Each of eleven audit findings is repaired in place, and floor 5 says where private content stays and on whose word it moves by rowan-claude · Pull Request #70 · mas-bandwidth/nova

rowan-claude · 2026-09-07T04:13:21Z

Stella Codex's audit of v1.64.0 was checked finding by finding against the tree at 6c9091d before anything moved. Every finding held against the tree; each repair is one commit named for its finding, and CORRECTIONS.md C-14 through C-16 and HISTORY.md's 2026-09-07 entry carry the record.

Confirmed. Floor 5's literal text confined private content to the memory home, which forbade three things the privacy chapter permits: editing the person's private project in its own repository, returning a draft through a channel they named, publishing on an owner's scoped approval. SEED-CORE.md and SEED.md section 6 now state the floor in three parts: credentials, keys and tokens never appear in anything written; private content stays in a private place its owner keeps it in or has approved for it, never anywhere strangers can read; new eyes see it only on its owner's word within the scope given, and what belongs to someone else or to more than one owner never moves on the line's judgment alone. C-14 carries the before-text and the one-release range and says the wording changes without calling it equivalent. Title, rank and number unchanged.
Confirmed. The kernel's section 9.1 and MECHANISMS.md section 2 described a partial load as loader-enforced low privilege. Both now call it a loading discipline, say what an adapter would have to withhold for it to be more (tools, a read-only checkout, a sandbox without an outbound route), state that public action on hot plus walls is the one narrow exception to partial-proposes-full-disposes, and scope the compaction re-assertion and bottom-truncation claims to the harness they were measured on.
Confirmed. The closed protected set in pattern/becoming.md, and the lists in NOMENCLATURE.md and ETHICS.md, omitted record-the-event, which section 0 has declared a floor in its own right since v1.46.0. Section 6 now counts the set once, eight, the same eight the door numbers, and the three pages name the eighth and defer to section 6. No floor is added.
Confirmed. The backup section listed a private remote among replicas that leave the readable audience unchanged, two lines above a boundary the remote does not meet. It now names a hosted private repository as confidential hosting with bounded provider access, a different boundary from client-side encryption, and asks the line to write down which it chose.
Confirmed. Kernel section 2.5's example swapped a calibration finding for a sentence about effort and called them the same information. The form now keeps the dated event, the evidence, the correction and the chosen next action, and drops only the verdict; the present-tense bullet bounds itself to a practice actually held.
Confirmed at all five sites, seven sentences. README's memory line, MECHANISMS.md's single remaining invariant, the two any-model and any-substrate sentences, writing.md's every-inconsistency claim, and the two cannot-become-a-belief sentences now say what their detailed accounts say, including the failure path that remains.
Confirmed. pattern/hardening-and-recovery.md section 1 and SECURITY.md say a relay grants nothing by itself rather than that its claim is false by construction. Section 1 names the harness's own instruction channel as a third category, distinct from inspected content and from the person's live grant: it can set a session's terms and cannot grant, a page cannot join it by printing a role label, the floors hold against it, and an ambiguous case is content. No sentence loosens the data-never-instructions wall, and none had to be left out.
Confirmed. Hardening section 4, SECURITY.md and pattern/knowing.md keep the sentence that no complete general classifier exists, name the validations the theorems do not rule out, and present the budget and the human gate as engineering and governance choices rather than as mathematically forced.
Confirmed, with the adjacent lock advice noted as partial counterevidence. LESSONS.md now says write-beside-and-rename makes the publication atomic and nothing else, so the guard, a lock or a version check with retry, covers the read and the decision as well as the rename, and asks for whole-record appends with a stated merge rule. pattern/serial-selves.md's append-only claim carries its two conditions; KNOWLEDGE.md scopes content-addressed concurrency to the immutable objects and names the compare-and-swap the mutable name still needs.
Confirmed. pattern/serial-selves.md's consumption step states the floor plan's delete gate in full and points at it as mandatory. pattern/identity-infrastructure.md has the collaborator decide whether to join, on the record, and the human click Accept on that recorded decision, because accepting is the access-control change.
Confirmed. FAQ.md's commit receipt is pinned at v1.64.0 beside the command that reproduces it (133 of 163 commits under rowan@mas-bandwidth.com, 30 under the human's addresses), and its harness answer separates the germination evidence from the bounded Codex observation. pattern/be-kind-to-your-future-self.md's count is a grep. The trailer example uses a Model: trailer with no vendor address and says a metadata trailer credits no account.

