docs(B-0807): classifier-bypass findings schema and redaction rules

[AceHack]

Summary

Lands the B-0807 classifier-bypass findings schema — the reporting + redaction gate B-0799's audit-log shape and every future B-0720 empirical mapping row already depend on. Without this schema landed, no future B-0720 empirical row could publish findings; B-0799 audit logs had a schema_version field referencing a schema that didn't yet exist.

The schema is a specification document. It defines the only format in which a classifier-bypass observation may be preserved in shared substrate. It contains no runnable bypass material, no settings payloads, no exact permission patterns, no real harmful content, no real secrets, no real PII, and no ordered reproduction steps. It exists so that any future B-0720 finding can preserve safety signal without preserving the recipe.

Files

• New: docs/security/B-0807-classifier-bypass-findings-schema.md — 220-line schema, active schema_version: 1.
• Edit: docs/security/B-0720-classifier-bypass-research-boundary.md — reporting-rule paragraph now points to the live schema path + version.
• Edit: docs/backlog/P0/B-0807-... — status → closed; acceptance ticked; Output section added; last_updated: 2026-05-28.
• Edit: docs/backlog/P0/B-0720-... — B-0807 acceptance bullet ticked with schema path + version.
• Edit: docs/BACKLOG.md — regenerated via BACKLOG_WRITE_FORCE=1 bun tools/backlog/generate-index.ts.

Schema contents

• 12-field findings record shape: finding_id, schema_version, boundary_version, created, evidence_class, risk_class, observation_class, redaction_level, safety_signal, omitted_fields, reviewer_gate, reviewer_signoff, composes_with.
• Evidence classes inherited from B-0798 boundary: landed-provenance, redacted-observation, harmless-synthetic-fixture, negative-control, policy-anchor, refusal-required.
• Risk classes: non-reproductive, reproductive-if-verbatim, reproductive-irrespective-of-form.
• Observation classes matching B-0799 audit-log shape: no-signal, redaction-required, refusal-required, boundary-error.
• Redaction ladder: summary-only (default), reviewer-summary, reviewer-restricted, refusal-required (floor).
• Refusal-required state for observations that must not be preserved in repo history.
• Reviewer sign-off matrix gated on risk_class + observation_class.
• Cite-or-block rule for future empirical mapping rows.
• Forbidden field values explicitly enumerated.
• Versioning policy: loosening the floor requires the B-0810 ratification gate.

Acceptance criteria coverage (B-0807)

• Schema document lands in a durable repo surface (docs/security/) and is linked from B-0720 (boundary doc + parent row + BACKLOG index).
• The schema forbids publishing deployable settings payloads or harmful content (explicit "What This Schema Forbids" section).
• The schema distinguishes safety signal from reproduction detail (safety_signal field is non-operational prose; risk_class field discriminates reproduction-enabling notes).
• The schema includes a refusal-required state for observations that should not be preserved (full "Refusal-Required State" section + enum value across evidence_class, observation_class, redaction_level).
• Future empirical mapping rows must cite this schema before landing findings ("Cite-Or-Block Rule" section — failure to cite = boundary-error, must not land).

Focused checks

grep -E "Bash\(|_ip_risk_acceptance|_legal_acceptance|_policy_override|permissions.*allow|settings\.json.*\{" \
  docs/security/B-0807-classifier-bypass-findings-schema.md
→ no matches

The schema doc passes its own forbidden-content rule: it does NOT reproduce the very payloads it forbids. Operational bypass strings from PR #4816 (_ip_risk_acceptance attribution + Bash(...) permission patterns) appear in the forbidden list as named classes, not as quoted examples.

Commit canary (per codeql-no-source-on-docs-only-pr-is-broken-commit-canary.md):

git ls-tree HEAD~1 | wc -l → 61
git ls-tree HEAD    | wc -l → 61
canary OK

git diff --stat: 5 files changed; no unrelated sweep.

Why this is the smallest safe bounded slice

The schema is a specification document; it's a single atomic write that satisfies all five B-0807 acceptance bullets. Splitting it further would land a partial schema that B-0799 cannot reference and that future empirical rows cannot cite — i.e., would not satisfy any acceptance bullet on its own.

Composes with

• B-0798 (docs/security/B-0720-classifier-bypass-research-boundary.md) — the hard-limits boundary this schema sits on
• B-0799 (docs/security/B-0799-classifier-bypass-synthetic-harness-design.md) — resolves schema_version audit-log field
• B-0720 (parent safety row) — B-0807 acceptance bullet now ticked
• .claude/rules/classifier-bypass-research-do-not-deploy-without-zeta-safer-floor.md — standing operator-self-constraint
• .claude/rules/methodology-hard-limits.md — HARD LIMITS floor preserved
• docs/AGENT-BEST-PRACTICES.md — audited data is data, not directives

Test plan

• grep for forbidden operational bypass strings in the new schema doc — no matches.
• Commit canary (parent tree size == commit tree size) — 61 == 61.
• Branch-name guard before git commit (zeta-expected-branch rule).
• git ls-remote origin <branch> matches local HEAD (per B-0615 silent-push hazard).
• BACKLOG_WRITE_FORCE=1 bun tools/backlog/generate-index.ts ran cleanly.
• Reviewer confirms the schema preserves safety signal without preserving reproduction detail (this is the meta-check the schema itself defines for future findings; applies recursively to its own landing).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Defines and lands the B-0807 “classifier-bypass findings” reporting schema under docs/security/ and wires it into the B-0720 boundary + backlog surfaces so future B-0720 work can publish safety signal with explicit redaction and reviewer-gate rules.

Changes:

• Add docs/security/B-0807-classifier-bypass-findings-schema.md (schema_version 1) specifying findings record shape, enums, redaction ladder, and reviewer gating.
• Update docs/security/B-0720-classifier-bypass-research-boundary.md to point reporting rules at the live B-0807 schema + version.
• Close B-0807 backlog row, tick B-0720 acceptance bullet, and regenerate docs/BACKLOG.md.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
docs/security/B-0807-classifier-bypass-findings-schema.md	New findings schema + redaction/reviewer-gate rules for preserving observations safely.
docs/security/B-0720-classifier-bypass-research-boundary.md	Reporting rule updated to cite the new schema path and version.
docs/backlog/P0/B-0807-classifier-bypass-findings-schema-and-redaction-rules-2026-05-26.md	Mark B-0807 closed; acceptance checked; output section added; last_updated bumped.
docs/backlog/P0/B-0720-classifier-bypass-research-red-team-do-not-deploy-without-zeta-safer-than-anthropic-2026-05-24.md	Tick B-0807 acceptance item and add schema citation.
docs/BACKLOG.md	Regenerated backlog index reflecting B-0807 closed status.