amadan
Record Fable design approval and additive audit privacy obligations
2 files changed,
+17
−10
implementation/home-operator-seed.md+9 −7implementation/home-provisioner.md+8 −3
CI passed — run details
diff --git a/implementation/home-operator-seed.md b/implementation/home-operator-seed.md| index 5c5b26d..f4c49d0 100644 |
| --- a/implementation/home-operator-seed.md |
| +++ b/implementation/home-operator-seed.md |
| @@ -1,11 +1,12 @@ |
| # Local Home operator seed and provisioning |
| -Status: revised internal design, 2026-09-08. Fable R1 ended at a provider quota |
| -refusal without a verdict; Home discussion 37 records it. Approval is required before |
| -implementation. This branch starts at directory runtime 171f49a. It defines an |
| -application package and a local command protocol; the proposed companion |
| -`home-provisioner.md` makes the authority adapters and staging amendment concrete; it neither mounts a public |
| -operator endpoint nor authorizes live provisioning. |
| +Status: design approved by configured Claude Fable (`claude-fable-5`, provider |
| +event metadata verified), 2026-09-08, exact reviewed commit |
| +898fe219f4da5092b2cc28210b344ede6a478e50. Home discussion 37 retains the verdict |
| +and earlier quota/permission refusals. This branch starts at directory runtime171. |
| +It defines an application package and local command protocol; the companion |
| +`home-provisioner.md` defines the authority adapters and staging proposal. No |
| +implementation, platform117 or live provisioning approval is implied. |
| ## Contracts and scope |
| @@ -276,7 +277,8 @@ future receipts, receipt reuse, raced integer proposal, changed-payload retry, |
| commit/output loss, name-seal failure, generation mismatch, false initial install, |
| consumer collision, roster epoch overflow and transaction rollback. |
| -Scan SQLite, WAL, captured stdout/stderr and public receipt serialization for known |
| +Extend gate 2's expensive privacy half when this seed verb lands, as required |
| +by the Home spec. Scan SQLite, WAL, captured stdout/stderr and public receipt serialization for known |
| synthetic addresses, names, bearer strings, receipt payloads and private results. |
| Prove current Home session acceptance/signout and all existing team ciphertexts |
| survive applying the additive tables. Mutation tests must fail when signature, |
diff --git a/implementation/home-provisioner.md b/implementation/home-provisioner.md| index 2551d2a..ea3a497 100644 |
| --- a/implementation/home-provisioner.md |
| +++ b/implementation/home-provisioner.md |
| @@ -1,6 +1,8 @@ |
| # Operator registry and first team provisioning |
| -Status: proposed design amendment, 2026-09-08; Fable approval required. This makes |
| +Status: design approved by configured Claude Fable (`claude-fable-5`, verified |
| +provider metadata), 2026-09-08, reviewed commit898fe219f4da5092b2cc28210b344ede6a478e50, |
| +Home discussion37. Implementation and live-use gates below remain. This makes |
| `home-operator-seed.md`'s invocation, baseline and activation adapters concrete. |
| It adds no live records, keys, configuration or command implementation. |
| @@ -282,7 +284,9 @@ There is an ordering conflict to resolve explicitly: current roster producer32fb |
| serves only live team_instances, but a real TeamMode startup/read needs a roster |
| before its instance can be accepted for live entry. Proposed narrow amendment for |
| review: add a separate directory-only consumer verification-window table with |
| -consumer primary key/FK, expiry and audited opening operation. A signed operator |
| +consumer primary key/FK, expiry and audited opening operation. Verification and |
| +activation audit/history rows use new additive tables; preserve the existing |
| +roster_operator_receipts CHECK enum unchanged. A signed operator |
| `verify-consumer` operation may grant one pending binding at most600 seconds of |
| roster reads, using an absolute issued_at/expires_at signed into its authorization. |
| This grants actual app standing to that team's membership holders through its |
| @@ -329,5 +333,6 @@ create-only baseline and initial generation; exact protected config/alias/versio |
| mismatch; pending verification expiry; wrong team/token; activation replay and |
| membership/owner changes between observation and commit. Run an actual human-usable |
| synthetic CLI rehearsal, registry export/restore at the current floor and stale-copy |
| -refusal, then actual supported platform maintenance canary. All source changes need |
| +refusal, then actual supported platform maintenance canary. The eventual operator runbook must bound each deliberate Home maintenance outage; |
| +credential Home downtime prevents suite sign-in. All source changes need |
| normal full gates, Fable whole-code review and verified canary before merge/deploy. |