aaronrene / knowtation public
chore BREAKING governance feat/overseer-kit-install #3 / 3
aaronrene · 42 days ago · Jul 26, 2026 · Diff

chore(governance): install Overseer Kit + open SEC remediation board

Knowtation had no Overseer Kit (verified initialized:false, no .overseer/) while owning 7 of 11 code-level findings from the independent Pass 2 security audit in ~/scooling/docs/PRE-BUILD-SECURITY-AUDIT-FINDINGS-PASS2.md. The highest-risk repo was doing the highest-risk work with no freeze review and no build-verification gate. Installed via `ok init --regime muse+git-mirror --migrate --force` (operator-authorized option A).

Known intentional footprint deviation: --force overwrote MUSE-BRIDGE-WORKFLOW.md and scripts/muse-bridge-deploy.sh with kit templates, so both were restored to Knowtation's live versions afterwards (sha256 ef8a50b5... and fcc17c36...). Knowtation's bridge script is the live deploy path at 10,004 bytes; the kit template is 3,842 bytes and is not a substitute. `ok status --check-footprint` therefore reports footprint_integrity: mismatch by design, while footprint_self_integrity stays ok. Recorded in .overseer/config.yaml kit.notes so a later session does not "repair" it. Proper fix is a --preserve-shared-assets flag in the kit.

docs/ROADMAP.md now carries the SEC queue: SEC-KN-0 (verify the canister gateway auth secret - P1 fails OPEN on an empty secret, which would void every partition and RBAC guarantee), then SEC-KN-1 fail-closed, SEC-KN-2 server-only evaluation fields, SEC-KN-3 mcp_access role cap, SEC-KN-4 delegation principal_ref binding, SEC-KN-5 TTL ceiling + viewer mint, SEC-KN-6 constant-time compare, SEC-SEAM-1 session-bound write identity. Every SEC phase requires a security-tier test that fails against the pre-fix code.

docs/OVERSEER-HANDOVER.md is promoted from thin pointer to a real relay with the SEC-KN-0 paste-ready prompt including the KH1.9 governance gates checklist. Scooling keeps authority over cross-repo product order.

Verified this session: ok status -> initialized:true, kit_version 0.1.0, footprint_self_integrity ok, muse_sync synced, pending gates [].