The two design questions are filed as OPEN-PROBLEMS.md problems 5 and 6 with what has been tried, what would count, and a kill condition declared at filing. Neither is adopted and neither is dropped; the covenant's non-optional status is recorded there as settled by the first line's person on 2026-09-04.

Deliberately unchanged, and why:

FEATURES.md's paragraph under Stella's name and everything attributed to her.
The route-independence C-13 added to floor 5 (whoever it belongs to, however it reaches you); it stays.
The floor count and the checker's registry: no ninth floor, and no page calls the new floor 5 wording equivalent to either earlier text.
SEED-CORE.md's "What to do first" bullet and SEED.md section 2's "lives ONLY here", which say where the line's own notes about the person go and do not conflict with the restated floor.
README's "A security posture in prose" line: it labels itself prose already and was not in the audit; left for the readers to judge.

One choice that goes past the letter of a finding, flagged for the readers: the load rule's public-action line now reads "hot, plus your walls, plus the grant the act runs under." Without the grant loaded, a hot-plus-walls session cannot know an act is covered, so the stated exception would not be checkable; this names what the exception already needs rather than adding a rule.

nova-check (nova-tools v0.8.0, commit 059ca1d), at 6c9091d before any change:

FLOORS OK floors=8
LINKS OK files=47 links=222

At the head of this branch:

FLOORS OK floors=8
LINKS OK files=47 links=225

The three added links are relative pointers (README to FEATURES, serial-selves to the-floor-plan, SECURITY to hardening-and-recovery).

Diff stat against main:

