From 6395c1b027506ab9fd308ec9fde2e6a8ed464454 Mon Sep 17 00:00:00 2001 From: githubscum Date: Tue, 27 Oct 2026 00:35:00 -0500 Subject: [PATCH 1/2] KNOWN-LIMITS 23: amend blast radius (bare filenames, bin/, file tools) Field reports from 2026-10-26 plus a re-read of the self-mod fragment list: the npm manifest fragment matches every package.json on the machine (by design, now disclosed), core-shaped relative paths and the bin/ regex match outside the install, and the file tools over-gate the same way. One report (.claude.json on its own) does not hold against the source and is marked so. No new number. Pin re-stamped. Co-Authored-By: Claude Opus 5.5 --- KNOWN-LIMITS.md | 41 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/KNOWN-LIMITS.md b/KNOWN-LIMITS.md index 6d84079..e4fe306 100644 --- a/KNOWN-LIMITS.md +++ b/KNOWN-LIMITS.md @@ -1,8 +1,8 @@ @@ -540,6 +540,43 @@ command's trailing slash before matching, while the file form (`.../src/store/x.js`) gates. The over-gate is real for the file form; the trailing-slash directory form is an under-gate of the same rule. +**Amended 2026-10-27: the blast radius is wider than the title.** Field reports +from one session on 2026-10-26 (five self-mod denials on read-only commands, +all left unsigned) and a re-read of the policy source show three more shapes of +the same over-gate. No new number; the cause is the one above, a matcher that +reads path text and does not know where the Lotor install lives. + +1. **A protected bare filename matches anywhere on the machine.** The fragment + list in the self-mod matcher includes the npm manifest (`package.json`) with + no directory. Any command naming that filename gates, in any project: a + `node -e "require('./node_modules//package.json')"` in a folder with no + relation to Lotor was stopped as self-mod. The source comment there says this + is deliberate (an execution manifest is worth a signature everywhere, since + the matcher cannot resolve which repo's manifest it is), so this part is an + accepted cost, now disclosed here rather than only in a code comment. +2. **Core-shaped relative paths match outside the install.** `bin/*.js` (any + name, via the bin regex on both the Bash and file-tool paths) and the + `src//` fragments match wherever they sit. In a fresh temp clone of + this repo, `node bin/pap-boot.js` was stopped as self-mod, so running a + Lotor checkout that is not the install still costs signatures. +3. **The file tools over-gate the same way.** A Write or Edit to an npm + manifest in an unrelated project was blocked, not only Bash commands. + +One report did not hold up against the source: no self-mod fragment matches +`.claude.json` on its own (the protected settings fragment is +`.claude/settings.json`); the command that tripped on it also named the npm +manifest, which is the likelier match. Unconfirmed from the receipt. + +Observation, not a new limit: the same file can gate or not by spelling. +`npm run pap:boot -- ...` ran the script that `node bin/pap-boot.js` could not, +because the matcher sees the command string, not what it executes (limit 26's +class). Here that lands in the over-gate's favour by luck. + +Fix shape, unchanged and still not wired: scope directory fragments, the bin +regex, and bare filenames to the resolved Lotor install root, which core-paths +already knows how to find. Until then, every item above is the cheap failure +of limit 21, and its cost is paid in signatures on unrelated work. + ## 24. The destructive allowlist exempts real directories named tmp/temp/scratchpad/mktemp `destructiveAllowlisted` exempts an `rm -rf` / `Remove-Item` whose resolved path From dd4d91de294f67d844204aeacb69eb20621f260b Mon Sep 17 00:00:00 2001 From: githubscum Date: Wed, 28 Oct 2026 00:35:08 -0500 Subject: [PATCH 2/2] Re-stamp the KNOWN-LIMITS pin after merging main Co-Authored-By: Claude Opus 5.5 --- KNOWN-LIMITS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/KNOWN-LIMITS.md b/KNOWN-LIMITS.md index f13afc4..a6225d2 100644 --- a/KNOWN-LIMITS.md +++ b/KNOWN-LIMITS.md @@ -2,7 +2,7 @@ This file describes commit 23a213afa39fb8f56d0783f0ba5ab24ad4323320 stamped 2026-10-28 subject: Land chain checkpoints and inclusion proofs (PR 89) at the 2026-10-27 signing sitting; limits 87-89 - body-sha256: f037bc54db74e50e3a9711b4549dea8f153686621f70b8b2d0020723699bea43 + body-sha256: 090de053f428016864bb906cac45674c9c31521a2db53ea867a7cdb9f2b19edd Re-stamp after updating this log: npm run limits-pin -- --stamp Divergent checkout? See: npm run limits-pin -- --check known-limits:pin end -->