sha256:980b99c4245dcaa4b404f542c40a68ee3d4180d0a9da0f85a274a44e3af941a0 sha
sha256:0c54d3a4abb2e327f87b381858cce59d6c70c3ff89112daacb8003cff7ace546 parent
+231 ~3 −2 symbols
sha256:a5db27e581740806fd5855c0e08ae612a44d0b51ff2b06eaebb8d6964a667aeb snapshot
+231
symbols added
~3
symbols modified
−2
symbols removed
0
dead code introduced
Semantic Changes 236 symbols
+ .claude/
+ .claude/skills/
+ .claude/skills/build-verification-review/
+ .claude/skills/check-ok/
+ .claude/skills/deploy-verification-review/
+ .claude/skills/freeze-review/
+ .claude/skills/freeze-review-loop/
+ .claude/skills/governance-sync/
+ .cursor/skills/build-verification-review/
+ .cursor/skills/check-ok/
+ .cursor/skills/deploy-verification-review/
+ .cursor/skills/freeze-review/
+ .cursor/skills/freeze-review-loop/
+ .cursor/skills/governance-sync/
+ .overseer/
+ .overseer/policy/
~ .claude/skills/build-verification-review/SKILL.md .md 19 symbols added
+ Build verification review skill section Build verification review skill L1–150
+ CLI helpers (non-substitute) section CLI helpers (non-substitute) L126–136
+ code[bash] variable variable code[bash] L128–133
+ Handover integration section Handover integration L136–145
+ code[text] variable variable code[text] L140–144
+ Hard stops section Hard stops L145–150
+ Inputs (read all) section Inputs (read all) L40–49
+ Loop (bounded) section Loop (bounded) L100–108
+ Model section Model L35–40
+ Output format section Output format L108–126
+ code[markdown] variable variable code[markdown] L110–125
+ Purpose section Purpose L12–28
+ table section table L19–24
+ Verdicts section Verdicts L89–100
+ table section table L91–96
+ Verification checklist (every item needs evidence) section Verification checklist (every item needs evidence) L49–89
+ code[markdown] variable variable code[markdown] L65–71
+ table section table L51–61
+ When to use section When to use L28–35
~ .claude/skills/check-ok/SIDE-CHECK-TEMPLATE.md .md 9 symbols added
+ Side check — {{TOPIC}} section Side check — {{TOPIC}} L1–49
+ Freeze-contract declaration section Freeze-contract declaration L7–18
+ code[yaml] variable variable code[yaml] L9–17
+ Ground-truth edge section Ground-truth edge L24–30
+ Review record section Review record L44–49
+ table section table L46–49
+ Scope section Scope L18–24
+ Test matrix (seven tiers) section Test matrix (seven tiers) L30–44
+ table section table L32–41
~ .claude/skills/check-ok/SKILL.md .md 11 symbols added
+ Check OK section Check OK L10–113
+ Hard stops section Hard stops L98–107
+ How the operator runs it section How the operator runs it L37–54
+ code[bash] variable variable code[bash] L43–48
+ Purpose section Purpose L16–28
+ table section table L20–24
+ Read first section Read first L107–113
+ Thinking sessions (always-on) section Thinking sessions (always-on) L89–98
+ Where this skill is installed section Where this skill is installed L28–37
+ table section table L30–36
+ Workflow (execute in this session) section Workflow (execute in this session) L54–89
~ .claude/skills/deploy-verification-review/SKILL.md .md 17 symbols added
+ Deploy verification review skill section Deploy verification review skill L1–126
+ CLI helpers (non-substitute) section CLI helpers (non-substitute) L112–119
+ code[bash] variable variable code[bash] L114–118
+ Checklist (every item needs evidence) section Checklist (every item needs evidence) L49–62
+ table section table L51–61
+ Hard stops section Hard stops L119–126
+ Inputs (read all) section Inputs (read all) L41–49
+ Loop (bounded) section Loop (bounded) L87–93
+ Model section Model L36–41
+ Output format section Output format L93–112
+ code[markdown] variable variable code[markdown] L95–111
+ Purpose section Purpose L12–23
+ table section table L17–22
+ Relationship to build-verification section Relationship to build-verification L62–77
+ Verdicts section Verdicts L77–87
+ table section table L79–84
+ When to use section When to use L23–36
~ .claude/skills/freeze-review-loop/SKILL.md .md 14 symbols added
+ Freeze-review loop skill section Freeze-review loop skill L1–110
+ CLI between rounds (recommended) section CLI between rounds (recommended) L78–88
+ code[bash] variable variable code[bash] L82–85
+ Degrade section Degrade L106–110
+ Hard stops (stop loop immediately) section Hard stops (stop loop immediately) L28–43
+ Loop (execute in one agent session — do not stop after one round) section Loop (execute in one agent session — do not stop after one round) L43–78
+ code[text] variable variable code[text] L45–77
+ Model section Model L21–28
+ Must cite section Must cite L96–100
+ Purpose section Purpose L10–15
+ Review-record table (required) section Review-record table (required) L88–96
+ table section table L92–95
+ Tier authority section Tier authority L100–106
+ When to use section When to use L15–21
~ .claude/skills/freeze-review/SKILL.md .md 13 symbols added
+ Freeze-step review skill section Freeze-step review skill L1–71
+ After Auto build (honesty gate) section After Auto build (honesty gate) L53–59
+ CLI (when K5 lands) section CLI (when K5 lands) L41–48
