sha256:3c8fff616c4f314ae3095734b9b6e92380446f0e7857f0e4ab7703f55760e9ae · aaronrene/knowtation

SEC-KN-4b: fix build-verification round-1 findings (4 MINOR)

BV1 governance: the handover's known-gaps block omitted that full npm test is not green, which frozen section 7.2 requires. Now disclosed with the proof that the 13 failures predate this build: the 4 real ones are stale resolveHostedActorRole source-shape assertions left by SEC-KN-3 (asserted-on source and test files are sha256-identical before and after the 4b commit, and they reproduce with no SEC-KN-4 module loaded). Opened roadmap row SEC-KN-3a.

BV2 test honesty: assert.notEqual on two compile-time constants proved nothing. Replaced with a real check that a refused apply returns no record and never persists the partition owner's derived principal.

BV3 rule fidelity: R5 is worded on the body's principal_ref OR owner_ref. The implementation scoped each ref to one record kind, which is equivalent only because the per-kind validators ignore the other field. Now checks both refs for every kind, with a cross-kind test (consent body smuggling org_ref in owner_ref).

BV4 coverage: the performance tier asserted wall-clock only. Added a read-counting test — every filesystem read during precheck is one of the policy or the two delegation stores, and a refusal never reads more than an accepted apply.

Also, two claims corrected with measurement rather than assumption: - Motoko compile is VERIFIED, not unverified. The reported dfx panic was terminal-colour detection; NO_COLOR=1 TERM=dumb dfx build --check hub succeeds with only pre-existing M0155 warnings. This also discharges the forward reference to isAsciiSpace that BV could not check statically. - The freeze's hedged repeat-deploy consequence is now measured: the first upgrade is accepted (moc --stable-compatible exit 0) and a repeat deploy is REFUSED with Compatibility error M0216. So there is no silent authorship erasure, but the canister is un-upgradeable until T4 restores the identity hook. R1.4 and gate T4 carry the measurement; SEC-KN-4c states it as the reason it is required.

SEC-KN-4 tests 31/31; delegation suites 31/31; canister:verify-migration exit 0. Governance sync (SD-17): ROADMAP + OVERSEER-HANDOVER in this commit. Not DONE — awaiting build verification round 2. No merge, no deploy.

symbols added

~17

symbols modified

−2

symbols removed

dead code introduced

Semantic Changes 23 symbols

~ docs/OVERSEER-HANDOVER.md .md 3 symbols added, 2 symbols removed, 8 symbols modified

~ Prior session — SEC-KN-4b build (completed code; awaiting BV)

− NEXT SESSION — SEC-KN-4b build verification (PRIMARY) section NEXT SESSION — SEC-KN-4b build verification (PRIMARY) L20–51

− code[text] variable variable code[text] L29–40

+ NEXT SESSION — SEC-KN-4b build verification round 2 (PRIMARY) section NEXT SESSION — SEC-KN-4b build verification round 2 (PRIMARY) L20–81

+ code[text] variable variable code[text] L62–70

+ table section table L32–38

~ Overseer Handover — Knowtation

~ Change log

~ table

~ NEXT SESSION — archived SEC-KN-4b build prompt

~ Governance gates checklist

~ Verified snapshot (what exists now)

~ table

~ docs/ROADMAP.md .md 3 symbols modified

~ Roadmap — knowtation

~ Build queue

~ table

~ docs/SEC-KN-4-DELEGATION-PRINCIPAL-BINDING-FREEZE.md .md 5 symbols modified

~ SEC-KN-4 — frozen spec: delegation principal binding at apply + proposal authorship

~ Frozen rules (SEC-KN-4b implements exactly these)

~ R1 — Server-only proposal authorship

~ Tier 3 gates (not part of SEC-KN-4b)

~ table

~ lib/agent/delegation.mjs .mjs 1 symbol modified

~ precheckApprovedDelegationProposal

~ test/sec-kn-4-delegation-principal-binding.test.mjs .mjs 1 symbol added

+ countReads function function countReads L728–740

Older SEC-KN-4b: bind delegation principal to proposal author at apply. sha256:80c36bbd32a7d14013a23300129d9f49ba78f16c7348c295766de59419124e55 All commits Newer SEC-KN-4b DONE: build verification round 2 = pass. sha256:c81dd03e420d7d7659ac29ae65547a5275d60982da49da8155eb6627ea1959a8

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:3c8fff616c4f314ae3095734b9b6e92380446f0e7857f0e4ab7703f55760e9ae --body "your comment"