amadan
Ruling 21: the zero-JS tripwire fired, and it fired correctly
§11 said the day a surface needs script is the day the section is wrong. Passkeys are that day. Paul ruled one named carve-out for enrolment and ceremony rather than widening the rule or dropping the second factor, and this file follows. The allowlist matters more than the exemption: a rule naming which screens may load script is checkable, and one with an escape hatch is not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 file changed,
+10
−2
AGENTS.md+10 −2
CI passed — run details
Intent
Attributed to this commit: 245 g CO₂e (21956905 tokens). This is an attribution, not a measurement — usage counted from this commit's own marker forward to the next one on fix/agents-md-matches-spec, never backward from it. A turn that produced more than one commit books all of its tokens to the last one, and a concurrent session on this branch can add to the same figure. Some of it was priced using the shared default rate, because no model-specific factor row exists yet for at least one model involved. The Carbon view has the repo total, which is never derived from this attribution.
diff --git a/AGENTS.md b/AGENTS.md| index 7767872..94da18a 100644 |
| --- a/AGENTS.md |
| +++ b/AGENTS.md |
| @@ -241,8 +241,16 @@ quietly ignored). |
| copy of that test. There is no vendored `static/` in the |
| tree today — `internal/home/page.go` links no stylesheet, deliberately — |
| so this is an instruction with no object until the first asset arrives. |
| -- Zero JS. **No surface here has any reason to require script**, and the day |
| - one does is the day the spec is wrong. |
| +- Zero JS, **with exactly one carve-out** (ruling 21): the passkey |
| + enrolment and ceremony screens may load rastrillo's own `webauthn.JS()`. |
| + That sentence used to read "no surface here has any reason to require |
| + script, and the day one does is the day the spec is wrong" — and the day |
| + came, with passkeys. It was a tripwire and it fired correctly. Everything |
| + else stays scriptless: magic-link sign-in, recovery-code redemption and |
| + the springboard, so script-off keeps a working sign-in and loses only an |
| + optional second factor. The no-`<script>` test carries an **explicit |
| + allowlist of the carved-out screens** — never a blanket exemption, because |
| + a rule with a list is checkable and a rule with an escape hatch is not. |
| **Deploys** |
| - One binary, `CGO_ENABLED=0`, cgo-free SQLite. |