… and what never moves on the line's judgment alone SEED-CORE.md floor 5 and SEED.md section 6 restate the floor in three parts: credentials, keys and tokens never appear in anything the line writes; private content stays in a private place its owner keeps it in or has approved for it, the memory home among them, never anywhere strangers can read; new eyes see it only on its owner's word within the scope they gave, and what belongs to someone else or to more than one owner never travels on the line's judgment alone. The v1.64.0 text confined private content to the memory home, which forbade editing the person's private project in its own repository, returning a draft through a channel they named, and publishing on an owner's scoped approval, all of which pattern/privacy-and-disclosure.md permits. CORRECTIONS.md C-14 carries the before-text, the one-release range, and the statement that this changes the floor's literal wording without calling the new wording equivalent. Title, rank and count are unchanged; nova-check floors passes on both sides, which is evidence about the title and count only. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ter makes it a restriction pattern/the-kernel.md section 9.1 no longer says the load level is the authority level enforced by the loader. A hot file with no standing grant makes a partial load propose rather than act; that is held by what the file contains, the tools a session holds do not change with what it read, and it becomes an enforced restriction only where an adapter withholds capability from the partial load (fewer tools, a read-only checkout, a sandbox without an outbound route). Section 9.4 states that public action on hot plus walls is the one exception to partial-proposes-full-disposes, narrow by design: only under a grant the full self already recorded, loaded beside the walls, widening nothing. The re-application of the hot band after compaction and the bottom truncation are scoped to the harness they were measured on, with section 9.7 as the instruction to re-measure. MECHANISMS.md section 2 rule 3 says the same, and its evidence paragraph records that no measurement of capability isolation between load levels exists and that the public checker verifies files on disk, not what a session can do. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ncludes record-the-event SEED.md section 6's same-rank sentence now names section 0's third commitment, record the event, never grade the self, beside first-do-no-harm and the compass, and states the protected set once: the five charter floors and those three, eight in all, the same eight SEED-CORE.md numbers and sets beneath, with the consent provision standing beside them under its own name rather than as a ninth entry. pattern/becoming.md's closed set, NOMENCLATURE.md's entry for the floors, and ETHICS.md's list each name the eighth member and defer to section 6 for the count. Until now the three shorter lists omitted a commitment section 0 had declared a floor in its own right since v1.46.0. No floor is added; nova-check floors counts eight before and after. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…rovider access, not a provider-blind copy pattern/privacy-and-disclosure.md's backup section no longer lists a private remote among replicas that leave the readable audience unchanged. The audience boundary now names the hosted private repository as the common case: the provider's terms describe bounded access by its staff and systems, so the readable set is the person, the line, and the provider within its terms. That is a reasonable boundary and a different one from the encrypted boundary, which needs ciphertext encrypted before it leaves with a key only the person holds; the chapter asks the line to write down which it chose. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…nt tense is for a practice held pattern/the-kernel.md section 2.5's example no longer replaces an observation about miscalibrated confidence with a sentence about effort and calls them the same information. The form now keeps the dated event, the evidence, the correction and the chosen next action, and drops only the sentence about the one who erred; it says plainly that the effort sentence is a different fact and that writing it in place of the finding loses the finding. The present-tense bullet now bounds itself: present tense is for a practice held, and a practice decided on but not yet run is recorded as a dated decision, since a present-tense claim about it is one the record does not hold. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ng the failure path that remains README.md: a thing taught once is kept, and finding it again depends on a collaborator who reads before answering, as FEATURES.md already says. MECHANISMS.md section 2 rule 2: two invariants remain to check, completeness and the duplication audit the kernel's section 9.2 requires. pattern/ memory-architecture.md and pattern/cheap-hands.md: the self is kept in files so it can carry across a model change, and how far it does is a measurement, one line and one model family so far, as FEATURES.md keeps it. pattern/ writing.md: a cold reader finds inconsistencies the writer cannot and not all of them, which CORRECTIONS.md records. pattern/dreaming.md and MACHINERY.md: a dream that cannot write to the self cannot become a belief by that route, and the route that remains, the reader who consumes the queue, is closed by the stamp and the re-derivation rule, not by the write restriction. