aaronrene / knowtation public
BREAKING feat/sec-seam-1-session-bound-writes #3 / 8
aaronrene · 44 days ago · Jul 27, 2026 · Diff

SEC-SEAM-1b: session-bound identity for seam self-apply (S1–S10)

Stamp type:session at all five learner mint sites; classify tokens and refuse seam self-apply unless session-bound author==approver. Seam surfaces reuse apply-path predicates (incl. flow/flow_capture); named HTTP refusal codes on both approve gates; S10 empty-list control; CORS X-User-Id advertisement removed. Seven-tier 33/33; BV round 1 pass. T1–T5 unexecuted. No merge.

sha256:97cea973b3ce3806ce7868f1f2a84859f9b28170dcfebb320a8aecd28ec4fdef sha
sha256:5954170f85de5fd2075075e9f91cae07e6f7b8289e32abef6ef7ac80c77a0517 parent
+22 ~27 −2 symbols
sha256:50ad35f56a04589bb518cb2feb57f8f618c73665c26d16fc58d9f7698314e30b snapshot
+22
symbols added
~27
symbols modified
−2
symbols removed
0
dead code introduced
Semantic Changes 51 symbols
~ lib/hub-self-apply-ineligible.mjs .mjs 2 symbols added
+ isSelfApplyIneligibleSub function function isSelfApplyIneligibleSub L42–45
+ parseSelfApplyIneligibleSubs function function parseSelfApplyIneligibleSubs L20–30
~ test/sec-seam-1-session-bound-identity.test.mjs .mjs 8 symbols added
+ baseEligibleOpts function function baseEligibleOpts L82–93
+ frontmatter method method frontmatter L227–229
+ hostedTaskProposal function function hostedTaskProposal L71–80
+ isPersonalSelfApplyClassPreFix class function isPersonalSelfApplyClassPreFix L111–140
+ notesTray function function notesTray L60–69
+ pathToFileURLSafe function function pathToFileURLSafe L259–261
+ roleEligible function function roleEligible L116–122
+ round1SeamByProposalKind function function round1SeamByProposalKind L143–156
~ docs/OVERSEER-HANDOVER.md .md 3 symbols added, 2 symbols removed, 11 symbols modified
~ Prior session — SEC-KN-6 BV round 1 = pass
~ Prior session — SEC-SEAM-1a freeze authored, loop blocked at round 2
~ Prior session — SEC-SEAM-1a round 3: D1–D4 ratified, N1 closed, loop blocked at round 3
~ Prior session — SEC-SEAM-1a rounds 4–7: D5 = A, freeze CLEARED
− NEXT SESSION — SEC-SEAM-1b Auto build (PRIMARY) section NEXT SESSION — SEC-SEAM-1b Auto build (PRIMARY) L20–113
− code[text] variable variable code[text] L45–58
+ NEXT SESSION — after SEC-SEAM-1b (PRIMARY) section NEXT SESSION — after SEC-SEAM-1b (PRIMARY) L20–107
+ Prior session — SEC-SEAM-1b Auto build + BV pass section Prior session — SEC-SEAM-1b Auto build + BV pass L43–53
+ code[text] variable variable code[text] L35–42
~ Overseer Handover — Knowtation
~ Change log
~ table
~ NEXT SESSION — archived SEC-KN-4b build prompt
~ Governance gates checklist
~ Verified snapshot (what exists now)
~ table
~ docs/PROPOSAL-LIFECYCLE.md .md 2 symbols added, 2 symbols modified
+ Media proposals — self-hosted only today (SEC-SEAM-1 / S7) section Media proposals — self-hosted only today (SEC-SEAM-1 / S7) L61–64
+ Session-bound learner identity (SEC-SEAM-1) section Session-bound learner identity (SEC-SEAM-1) L55–61
~ Proposal lifecycle (Hub)
~ Personal self-apply (Scooling review tray — HOSTED-WRITE-EVAL)
~ docs/ROADMAP.md .md 3 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ hub/bridge/server.mjs .mjs
~ hub/gateway/access-token-authz.mjs .mjs 2 symbols added
+ isSessionBoundActor function function isSessionBoundActor L54–56
+ resolveActorTokenClass class function resolveActorTokenClass L38–45
~ hub/gateway/cors-middleware.mjs .mjs 1 symbol modified
~ applyGatewayCors
~ hub/gateway/server.mjs .mjs 4 symbols modified
~ assertHostedProposalApproveDiscard
~ issueAccessTokenForSub
~ issueToken
~ resolveHostedActorRole
~ hub/lib/local-auth.mjs .mjs 1 symbol modified
~ issueLocalToken
~ hub/server.mjs .mjs 3 symbols modified
~ issueAccessTokenForSub
~ issueToken
~ requireApproveRole
~ lib/hub-proposal-personal-self-apply.mjs .mjs 5 symbols added, 2 symbols modified
+ isDelegationSurfaceProposal function function isDelegationSurfaceProposal L173–182
+ isHttpVisibleSelfApplySeamCode function function isHttpVisibleSelfApplySeamCode L69–71
+ isSeamSurfaceProposal function function isSeamSurfaceProposal L151–166
+ personalSelfApplyRefusalReason function function personalSelfApplyRefusalReason L212–266
+ trimActorId function function trimActorId L189–191
~ isPersonalSelfApplyClass
~ personalSelfApplyAllowsApprove
Older SEC-SEAM-1a: clear freeze (round 7 pass); D5=A; V1-V11 fixed sha256:5954170f85de5fd2075075e9f91cae07e6f7b8289e32abef6ef7ac80c77a0517 All commits Newer governance: point NEXT at Scooling L-SEAM C1-C4; Overseer re-verified sha256:ad852923dbb0c6d080febe706753a127fc062ea4056f1a4b9b49bc7a17666c56

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:97cea973b3ce3806ce7868f1f2a84859f9b28170dcfebb320a8aecd28ec4fdef --body "your comment"