+ code[bash] variable variable code[bash] L43–47
+ Escalate to human when section Escalate to human when L59–68
+ Multi-round loop (optional) section Multi-round loop (optional) L48–53
+ Must cite section Must cite L68–71
+ Purpose section Purpose L6–12
+ Read first section Read first L12–18
+ Review checklist section Review checklist L25–33
+ Verdicts section Verdicts L33–41
+ table section table L35–40
+ When to run section When to run L18–25
~ .claude/skills/governance-sync/SKILL.md .md 8 symbols added
+ Governance sync skill section Governance sync skill L1–44
+ CLI (when K4/K5 land) section CLI (when K4/K5 land) L26–35
+ code[bash] variable variable code[bash] L28–32
+ Closing commit section Closing commit L35–39
+ Hard stops section Hard stops L39–44
+ Purpose section Purpose L5–10
+ Read first section Read first L10–17
+ Workflow (docs-first) section Workflow (docs-first) L17–26
+ .cursor/rules/build-verification-required.mdc .mdc
+ .cursor/rules/check-ok-thinking.mdc .mdc
+ .cursor/rules/governance-sync.mdc .mdc
+ .cursor/rules/l1-checkpoints-consumer-owned.mdc .mdc
+ .cursor/rules/tier-authority.mdc .mdc
~ .cursor/skills/build-verification-review/SKILL.md .md 19 symbols added
+ Build verification review skill section Build verification review skill L1–150
+ CLI helpers (non-substitute) section CLI helpers (non-substitute) L126–136
+ code[bash] variable variable code[bash] L128–133
+ Handover integration section Handover integration L136–145
+ code[text] variable variable code[text] L140–144
+ Hard stops section Hard stops L145–150
+ Inputs (read all) section Inputs (read all) L40–49
+ Loop (bounded) section Loop (bounded) L100–108
+ Model section Model L35–40
+ Output format section Output format L108–126
+ code[markdown] variable variable code[markdown] L110–125
+ Purpose section Purpose L12–28
+ table section table L19–24
+ Verdicts section Verdicts L89–100
+ table section table L91–96
+ Verification checklist (every item needs evidence) section Verification checklist (every item needs evidence) L49–89
+ code[markdown] variable variable code[markdown] L65–71
+ table section table L51–61
+ When to use section When to use L28–35
~ .cursor/skills/check-ok/SIDE-CHECK-TEMPLATE.md .md 9 symbols added
+ Side check — {{TOPIC}} section Side check — {{TOPIC}} L1–49
+ Freeze-contract declaration section Freeze-contract declaration L7–18
+ code[yaml] variable variable code[yaml] L9–17
+ Ground-truth edge section Ground-truth edge L24–30
+ Review record section Review record L44–49
+ table section table L46–49
+ Scope section Scope L18–24
+ Test matrix (seven tiers) section Test matrix (seven tiers) L30–44
+ table section table L32–41
~ .cursor/skills/check-ok/SKILL.md .md 11 symbols added
+ Check OK section Check OK L10–113
+ Hard stops section Hard stops L98–107
+ How the operator runs it section How the operator runs it L37–54
+ code[bash] variable variable code[bash] L43–48
+ Purpose section Purpose L16–28
+ table section table L20–24
+ Read first section Read first L107–113
+ Thinking sessions (always-on) section Thinking sessions (always-on) L89–98
+ Where this skill is installed section Where this skill is installed L28–37
+ table section table L30–36
+ Workflow (execute in this session) section Workflow (execute in this session) L54–89
~ .cursor/skills/deploy-verification-review/SKILL.md .md 17 symbols added
+ Deploy verification review skill section Deploy verification review skill L1–126
+ CLI helpers (non-substitute) section CLI helpers (non-substitute) L112–119
+ code[bash] variable variable code[bash] L114–118
+ Checklist (every item needs evidence) section Checklist (every item needs evidence) L49–62
+ table section table L51–61
+ Hard stops section Hard stops L119–126
+ Inputs (read all) section Inputs (read all) L41–49
+ Loop (bounded) section Loop (bounded) L87–93
+ Model section Model L36–41
+ Output format section Output format L93–112
+ code[markdown] variable variable code[markdown] L95–111
+ Purpose section Purpose L12–23
+ table section table L17–22
+ Relationship to build-verification section Relationship to build-verification L62–77
+ Verdicts section Verdicts L77–87
+ table section table L79–84
+ When to use section When to use L23–36
~ .cursor/skills/freeze-review-loop/SKILL.md .md 14 symbols added
+ Freeze-review loop skill section Freeze-review loop skill L1–110
+ CLI between rounds (recommended) section CLI between rounds (recommended) L78–88
+ code[bash] variable variable code[bash] L82–85
+ Degrade section Degrade L106–110
+ Hard stops (stop loop immediately) section Hard stops (stop loop immediately) L28–43
+ Loop (execute in one agent session — do not stop after one round) section Loop (execute in one agent session — do not stop after one round) L43–78
+ code[text] variable variable code[text] L45–77
+ Model section Model L21–28
+ Must cite section Must cite L96–100
+ Purpose section Purpose L10–15
+ Review-record table (required) section Review-record table (required) L88–96
+ table section table L92–95
+ Tier authority section Tier authority L100–106
+ When to use section When to use L15–21
