rule(B-0743)+backlog: desktop admin consent pattern via biometric + small challenge ('I execute, you fingerprint') — new consent-first AI design pattern for admin permission on desktop instead of server#5006
Closed
AceHack wants to merge 1 commit into
Conversation
…mall challenge ('I execute, you fingerprint') — new consent-first AI design pattern for admin permission on desktop instead of server
Aaron 2026-05-25, after B-0737 zflash shipped + cron-check:
'hey we should save this interaction pattern about human permission
excalation being on touch and the extra small challenge as new consent
first ai design patterns for admin permisson on desktop instead of
server.'
Lands two artifacts in one PR:
1. New auto-loading rule at .claude/rules/desktop-admin-consent-via-
biometric-plus-small-challenge-i-execute-you-fingerprint.md that
future-Otto + future-Alexa + future-Riven + future-Vera + future-Lior
+ any future AI inherits at cold-boot. Names the 4 composing
elements (hardware sanity rails + per-run nonce + biometric PAM +
provenance chain). Desktop-vs-server design-space distinction
table. Documents what CANNOT substitute for biometric (NOPASSWD /
stored password / GUI prompt / pre-shared secret / MFA-via-phone).
Empirical anchor: B-0737 zflash.
2. B-0743 backlog row carves the generalization scope: applying the
pattern to other desktop destructive ops via candidate future
Z-tools (zformat / zwipe / zrotate-creds / zinstall-cert /
zsetup-ssh-key / zdb-migrate-prod / zsign-package / zelevate-network
/ zinstall-cluster / zfork-zeta). Each candidate is independently
shippable + inherits the pattern wholesale. 5 scope items: land
rule (this PR) / public design-pattern doc (future) / common
Z-tool framework (future) / cross-platform pattern coverage
(composes with B-0738+B-0739) / pattern-adoption tracker.
The design-space distinction: server-side AI consent uses IAM / SPIFFE
/ OIDC / RBAC at DEPLOY time (no human present); desktop AI consent
uses biometric + small challenge at ACTION time (human at keyboard).
Most current AI-agent ecosystems use server-side patterns EVERYWHERE
including on operator's desktop — that conflates the contexts.
Desktop is where physical-presence proof is available + cheap +
meaningful; using it changes the consent model fundamentally.
P2 — design-pattern-shaped substrate; high reuse-leverage; rule landing
is immediate scope (this PR); broader generalization is future-shaped.
Naming-expert (Ilyana) review pending if pattern goes public-surface.
Closes today's substrate cascade arc (B-0728 destructive-tool contract
→ B-0743 design-pattern landing).
Co-Authored-By: Claude <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
Adds a new .claude/rules/ rule and a corresponding P2 backlog row capturing a “desktop admin consent” interaction pattern (biometric elevation + small per-run challenge) and its intended generalization scope to future desktop-destructive tools.
Changes:
- Added a new auto-loading rule documenting the biometric + short challenge consent pattern for desktop privileged/destructive operations.
- Added backlog row B-0743 describing the pattern, its composition, and candidate future tools that should inherit it.
- Updated
docs/BACKLOG.mdto include the new B-0743 entry.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
docs/backlog/P2/B-0743-desktop-admin-consent-pattern-biometric-plus-small-challenge-i-execute-you-fingerprint-rule-landing-plus-generalization-scope-aaron-2026-05-25.md |
New backlog row capturing the pattern + generalization scope; includes cross-references and a candidate-tool table. |
docs/BACKLOG.md |
Regenerated index entry adding B-0743 under P2. |
.claude/rules/desktop-admin-consent-via-biometric-plus-small-challenge-i-execute-you-fingerprint.md |
New rule describing the operational consent pattern and when/why it applies. |
Comment on lines
+21
to
+22
| - full-ai-cluster/tools/zflash.ts | ||
| - full-ai-cluster/tools/zflash-setup.ts |
Comment on lines
+53
to
+57
| Documents: | ||
| - The pattern + when it applies + when it doesn't | ||
| - Desktop vs server design-space distinction table | ||
| - Why each element matters (what biometric alone misses; what challenge alone misses) | ||
| - What CANNOT be substituted (NOPASSWD / stored password / GUI prompt / pre-shared secret / MFA-via-phone — each has trade-offs the rule documents) |
Comment on lines
+70
to
+72
| | Tool | Operation | Why biometric gates it | | ||
| |---|---|---| | ||
| | **zformat** | Format a disk / partition | Destroys data; biometric proves intent at format time | |
Comment on lines
+73
to
+77
| | Layer | Server AI consent pattern | Desktop AI consent pattern (THIS RULE) | | ||
| |---|---|---| | ||
| | **Who's present** | No human in the loop at action time | Human at the keyboard / trackpad | | ||
| | **Identity proof** | Machine identity (SPIFFE / OIDC tokens / IAM roles) | Human biometric (Touch ID / Windows Hello / fprintd) | | ||
| | **Consent timing** | Deploy time + policy-time (RBAC, sudoers, IAM policy) | Action time + per-invocation (biometric gate fires each run) | |
This was referenced May 25, 2026
AceHack
pushed a commit
that referenced
this pull request
May 25, 2026
…ef operator (not Aaron), soften B-0743 cross-ref to in-flight PR, correct multi-USB doc claim, defense-in-depth partition-path validation
P1 (description length): SKILL.md frontmatter description was ~360 chars; per B-0347 carved-sentence routing budget (<150 hard), shortened to ~110 chars while preserving the load-bearing routing signal (zflash + Touch ID + macOS + operator-only/agent-driven paths).
