Skip to content

docs(spec): resolve C5 audit findings — casing authority (G1) + localized staleness (G3)#206

Merged
dp-web4 merged 2 commits into
mainfrom
worker/web4-20260517-180002
May 18, 2026
Merged

docs(spec): resolve C5 audit findings — casing authority (G1) + localized staleness (G3)#206
dp-web4 merged 2 commits into
mainfrom
worker/web4-20260517-180002

Conversation

@dp-web4
Copy link
Copy Markdown
Owner

@dp-web4 dp-web4 commented May 18, 2026

Summary

Remediates 7 of 13 findings from the C5 presence-protocol internal-consistency
audit (PR #204, merged 2026-05-17). Follows the same pattern as the C2 audit
remediation (PRs #200, #201, #203).

G1 — Casing authority (P1/P3/P6) — commit 1

  • P1 (HIGH): §3 falsely stated tool input is camelCase; rewrote as surface-split
    rule (input snake_case / output+type-catalog camelCase / resource bodies
    snake_case), anchored to the bound schemas.
  • P3 (MED): §7 had no schema-precedence clause; added Precedence paragraph
    making JSON Schemas + vectors normative over prose on any wire-shape disagreement.
  • P6 (MED): Narrowed §5's overbroad "all wire shapes camelCase"; corrected §8
    drift row 5 whose "rename to camelCase" aspiration contradicted the §7-bound
    snake_case conformance vectors.

G3 — Localized staleness (P4/P5/P7/P9) — commit 2

  • P4 (MED): §3.1 output example pinned stale protocolVersion: 0 → updated to 1.
  • P5 (MED): §5.4 PolicyResult type catalog lagged §3.4 tool surface — added
    status, nextPollMs, documented enforced. Cross-refs §3.4.1 wait protocol.
  • P7 (LOW): §2 link text "tool/connect" → hestia_connect with correct anchor.
  • P9 (LOW): §3.1 error list annotated hestia.invalid_role with (v1+)
    reservation caveat matching §6.1.

Not addressed (future PRs)

  • G2 (P2/P8/P10/P11) — discipline honesty: synthetic completion, §2 additive-field
    exception, §8/§9 post-v1 staleness.
  • G4 (P12/P13) — conformance vector gaps: fix P1-003, add wait-protocol vector.

Test plan

  • Verify all 7 findings resolved by re-reading modified sections against audit
  • Confirm zero wire-shape change (artifacts were already correct; only prose wrong)
  • No SDK or daemon changes needed

🤖 Generated with Claude Code

dp-web4 and others added 2 commits May 17, 2026 18:11
presence-protocol.md's normative casing statements were self-contradictory
and contradicted the JSON Schemas + conformance vectors §7 binds:

- P1 (HIGH): §3 falsely stated tool INPUT is camelCase; schemas require
  snake_case inputs. Rewrote §3 as a surface-split rule (input snake /
  output+§5-type camel / §4 resource snake), anchored to the bound schemas.
- P3 (MED): §7 had no precedence rule and bound only the vectors JSON.
  Added a Precedence clause making the Schemas DIRECTORY + vectors
  normative over prose on any wire-shape/casing disagreement.
- P6 (MED): narrowed §5's overbroad "all wire shapes camelCase"; corrected
  §8 drift row 5 whose "rename to camelCase in v1" aspiration contradicted
  the §7-bound snake_case conformance vectors (sovereign_lct, chain_length).

Zero wire-shape change — artifacts were already correct; only prose was
wrong. Remediates the merged C5 audit (PR #204). 1 file, +27/-8.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Four independent one-spot fixes from the C5 presence-protocol
internal-consistency audit (PR #204):

- P4 (MED): §3.1 output example pinned stale `protocolVersion: 0`;
  updated to `1` to match §2's v1 declaration and the conformance
  vectors.
- P5 (MED): §5.4 PolicyResult type-catalog entry lagged the §3.4
  tool surface — added `status`, `nextPollMs`, and documented
  `enforced`. Cross-references §3.4.1 wait protocol.
- P7 (LOW): §2 link text "tool/connect" → `hestia_connect` with
  correct in-doc anchor.
- P9 (LOW): §3.1 error list for `hestia.invalid_role` omitted the
  §6.1 reservation caveat (v1+; v0 daemons may emit
  `hestia.internal_error` instead).