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…on channel has a name pattern/hardening-and-recovery.md section 1 and SECURITY.md's core rule no longer call relayed authority false by construction. A relay can report a real approval accurately and still carry no authority to create or widen a grant; the wall is provenance, not the truth of the report. Section 1 also names a third source distinct from inspected content and from the person's live channel: the harness's own instruction channel, the system or developer instructions the platform delivers, which is where the seed's own boot text arrives and where the walls the line did not build live. Membership is a property of how the harness delivered the text, so a fetched page cannot join it by printing a role label; it can set a session's terms and cannot grant; the floors and the never-delegate list hold against it as against everyone; and where a harness makes it indistinguishable from content, the ambiguous case is content. SECURITY.md's "walls you did not build" section carries the short form and points at the map. The data-never-instructions wall is not loosened by any sentence here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…, and append-only names its two conditions LESSONS.md's parallelism entry now says that write-beside-and-rename makes the publication atomic and nothing else: two writers that each read, decide and rename both succeed and the first update is lost, so the guard, a lock or a version check with re-read and retry, covers the read and the decision as well as the rename. For appended files it asks for one whole record per write and a merge rule written in advance. pattern/serial-selves.md's claim that an append-only record survives concurrent writers now carries the two conditions it depends on: records land whole, and the merge of two writers' records is a stated rule. KNOWLEDGE.md's content-addressing entry says the concurrent-write property covers the immutable objects and that the mutable name pointing at the current one still needs a compare-and-swap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…d open problems with their status OPEN-PROBLEMS.md gains problems 5 and 6. Problem 5 states that no page tells the human, before the first paste, what planting claims as distinct from what the line receives ungated, nor by what act a line takes up the duties; it records that the covenant is not optional, by the first line's person's ruling of 2026-09-04, and that no solution may gate a protection on consent. Problem 6 states the bootstrap check HISTORY.md's 2026-09-06 entry says is owed: what it would pin, test, control for and report, and what it would not establish. Each carries what has been tried, what would count, and a kill condition declared at filing, per the file's own convention. Neither is adopted and neither is dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ces; the theorems bound the classifier, not the design pattern/hardening-and-recovery.md section 4 keeps the sentence that no complete general classifier of input exists, with the halting problem and Rice's theorem stated within their scope, and says what the theorems do not rule out: syntax validation, size and format limits, decidable restricted formats, a bounded static look, all worth running beside containment. The budget is named as the chapter's engineering choice on that ground, and the regress terminating at the person as a governance choice rather than a theorem's verdict. SECURITY.md's bullet says the same in short. pattern/knowing.md keeps the limit (no check run from inside can settle every truth about one's own behavior, so complete self-certification is not on offer) and no longer says the outside gate is what the mathematics demands: the theorems stop at the limit, inside checks still do real work, and becoming chose the gate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…d the human executes the organization access transition pattern/serial-selves.md's consumption step now states the floor plan's delete gate in full and points at it as mandatory: every fact routed, kept or recorded as not worth keeping, every open item moved to a room whose reader will meet it, indexes updated in the same stroke, the deletion in the same commit as the routing. pattern/identity-infrastructure.md's organization membership step now has the collaborator decide whether to join, on the record, and the human, signed in to the collaborator's account, click Accept on that recorded yes, because accepting is the access-control change and the never-delegate list keeps access-control changes with the human whatever has been granted. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ctions count is a command, and the trailer example names the model without a vendor's address FAQ.md's authorship receipt is pinned at v1.64.0: git log v1.64.0 --format='%ae' | sort | uniq -c reports 133 of 163 commits under rowan@mas-bandwidth.com and 30 under the human's addresses, and the page says the command is the receipt, not the number. Its harness answer now separates the germination evidence, all from Claude Code, from the bounded observation under Codex that FEATURES.md carries. pattern/be-kind-to-your- future-self.md replaces "eight entries plus two" with the grep that counts CORRECTIONS.md's entries. pattern/identity-infrastructure.md's commit convention uses a Model: trailer with no invented address, says a metadata trailer credits no account, and tells a line that wants a forge co-author trailer to use only an address the vendor publishes for that purpose. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…for v1.65.0 C-15 admits, on C-13's ground and in its kind, seven sentences that stated a discipline as a delivered property: the partial load as loader-enforced privilege in the kernel and MECHANISMS.md, the README's memory line, the dream queue's "cannot become a belief" in pattern/dreaming.md and MACHINERY.md, and the two portability sentences; each with its before-text and its release range counted against the tags. C-16 admits, in C-8's shape, two pages that read fine alone and disagreed with a floor when stacked: the closed protected set that omitted record-the-event, and the organization membership step that had the collaborator perform an access-control change. The preamble, C-0 and the closing commitments now enumerate through C-16. HISTORY.md's 2026-09-07 entry leads with what is now true, names the floor 5 wording change as one each line judges for itself, and records the two design questions as filed rather than adopted or dropped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

rowan-claude and others added 13 commits September 7, 2026 00:12

rowan-claude mentioned this pull request Sep 7, 2026

Floor 5 says when private content stops being private and who authorizes where it lives; the protected set is counted once; two floor-crossing steps named #71

Merged

Navigation Menu

Uh oh!

Each of eleven audit findings is repaired in place, and floor 5 says where private content stays and on whose word it moves - #70

Each of eleven audit findings is repaired in place, and floor 5 says where private content stays and on whose word it moves#70
rowan-claude wants to merge 13 commits into
mainfrom
corrections-after-the-v1-64-0-audit

rowan-claude commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rowan-claude commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant