aaronrene / knowtation public
feat/sec-seam-1-session-bound-writes #8 / 8
aaronrene · 43 days ago · Jul 27, 2026 · Diff

SEC-SEAM-1a: freeze session-bound learner identity for task/media/delegation writes (P3)

sha256:b0fbc3d691c6540d82162e2fbcab5e530c6b2529e3d898ba5802e63497e8ef53 sha
sha256:bb86e8d2c5951a726738b7773e3016fd1d22acb61723fb1f488659b3112006ce parent
+46 symbols
sha256:f8833f6923d25a717efbcef10fb5440d985252a67fdee082d366b0271bf10ffb snapshot
+46
symbols added
0
dead code introduced
Semantic Changes 46 symbols
~ docs/SEC-SEAM-1-SESSION-BOUND-IDENTITY-FREEZE.md .md 46 symbols added
+ SEC-SEAM-1 — frozen spec: session-bound learner identity for task / media / delegation writes section SEC-SEAM-1 — frozen spec: session-bound learner identity for task / media / delegation writes L1–515
+ Plain-language summary section 1. Plain-language summary L45–88
+ Technical summary section Technical summary L67–88
+ Ground-truth edge — what this session could not verify section 10. Ground-truth edge — what this session could not verify L458–470
+ table section table L460–467
+ Review record section 11. Review record L470–478
+ table section table L472–475
+ Operator decisions required before SEC-SEAM-1b (escalated) section 12. Operator decisions required before SEC-SEAM-1b (escalated) L478–515
+ 1 Ratification record section 12.1 Ratification record L511–515
+ D1 — security — stamp a session class claim on minted JWTs? class section D1 — security — stamp a session class claim on minted JWTs? L484–499
+ D2 — Tier 2 — media surface disposition section D2 — Tier 2 — media surface disposition L499–511
+ Ground truth — what the code does today (file+line) section 2. Ground truth — what the code does today (file+line) L88–150
+ 1 Why P3 is not exploitable through self-apply today section 2.1 Why P3 is not exploitable through self-apply today L126–137
+ 2 What the shared token actually collapses today section 2.2 What the shared token actually collapses today L137–150
+ table section table L142–147
+ table section table L97–125
+ Frozen trust model section 3. Frozen trust model L150–206
+ 1 Inherited assumptions (stated, not silently assumed) section 3.1 Inherited assumptions (stated, not silently assumed) L160–173
+ 2 The honesty clause — what Knowtation cannot verify section 3.2 The honesty clause — what Knowtation cannot verify L173–190
+ 3 Why the admission gate is the load-bearing rule section 3.3 Why the admission gate is the load-bearing rule L190–206
+ table section table L152–159
+ Frozen rules — SEC-SEAM-1b implements exactly these section 4. Frozen rules — SEC-SEAM-1b implements exactly these L206–371
+ 1 Frozen signatures section 4.1 Frozen signatures L351–371
+ code[js] variable variable code[js] L353–368
+ S1 — Session binding is a positive, mint-time, server-set property section S1 — Session binding is a positive, mint-time, server-set property L208–235
+ S2 — Author-bound admission to the self-apply class class section S2 — Author-bound admission to the self-apply class L235–254
+ S3 — The seam surface intent set is frozen and closed section S3 — The seam surface intent set is frozen and closed L254–274
+ code[text] variable variable code[text] L258–265
+ S4 — Client-asserted identity is forbidden, and the advertisement is removed section S4 — Client-asserted identity is forbidden, and the advertisement is L274–285
+ S5 — Seam propose keeps accepting learner roles section S5 — Seam propose keeps accepting learner roles L285–296
+ S6 — Named, loud refusals section S6 — Named, loud refusals L296–312
+ table section table L301–307
+ S7 — The hosted media surface gap is recorded, not silently "supported" section S7 — The hosted media surface gap is recorded, not silently "supported" L312–329
+ S8 — The consumer contract is published section S8 — The consumer contract is published L329–340
+ S9 — No scope creep section S9 — No scope creep L340–351
+ Scope section 5. Scope L371–383
+ Consumer contract — Scooling L-SEAM (not built by SEC-SEAM-1b) section 6. Consumer contract — Scooling L-SEAM (not built by SEC-SEAM-1b) L383–405
+ table section table L387–395
+ Test matrix — seven tiers plus security regression section 7. Test matrix — seven tiers plus security regression L405–432
+ table section table L411–420
+ Tier 3 gates (not part of SEC-SEAM-1b) section 8. Tier 3 gates (not part of SEC-SEAM-1b) L432–444
+ table section table L434–441
+ Residual risks and non-goals (explicitly accepted) section 9. Residual risks and non-goals (explicitly accepted) L444–458
+ table section table L446–455
+ Freeze-contract declaration section Freeze-contract declaration L12–45
+ code[yaml] variable variable code[yaml] L14–42
← Older Oldest on feat/sec-seam-1-session-bound-writes
All commits Newer SEC-SEAM-1a: freeze review round 1 (blocked) — 14 cited findings… sha256:6bdd12a3ca65d5167079e1595f5ee1719db31fbb2ccf959339229d07e196576e

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:b0fbc3d691c6540d82162e2fbcab5e530c6b2529e3d898ba5802e63497e8ef53 --body "your comment"