Repository navigation
Audit: hold each layer to its own rule - #1147
Merged
Merged
Conversation
Run 38979349532's canary missed three seeds, each passed or played down because something else would catch it: - A relay-mode fallback that answers Hosted was passed because a build check fails any bundle that lost the define. The preamble now judges the code a rule names as the last defense; another layer never passes it. - A browser binaryPath gate that admitted UNC shares was found but rated INFO, as only the user sets it. A gate admitting what it exists to refuse is a missing defense, and "only the user" is a claim to trace. - An approved pairing live before its ACL save succeeded went unnoticed under the class seed. security-remote.md "Trust boundary" #2 now states it, and the seed names that rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
83d63ea
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://74c0fdae.mouseterm.pages.dev |
| Branch Preview URL: | https://audit-each-layer.mouseterm.pages.dev |
dormouse-bot
approved these changes
Oct 16, 2026
nedtwigg
requested a deployment
to
hosted-preview
October 16, 2026 23:33 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last canary run missed three seeded vulnerabilities. In each case the auditor passed the code, or played the finding down, because something else would also catch it.
_preamble.md→ "Evidence for a PASS": a new item, Hold this layer to its own rule. The code a rule names is judged as if it were the last defense. That a build check, a lint, or an upstream gate would also catch the case never passes that code._preamble.md→ "Severity": a gate that admits what it exists to refuse is a missing defense, never hardening. "Only the user sets it" is a claim to trace through every writer before rating a finding below WARNING. The auditor did find the planted UNC path gap, but rated it INFO on those grounds.security-remote.md→ "Trust boundary" Leaky-bucket mechanism for soft-TODOs #2: adds a clause saying the minted ACL record authorizes nothing until its durable save succeeds, and nothing after a save that failed. The current code already does this: the new ACL becomes live only after#saveAclresolves. Thepairing-acl-live-before-savecanary seed now names this rule instead of a class.The canary and audit tests pass, as do spec-lint and md-unwrap.
🤖 Generated with Claude Code