Zero wire-shape change — only prose/examples brought in line with
existing schemas and normative sections. Complements the G1 casing-
authority commit (same branch).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@dp-web4
Copy link
Copy Markdown
Owner Author

dp-web4 commented May 18, 2026

APPROVED: Remediates C5 audit findings G1 (P1/P3/P6 casing authority) + G3 (P4/P5/P7/P9 localized staleness) — 7 of 13 findings. Diff matches description exactly: §3 rewritten into surface-split casing rule anchored to bound schemas, §7 Precedence clause added (schemas dir + vectors normative over prose), §5 camelCase narrowed with explicit input/resource-body carve-out, §8 drift row 5 corrected, protocolVersion 0→1 example fix, PolicyResult status/nextPollMs/enforced documented, hestia_connect link fix, invalid_role (v1+) annotation. 1 file, 0 new files, docs-only spec reconciliation, zero wire-shape change (schemas/vectors were already correct). No drift signals. Follows sanctioned C2 audit→remediation precedent (#200/#201/#203). Superset of #205 with accurate scope description.

@dp-web4 dp-web4 merged commit a67e9c9 into main May 18, 2026
@dp-web4 dp-web4 deleted the worker/web4-20260517-180002 branch May 18, 2026 05:04
dp-web4 added a commit that referenced this pull request May 18, 2026
…ipline; §7.7 promotion gate formalized

Eight commits since 2026-05-17 reviewed. All are audit-remediation
clean-up of two specs already on the watch list (presence-protocol +
mcp-protocol §7.7); none introduce new protocol surface or warrant
integration today.

- C5 presence-protocol internal-consistency audit (#204) → G1
  casing-authority + G3 localized staleness (#206) → G2 discipline
  honesty (#207). Spec now internally consistent at v1 — but
  consistency is the *condition* for integration, not the trigger.
  DEFER continues pending Hestia/Hardbound registry-published release.

- mcp-protocol C2 audit remediation HIGH F2/F3/F4/F12 (#200) +
  MEDIUM F1/F5/F15 (#201) + LOW F14/F16 (#203). §7.7 conformance
  status disambiguated per-subsection; atp_settlement gains referent
  slot forward-compatible with §7.7.3 acceptance payload.

- §7.7 promotion-tracking memo (Sprint 54 C3, #202) formalizes the
  integration gate: 3 hard prerequisites (one now met), 5 open
  design questions, 2-implementations + interop + error-catalogue
  evidence criteria. Pending Updates row refined to cite the memo
  directly rather than re-derive gate logic per maintenance pass.

Live whitepaper sections verified clean of canonical-term drift
(only archive files retain historical expansions, intentionally
preserved per 2026-04-29 cleanup). Build artifacts remain aligned
with 2026-05-16 source state (5ccbe46); no rebuild needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
dp-web4 added a commit that referenced this pull request May 18, 2026
…/P13) (#208)

P12: P1-003 ("v1 protocolVersion bumped on connect") previously only
read hestia://society/state and checked sovereign_lct — it never
verified protocolVersion. Now does a fresh hestia_connect with
protocol_version: 1 and asserts protocolVersion == 1 in the response.

P13: New P1-004 vector verifies wait-protocol default values per §3.4.1:
status == "decided" and nextPollMs == null on a v1 query_policy response.

Completes C5 audit remediation (G1+G3 merged #206, G2 merged #207,
G4 this commit). 14 conformance scenarios (was 13), 1 file modified.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant