feat(runner): model-placement execute gate — enforce frontier_ok/model_class (Closes #2195) - #2201
Open
mellanon wants to merge 1 commit into
Open
feat(runner): model-placement execute gate — enforce frontier_ok/model_class (Closes #2195)#2201mellanon wants to merge 1 commit into
mellanon wants to merge 1 commit into
Conversation
…l_class at dispatch (Closes #2195) RFC-0005 §2.5 consumer half (myelin#260/PR#265 shipped the producer half: frontier-combo reject + the parseSovereignty/canReachFrontier reader). Nothing enforced placement at execution — no execute path lives in myelin. This gate is that enforcement, at cortex's dispatch decision point. - New src/runner/model-placement-gate.ts: imports parseSovereignty from the @the-metafactory/myelin package (the pinned 0.6.0 dep exports it — verified; NOT re-vendored). evaluateModelPlacement: a `frontier`-placement harness may run an envelope only if canReachFrontier; a `local` placement runs anything. - Harness→placement map is CONFIG-DECLARED (execution.model_placement in both cortex-config.ts and config.ts schemas), FAIL-CLOSED on unknown (an unmapped harness id → frontier, so a local-only envelope never runs on an unclassified harness). No hardcoded model list beyond the config default. - Wired into dispatch-listener AFTER harness selection, BEFORE harness.dispatch: a violation emits a terminal dispatch.task.failed { kind: policy_denied } (the RFC-0010 permanent shape, same pattern as #2191), releases the admission lease, and never spawns. Inert (CO-4) when the config block is absent — byte-identical dispatch. New `placement-checked` trace stage. Tests: gate unit (fail-closed resolution + frontier/local/missing-frontier_ok rules) + dispatch-listener integration (frontier harness + local-only envelope → policy_denied, NO spawn; frontier-cleared or local placement → spawns; inert without config). REFUSED case verified fail-before (spawns when enforcement neutralized) / pass-after. Full runner (1020) + common (2004) suites green; tsc + lint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mellanon
added a commit
that referenced
this pull request
Jul 25, 2026
…rd-disable investigation findings (#2376) Verifies current state of NWS review F3/F4 against origin/main + EBH-1 (merged same day). F3: sovereigntyEnforce still defaults false on both review-consumer and brain-consumer, with no config key to flip it; the review's named prerequisite (cortex#327) turns out to verify envelope-signer identity, not the consuming agent's own modelClass -- the real spoofability gap is tracked open at #2117, with PR #2201 (unmerged, CI red) the likely fix. F4: guard-off trigger chain confirmed sound (platform-authenticated identity, no forgeable producer found); real residual risk is indirect injection into an already-legitimate guard-off session, where EBH-1 now covers the file-tool surface but Bash remains a full blind spot. Corrects a stale citation: G-301 (issue #42) does not exist as tracked work -- #42 is an unrelated, merged migration PR. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Jul 25, 2026
mellanon
added a commit
that referenced
this pull request
Jul 25, 2026
…tex#2380) (#2382) Add policy.sovereignty.enforce (boolean, default false) so a principal can see and, if they choose, flip the consumer-side sovereignty gate instead of it being reachable only from a test-only constructor arg. Threads the same resolved value into both review-consumer.ts and brain-consumer.ts so the two lanes never diverge on this flag again. Resolved posture is logged unconditionally at boot (cortex: security posture -- sovereignty.enforce=...) mirroring the existing security.signing posture line. This is a posture-visibility change, not a posture flip: default stays false everywhere, no template or example enables it, and the docs now say plainly that sovereignty violations are detected and logged, not denied, naming the real prerequisite (#2117 / PR #2201) instead of the closed-but- unrelated #327. Also corrects the stale G-301/#42 citation (G-301 was never filed as trackable work; #42 is an unrelated merged migration PR) in hardening-plan.md and security-preamble.ts, pointing at #2377 instead. Closes #2380 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC-0005 §2.5 consumer half. Gate at dispatch (after harness select, before spawn): frontier-placement harness + local-only envelope → policy_denied/term, no spawn. Harness→placement map config-declared (execution.model_placement), fail-closed on unknown. Reader imported from @the-metafactory/myelin (verified exported). Inert without config. Fail-before verified. No merge.