~ .cursor/skills/freeze-review/SKILL.md .md 13 symbols added
+ Freeze-step review skill section Freeze-step review skill L1–71
+ After Auto build (honesty gate) section After Auto build (honesty gate) L53–59
+ CLI (when K5 lands) section CLI (when K5 lands) L41–48
+ code[bash] variable variable code[bash] L43–47
+ Escalate to human when section Escalate to human when L59–68
+ Multi-round loop (optional) section Multi-round loop (optional) L48–53
+ Must cite section Must cite L68–71
+ Purpose section Purpose L6–12
+ Read first section Read first L12–18
+ Review checklist section Review checklist L25–33
+ Verdicts section Verdicts L33–41
+ table section table L35–40
+ When to run section When to run L18–25
~ .cursor/skills/governance-sync/SKILL.md .md 8 symbols added
+ Governance sync skill section Governance sync skill L1–44
+ CLI (when K4/K5 land) section CLI (when K4/K5 land) L26–35
+ code[bash] variable variable code[bash] L28–32
+ Closing commit section Closing commit L35–39
+ Hard stops section Hard stops L39–44
+ Purpose section Purpose L5–10
+ Read first section Read first L10–17
+ Workflow (docs-first) section Workflow (docs-first) L17–26
~ .overseer/STANDING-DECISIONS.reference.md .md 9 symbols added
+ Standing Decisions (ADR log) — knowtation section Standing Decisions (ADR log) — knowtation L1–57
+ Decision authority (summary) section Decision authority (summary) L21–33
+ table section table L25–30
+ How to use this log section How to use this log L10–21
+ table section table L12–18
+ Model-split protocol pointer (SD-3) section Model-split protocol pointer (SD-3) L45–57
+ table section table L49–53
+ Standing Decisions table (append below) section Standing Decisions table (append below) L33–45
+ table section table L35–40
+ .overseer/config.yaml .yaml
+ .overseer/policy/model-labels.yaml .yaml
+ .overseer/policy/model-routing.yaml .yaml
+ .overseer/policy/test-tiers.yaml .yaml
+ .overseer/policy/tiers.yaml .yaml
+ .overseer/version.lock .lock
~ docs/CROSS-REPO-COORDINATION.md .md 18 symbols added
+ Cross-Repo Coordination And Overseer Playbook — knowtation section Cross-Repo Coordination And Overseer Playbook — knowtation L1–156
+ Boundaries we do not overstep section Boundaries we do not overstep L61–71
+ Canonical documents map (this repo) section Canonical documents map (this repo) L71–82
+ table section table L73–79
+ Decision authority (three tiers) section Decision authority (three tiers) L115–130
+ table section table L119–124
+ Model-split handover protocol (SD-3) section Model-split handover protocol (SD-3) L145–152
+ Recommended Flow: Overseer handover section Recommended Flow: Overseer handover L130–145
+ table section table L134–142
+ Seven-tier test contract (RULE #0) section Seven-tier test contract (RULE #0) L152–156
+ Simple summary section Simple summary L16–23
+ Technical summary section Technical summary L23–32
+ The overseer role and handover protocol section The overseer role and handover protocol L82–115
+ code[text] variable variable code[text] L100–112
+ Version control (this repo) section Version control (this repo) L32–61
+ Regime-specific hard stops section Regime-specific hard stops L48–61
+ table section table L50–55
+ table section table L34–44
~ docs/ROADMAP.md .md 11 symbols added
+ Roadmap — knowtation section Roadmap — knowtation L1–88
+ Build queue section Build queue L35–49
+ table section table L37–48
+ Cross-references section Cross-references L80–88
+ Current status (2026-07-26) section Current status (2026-07-26) L25–35
+ table section table L27–34
+ Definition of Done (every phase) section Definition of Done (every phase) L49–63
+ Phase Model Key section Phase Model Key L12–25
+ table section table L14–20
+ VCS context (this repo) section VCS context (this repo) L63–80
+ table section table L65–75
~ .cursor/rules/no-docs-only-pr-to-main.mdc .mdc
~ docs/OVERSEER-HANDOVER.md .md 11 symbols added, 2 symbols removed, 3 symbols modified
− Change log (recent) section Change log (recent) L23–30
− table section table L25–30
+ Change log section Change log L136–146
+ table section table L138–145
+ Hard stops section Hard stops L128–136
+ NEXT SESSION — SEC-KN-0 canister gateway auth verification (PRIMARY) section NEXT SESSION — SEC-KN-0 canister gateway auth verification (PRIMARY) L20–108
+ Governance gates checklist section Governance gates checklist L93–108
+ Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L73–93
+ table section table L75–85
+ code[text] variable variable code[text] L35–72
+ Shared context (prepend to any phase prompt) section Shared context (prepend to any phase prompt) L146–165
+ Verified snapshot (what exists now) section Verified snapshot (what exists now) L118–128
+ table section table L120–127
~ Overseer Handover — Knowtation
~ Status (Knowtation product)
~ table
← Older Oldest on feat/overseer-kit-install
All commits Newer docs: SEC-KN-0 verified — gateway auth secret is set sha256:4b3bee2d868d82528f7db57ddf34d34659632b82b9ef94916a59c2f6ecd418cc

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:980b99c4245dcaa4b404f542c40a68ee3d4180d0a9da0f85a274a44e3af941a0 --body "your comment"