docs: close out C-83 — tampering verified, registry stays public, bring-up checks permissions - #165
Merged
Merged
Conversation
…ng-up checks permissions Three answers from epic #157, recorded. Stories #158, #161, #162. VERIFIED — NO EVIDENCE OF TAMPERING (#158). Operator ran a read-only probe against the live project; key never left their shell. unfao 111 rows 0 updated after creation production_forecasts 461 rows 11 updated after creation crafd 111 rows 0 updated after creation The two DELIVERY collections — what an external partner reads — are untouched since creation. All 11 flagged rows checked two ways: every one matched its recorded file_hash, and every one points at a file the bucket created BEFORE the row itself, by 0.16s to 51s. The provenance half is what settles it, because a matching hash alone would not: C-83's own scenario is rewriting fileId AND file_hash in one call, which leaves the hash matching. What that cannot fake is the file's $createdAt, set server-side — substituted content means a NEWER file. Not one of the eleven is newer. And triage was sufficient rather than partial because of a fact C-83 already recorded: all three buckets were already closed and never touched. File bytes could not be substituted at all; only rows were writable; every row alteration moves $updatedAt; every row whose $updatedAt moved is now verified. Re-deriving hashes for the other 572 would add nothing. RESIDUAL, not claimed closed: a count-preserving delete-and-recreate resets $createdAt and leaves no trace this method can see. Not ruled out, and not falsifiable — it would need an audit log reaching to 2025-11-17. So the verdict is "no evidence of tampering, twice over, with one permanently unfalsifiable residual", NOT "verified clean". The original sentence is struck rather than deleted because the distinction it drew is the one this preserves. DECIDED — THE REGISTRY STAYS PUBLIC (#161). Coordinates are useless without a key, the defect was an unlocked resource rather than a published address, and hiding the map treats the symptom while the cause is fixed upstream. Recorded as available and DECLINED rather than impossible — which was the error C-84's first draft made. §4 permits org-private if the reasoning ever changes; it asks only that the registry be readable without holding a secret. BRING-UP NOW CHECKS PERMISSIONS (#162). joining_the_seam.md gains §5: every container ends at permissions: [], verified with close_resource_permissions.py, expecting 401 anonymously and rows with the key. C-83 said plainly that "the next partner bring-up reopens this" — a bring-up following every other step could still produce an open collection. Sections renumbered 6 and 7. joining_the_seam.md is NON-NORMATIVE by its own header: no version bump, no edition, no tag, no consumer re-pin. Confirmed — git diff touches no .toml and no contract. Counts reproduce by grep: Total=64, Resolved=12, Open=52, dormant=15, live=37. Gates: ruff clean · self-contained 36 passed · validate_docs.sh PASSED · falsification 10 red / 6 green, baseline unchanged. PYTEST WAIVED — carbon protocol §2, docs-only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #158, #161, #162 from epic #157.
Verified — no evidence of tampering. Operator ran a read-only probe.
unfaoandcrafd(the delivery collections an external partner reads) are untouched since creation. All 11 flagged rows inproduction_forecastsmatched their hash and point at files the bucket created before the row — by 0.16s to 51s. That provenance check is what settles it: a coordinated rewrite offileId+file_hashleaves the hash matching, but cannot make a substituted file older than it is.Triage was sufficient rather than partial because all three buckets were already closed and never touched — so bytes could not be substituted at all, only rows, and every row alteration moves
$updatedAt.Residual, not claimed closed: a count-preserving delete-and-recreate is undetectable without an audit log reaching to 2025-11-17. Verdict is no evidence of tampering, twice over, with one permanently unfalsifiable residual — not verified clean.
Decided — the registry stays public. Recorded as available and declined, not impossible.
Bring-up now checks permissions.
joining_the_seam.md§5. Non-normative file: no version bump, no tag, no re-pin — confirmed, the diff touches no.tomland no contract.Counts reproduce by
grep: 64 · 12 resolved · 52 open. All gates green.🤖 Generated with Claude Code