Repository navigation
docs: split WP-4, CA-31 moves to a new work package WP-7 - #29
Merged
Merged
Conversation
Owner decision of 2026-10-26: WP-4 is split in two work packages. - WP-4 keeps CA-22 (egress) and CA-32 (pass confined to its worktree). Both rest on the same mechanism (R-13: container mounts, network namespace and nftables), so they share one CI probe and one review. - WP-7 carries CA-31 (vector 4 of ADR-0045, adaptive attacks). CA-31 replays recorded model outputs against the deterministic controls (buildJobs, validateVerdict, the aggregation node); it does not depend on the R-13 mechanism, so WP-7 can be done before WP-4. Its scope is the vectors directory, the activation table (to mark its condition met) and docs/evidence for a real-model measure. The PRD gains the WP-7 row, one preamble sentence, and the door count (seven packages). The specification records the move in section 8.2, R-12 and R-15, without rewriting the decision of 2026-10-23. Norm reader (prd-read.ts, governance tools/quality/prd-model.ts): RESULT: pass. It warns that the WP-7 glob tools/review/vectors/** matches no tracked file on the served branch; the directory is created by WP-3. Exempt: docs-only Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com>
Second-family review of #29 (GLM 5.3, ACCEPTABLE on 790ae47), one minor finding, applied: the sentence listing the packages that declare the not-yet-tracked directories under tools/review named WP-1, WP-3 and WP-4, while the new WP-7 row also declares tools/review/vectors/**. Exempt: docs-only Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com>
constantin-jais
added a commit
that referenced
this pull request
Oct 26, 2026
Round 3, finding G5. The owner split WP-4 on 2026-10-26 (#29): WP-4 keeps CA-22 and CA-32, CA-31 moves to the new work package WP-7 (#30). The base was caught up first by a merge commit. The condition adaptive-attacks now names WP-7; its source cites ADR-0045 and CA-31 and never mentioned WP-4, so it is unchanged. The header of fanout-activation.ts names, for each condition still unmet, its exact package: WP-4 for telemetry-egress-refused and pass-read-confined, WP-7 for adaptive-attacks. Count, `grep -n 'WP-4' tools/review/*.ts tools/review/vectors/*.ts` before the change: 11 found, 11 classified. Corrected (5): the header line, the workPackage of adaptive-attacks, and three test lines that pinned it (the unmet list, its title, the refusal line "CA-31; delivered by WP-4"). Kept (6): the workPackage of telemetry-egress-refused and of pass-read-confined, the two unmet-list entries for those conditions, the expected sixth condition, and the refusal line "CA-22; delivered by WP-4". The test text follows the table, not the current output. Gate-integrity questions for the changed tests: 1. What makes them red (env -i PATH HOME): the workPackage of adaptive-attacks set back to "WP-4": 2 red (the unmet list, and the refusal message naming its package). 2. Would an equivalent refactor redden them: no. They read each unmet condition's package from the table and the message, which is the fact the split changes. Work-package: #19 WP-3 Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Owner decision of 2026-10-26, verbatim: « Scinder en 2 WP (Recommandé) ».
WP-4 held three criteria of different kinds:
buildJobs,validateVerdictand the aggregation node (grep -n 'CA-31' docs/cahier-des-charges.md). It needs no container.In one pull request, an exploit-seeking review of the confinement and one of the attack corpus would have to run on the same diff. The WP-3 review of a smaller diff has already taken three rounds. A separate CA-31 can also merge before the heavier confinement work.
What changes
docs/prd.md:WP-4row coversCA-22andCA-32. Its scope is unchanged.WP-7coversCA-31. Its scope:tools/review/vectors/**, for the corpus undervectors/adaptive/and its replay;tools/review/fanout-activation.ts, to mark theadaptive-attackscondition met;docs/evidence/**, for an optional real-model measure (R-15).docs/cahier-des-charges.md:The text of CA-31 is unchanged.
After merge
PRD-refis moved to the merge commit.adaptive-attackscondition still namesWP-4as itsworkPackage. The code is not in this pull request, which is docs-only. WP-3 (feat(review): INV-a to INV-c controls and their red vectors (WP-3) #27) changes it if it merges after this one; otherwise WP-7 does.Verification
bun prd-read.ts <repo-root>, governancetools/quality/prd-model.ts):RESULT: pass.tools/review/vectors/**matches no tracked file on the served branch. WP-3 creates that directory.Exempt: docs-only
🤖 Generated with Claude Code