P1 (named-human attribution in skill prose): two 'Aaron' mentions replaced with role-refs ('the operator', 'the human maintainer') per the repo's naming convention for current-state skill files.
P1 (broken cross-reference): B-0743 rule file doesn't exist on main yet (lands via PR #5006, still open). Updated the cross-ref to name B-0743 + note 'in PR #5006' so the linked-file claim doesn't 404 readers landing on main between these two PRs merging.
P0 (incorrect docs): the multi-USB FAQ entry claimed the long-form 'forces explicit device choice' — incorrect; flash-usb.ts rejects 2+ USB candidates upstream of the consent prompt regardless of challenge format. Doc updated to name the actual escape hatch (manual sudo dd) when physical USB-isolation isn't possible.
P2 (defense-in-depth): added per-partition path validation before feeding partition identifiers to diskutilInfo. The identifier comes from diskutil's own plist (trusted), but matches the assertSafeDevicePath discipline applied to whole-disk candidates. Partition-aware regex (/^\/dev\/disk\d+s\d+$/) used since partition paths have the 's<N>' suffix.
Codex P0 + 5 Copilot threads addressed; 2 Copilot threads (double-pipe table) were FP per .claude/rules/blocked-green-ci-investigate-threads.md suspect-by-default class.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
May 25, 2026
…ent prompt + flash-cluster-iso skill (#5027) * feat(zflash): show USB partition contents + vendor/serial before consent prompt + new flash-cluster-iso skill Two improvements from the 2026-05-25 USB-flash session with the human maintainer: 1. **flash-usb.ts pre-prompt display enrichment** — adds Vendor, IORegName, Serial, Writable, and Part. table fields to the device block; adds a new "Currently on /dev/diskN (will be DESTROYED)" section that iterates partitions and prints filesystem, volume name, mount point, and used-space per partition via `diskutil info -plist`. Operator's request: *"show me the usb device somehow and some stats abuout it and details before i fingerprint"* — the rails already showed device/model/size; this adds what's actually on the stick so the runner sees what they're about to destroy. 2. **.claude/skills/flash-cluster-iso/SKILL.md** — captures the end-to-end zflash flow as substrate so future agent cold-boots inherit it. Two paths documented: operator-only (zflash + yes <4-hex> + Touch ID), and agent-driven (expect drives the nonce echo; operator's Touch ID still gates the sudo dd as the physical-presence floor). Empirical anchor: this session's successful flash via the agent-driven expect script. Composes with B-0737 (zflash + Touch ID PAM + short challenge), B-0743 ("I execute, you fingerprint" desktop admin consent pattern), B-0728 (destructive-tool authoring contract). Linux + Windows extensions remain at B-0738 + B-0739. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(#5027): Copilot+Codex catches — shorten skill description, role-ref operator (not Aaron), soften B-0743 cross-ref to in-flight PR, correct multi-USB doc claim, defense-in-depth partition-path validation P1 (description length): SKILL.md frontmatter description was ~360 chars; per B-0347 carved-sentence routing budget (<150 hard), shortened to ~110 chars while preserving the load-bearing routing signal (zflash + Touch ID + macOS + operator-only/agent-driven paths). P1 (named-human attribution in skill prose): two 'Aaron' mentions replaced with role-refs ('the operator', 'the human maintainer') per the repo's naming convention for current-state skill files. P1 (broken cross-reference): B-0743 rule file doesn't exist on main yet (lands via PR #5006, still open). Updated the cross-ref to name B-0743 + note 'in PR #5006' so the linked-file claim doesn't 404 readers landing on main between these two PRs merging. P0 (incorrect docs): the multi-USB FAQ entry claimed the long-form 'forces explicit device choice' — incorrect; flash-usb.ts rejects 2+ USB candidates upstream of the consent prompt regardless of challenge format. Doc updated