aaronrene / knowtation public
feat/sec-seam-1-session-bound-writes #7 / 8
aaronrene · 40 days ago · Jul 27, 2026 · Diff

SEC-SEAM-1a: freeze review round 1 (blocked) — 14 cited findings amended; adopt S10 operator-declared ineligible subjects

sha256:6bdd12a3ca65d5167079e1595f5ee1719db31fbb2ccf959339229d07e196576e sha
sha256:b0fbc3d691c6540d82162e2fbcab5e530c6b2529e3d898ba5802e63497e8ef53 parent
+11 ~29 −2 symbols
sha256:b250e4821083afe5a106b45b26b9e57138a2803065522f6d2b4b45d4d7481263 snapshot
+11
symbols added
~29
symbols modified
−2
symbols removed
0
dead code introduced
Semantic Changes 42 symbols
~ docs/SEC-SEAM-1-SESSION-BOUND-IDENTITY-FREEZE.md .md 11 symbols added, 2 symbols removed, 29 symbols modified
− table section table L301–307
− S9 — No scope creep section S9 — No scope creep L340–351
+ D3 — operational input — which subject backs the shared token? section D3 — operational input — which subject backs the shared token? L683–694
+ 4 Deviation from the driving finding's fix wording section 3.4 Deviation from the driving finding's fix wording L215–238
+ S10 — Operator-declared self-apply-ineligible subjects section S10 — Operator-declared self-apply-ineligible subjects L447–475
+ 1 — Frozen input sources (both call sites) section S2.1 — Frozen input sources (both call sites) L288–302
+ table section table L292–297
+ 1 — Classification is a union, and it is fail-closed class section S3.1 — Classification is a union, and it is fail-closed L318–332
+ 2 — Obligations attach to admission, not as a skippable overlay section S3.2 — Obligations attach to admission, not as a skippable overlay L332–353
+ table@L389 section table@L389 L389–396
+ table@L403 section table@L403 L403–412
+ S9 — No scope creep (closing rule — deliberately last, after S10) section S9 — No scope creep (closing rule — deliberately last, after S10) L475–497
+ table section table L479–490
~ SEC-SEAM-1 — frozen spec: session-bound learner identity for task / media / delegation writes
~ Ground-truth edge — what this session could not verify
~ table
~ Review record
~ table
~ Operator decisions required before SEC-SEAM-1b (escalated)
~ 1 Ratification record
~ D1 — security — stamp a session class claim on minted JWTs?
~ Ground truth — what the code does today (file+line)
~ table
~ Frozen trust model
~ 2 The honesty clause — what Knowtation cannot verify
~ 3 Why the admission gate is the load-bearing rule
~ Frozen rules — SEC-SEAM-1b implements exactly these
~ S1 — Session binding is a positive, mint-time, server-set property
~ S2 — Author-bound admission to the self-apply class
~ S3 — The seam surface intent set is frozen and closed
~ S4 — Client-asserted identity is forbidden, and the advertisement is removed
~ S6 — Named, loud refusals
~ Scope
~ Consumer contract — Scooling L-SEAM (not built by SEC-SEAM-1b)
~ Test matrix — seven tiers plus security regression
~ table
~ Tier 3 gates (not part of SEC-SEAM-1b)
~ table
~ Residual risks and non-goals (explicitly accepted)
~ table
~ Freeze-contract declaration
~ code[yaml]
Older SEC-SEAM-1a: freeze session-bound learner identity for task/medi… sha256:b0fbc3d691c6540d82162e2fbcab5e530c6b2529e3d898ba5802e63497e8ef53 All commits Newer SEC-SEAM-1a: record freeze review round 2 (blocked) + halt loop … sha256:a0e114d80a94da61c70a7223e946c50ae572f991f7136fa7169d7a1add1e094f

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:6bdd12a3ca65d5167079e1595f5ee1719db31fbb2ccf959339229d07e196576e --body "your comment"