b232265264
docs: estate-wide consistency pass (workflow audit, 36 findings, all verified before fixing)
...
Nine parallel readers audited every doc against measured ground truth; every
finding was re-verified against the file before any edit, and the sweep fixed
by PROPERTY, not by flag — wording the readers caught in one repo was hunted
in all siblings (the two-button README sentence existed in all four forks,
not the three flagged; likewise the cone-overclaim in TRUSTED-BASE item 1).
This repo: see the diff. Records were not rewritten; clarifications are
dated. Doc-only except where noted in the estate summary; every gated doc
change was followed by a green button run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-07 16:00:54 +02:00
65772b3d2e
warden hardening round: policy engine, ledger rotation, MCP UX, treasury LIVE, ops docs
...
Tier 2:
- request_signature decomposed into named gates (latch, freshness,
intent, policy, signer, firewall)
- ledger: O(1) tail-read appends under a dedicated lock file (survives
rotation rename); hash-chained segment rotation at policy
ledger.rotate_at; verify-ledger walks all segments to genesis;
archive tampering detected (tested)
- docs/threat-model.md (attacker matrix 1-9, proven-vs-trusted, design
invariants) + docs/runbook-latch.md (diagnose-first recovery)
- lecture 10: executable corrupt-a-member exercise (capsule pin catches
one appended byte), honest note on what the pin does NOT stop
Lightweight policy engine (POLICY_DENIED wired):
- policy.json: per-request/per-day amount ceilings, counterparty
allow/deny lists, per-identity overrides; rules make their intent
fields mandatory; daily sums from the ledger
-
Agent UX:
- signed refusal receipts travel inside MCP errors (receipt +
receipt_path in structuredContent)
- airgap over MCP: request_signature signer=airgap + request_id,
new airgap_pending tool; park -> list -> device answers -> complete
(tested end-to-end)
- all 8 tools carry readOnly/destructive annotations
- sliding-window rate limiter per tool class (custody/verify/liveness);
RATE_LIMITED refusal code; surface control, not ledgered
warden-treasury LIVE:
- treasury.py: stdlib base58, compact-u16, legacy+v0 wire parsing;
every required signature quorum-verified over exact message bytes;
completeness gap named in every verdict; RPC fetch uses response as
bytes only
-
- live-quorum test: synthetic Solana tx signed with wallet key ->
authentic via 4 proven forks; flipped byte -> not authentic
100 tests green (was 85).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-07 13:38:42 +02:00
