Skip to content

drain(#405/#411/#413/#415 post-merge): empty-cone safeguard + GITHUB_TOKEN header + grammar + Otto-279 policy reply #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AceHack merged 1 commit into from
Apr 25, 2026
+11 −4
Merged

drain(#405/#411/#413/#415 post-merge): empty-cone safeguard + GITHUB_TOKEN header + grammar + Otto-279 policy reply #424

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,14 @@
# - Third-party actions SHA-pinned by full 40-char commit SHA;
# trailing `# vX.Y.Z` comments for humans.
# - permissions: contents: read at the workflow level; no job
# elevates. No secrets referenced.
# elevates. The only secret referenced is the auto-generated
# per-run secrets.GITHUB_TOKEN (see workflow-level env: block
# below) — needed because mise's aqua: backend authenticates
# to the GitHub API for release-tag lookups. The token
# inherits the read-only permissions; no write escalation.
# Workflow-level scope chosen over per-step for DRY (~7
# install-toolchain steps would otherwise repeat the env);
# trade-off documented at the env: block.
# - Concurrency: workflow-scoped; cancel-in-progress only for PR
# events (main pushes queue so every main commit gets a record).
# - fail-fast: false so one OS failure doesn't hide another.
Expand Down
4 changes: 2 additions & 2 deletions docs/BACKLOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10703,8 +10703,8 @@ systems. This track claims the space.
- [ ] **Exempt `memory/CURRENT-*.md` from memory-index-
integrity paired-edit trigger.** The
`memory-index-integrity.yml` workflow (NSA-001 guard)
requires any modify to a top-level `memory/*.md` file
to be paired with a `memory/MEMORY.md` edit in the same
requires any add-or-modify on a top-level `memory/*.md`
file to be paired with a `memory/MEMORY.md` edit in the same
PR. The intent is real — new session memories must
have index pointers — but the trigger-exemption list
(`memory/README.md`, `memory/persona/*`, `memory/MEMORY.md`
Expand Down
2 changes: 1 addition & 1 deletion docs/research/provenance-aware-claim-veracity-detector-2026-04-23.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ output.**
|---|---|---|
| G_similarity | `sim(e_q, e_y) < τ_low` — below retrieval-noise floor | `sim < τ_med` — weak match only |
| G_evidence_independent | `y` has no independent-oracle-verified evidence | `y` has evidence but only self-attested |
| G_carrier_overlap | `overlap(q, y) > θ_high` where `overlap(q, y) = 0` when `size(cone(y)) = 0`, else `size(cone(q) ∩ cone(y)) / size(cone(y))` — majority of y's provenance shared with q | `overlap(q, y) > θ_med` |
| G_carrier_overlap | `overlap(q, y) > θ_high` (majority of y's provenance shared with q) **OR** `size(cone(y)) = 0` (no provenance to verify against — carrier-laundering safeguard treats missing-lineage as suspicious, not clean) | `overlap(q, y) > θ_med`. When `size(cone(y)) > 0`, `overlap(q, y) = size(cone(q) ∩ cone(y)) / size(cone(y))`. |
| G_contradiction | `y` or its provenance cone contains an unresolved contradiction with a known-good anchor | a resolved contradiction within cone |
| G_status | `y.status = known-bad` or `y.status = superseded` | `y.status = unresolved` (no status pins it) |

Expand Down
Loading