to name the actual escape hatch (manual sudo dd) when physical USB-isolation isn't possible. P2 (defense-in-depth): added per-partition path validation before feeding partition identifiers to diskutilInfo. The identifier comes from diskutil's own plist (trusted), but matches the assertSafeDevicePath discipline applied to whole-disk candidates. Partition-aware regex (/^\/dev\/disk\d+s\d+$/) used since partition paths have the 's<N>' suffix. Codex P0 + 5 Copilot threads addressed; 2 Copilot threads (double-pipe table) were FP per .claude/rules/blocked-green-ci-investigate-threads.md suspect-by-default class. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Lior <lior@zeta.dev> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Member
Author
|
Closing as substrate-stale (DIRTY-conflict) per .claude/rules/pr-triage-tiers.md Tier 3 + the discriminator pass below. Discriminator pass:
Disposition: close. The branch content is preserved in git history; re-land path is cherry-pick onto a fresh branch off current main with any ID-collision renumbering needed. This is the same Tier 3 disposition applied to today's #5038 + #5032 (same root cause: 2026-05-25 evening session left ~9 backlog/rule PRs DIRTY when the next morning's iter-5.x + iter-6 work landed and moved main forward). This close is NOT a punt — it's explicit ownership classification per .claude/rules/fighting-past-self-vs-peer-agent-distinguisher-fix-your-own-coordinate-on-peers-dont-punt-by-default.md (recurrence anchor landed today via #5126). The substrate-honest re-land path is documented; the operator-tax of indeterminate DIRTY state is cleared. |
auto-merge was automatically disabled
May 26, 2026 08:07
Pull request was closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aaron 2026-05-25, after B-0737 zflash shipped + the full day's substrate cascade:
Two artifacts in one PR — saving the interaction pattern as substrate so future AIs inherit it:
.claude/rules/desktop-admin-consent-via-biometric-plus-small-challenge-i-execute-you-fingerprint.md— future-Otto + Alexa + Riven + Vera + Lior + any future AI inherits the pattern at cold-bootThe pattern (4 composing elements)
yes <4-hex>= 8 chars){tool, nonce, biometric-identity, side-effect})Desktop vs server design space (rule documents the distinction)
Most current AI-agent ecosystems use server-side patterns EVERYWHERE — including on the operator's desktop. That conflates the contexts. Desktop has physical-presence proof available, cheap, meaningful; using it changes the consent model fundamentally.
What CANNOT substitute for biometric (rule documents)
NOPASSWD(removes all auth)Generalization scope — candidate future Z-tools
Each independently shippable + inherits the pattern wholesale:
zformat/zwipe/zrotate-creds/zinstall-cert/zsetup-ssh-key/zdb-migrate-prod/zsign-package/zelevate-network/zinstall-cluster(B-0742 composes) /zfork-zeta(B-0741 composes).Operator UX consistency across all Z-prefixed desktop destructive tools:
Composes with
.claude/rules/dont-ask-permission.md(agent invokes within authority; biometric IS per-run permission grant).claude/rules/classifier-bypass-research-do-not-deploy-without-zeta-safer-floor.md(biometric INSTALLS safety; not a bypass).claude/rules/glass-halo-bidirectional.md(biometric prompts are system-level UI; visible to operator regardless of terminal)Closing today's substrate cascade
Today's 2026-05-25 arc — B-0728 destructive-tool authoring contract → B-0743 design-pattern landing. The pattern surfaced operationally in B-0737 zflash; this PR names it as design-pattern substrate so future contributors inherit the discipline without re-discovering it.
Naming-expert review pending
If pattern goes public-surface (talk / blog post / industry presentation), Ilyana (per
.claude/skills/naming-expert/SKILL.md) review applies. Current working names documented in the rule body.Test plan
.claude/rules/; matches loading-taxonomy)composes_withonly B-NNNN row IDs; file paths inrelated_substrate:🤖 Generated with Claude Code