` (no provenance to verify against — carrier-laundering safeguard treats missing-lineage as suspicious, not clean) | `overlap(q, y) > θ_med`. When `size(cone(y)) > 0`, `overlap(q, y) = size(cone(q) ∩ cone(y)) / size(cone(y))`. | | G_contradiction | `y` or its provenance cone contains an unresolved contradiction with a known-good anchor | a resolved contradiction within cone | | G_status | `y.status = known-bad` or `y.status = superseded` | `y.status = unresolved` (no status pins it) |