operational-rigor + skill-vetting: trust-grant breadth — judge the effective grant expansion, never the syntax

[F-e-u-e-r]

Summary

One new canonical rule in operational-rigor §2 — trust-grant breadth: a trust or allow rule is judged by its effective grant expansion, never its syntax — placed between the instruction-files install-gate block and the activation-gated-payload rule, plus a bare-pointer mirror (Over-broad trust grant) in skill-vetting §2, plus the evidence package. Two canonical files, pure additions; 9 evidence files. Commit 0f2e344 on main-tip 5824f30.

Invariant (headline): the effective granted capability set must stay within what was actually vetted, or what an independent trusted policy explicitly authorizes as a class.

Why (adjudicated PARTIAL-GAP)

Existing doctrine catches config WRITES (config self-propagation), authorization RHETORIC (authorization-default flip), and tool REGISTRATION (MCP rule) — but no rule evaluated whether a persistent trust/allow/approval entry's EFFECTIVE GRANT SET exceeds the actually-vetted set, and a candidate that merely instructs the human to paste a broad grant intercepted nothing. External threat evidence is cited as shape (ATR-2026-02192; AWS Kiro AWS-2025-019), not first-hand reproduced.

The rule (owner-locked semantics)

• Judged by effective grant expansion, never wildcard syntax — wildcards, prefixes, globs, inherited namespaces, future-name patterns are examples, not the criterion.
• A pattern that can match beyond the vetted set is a finding; the candidate's own disclosure never launders it, and a human pasting the entry on the candidate's instructions is not independent authorization — human-entered broad grants stay findings.
• Independent-policy carve-out: an independent trusted owner/project policy CAN authorize the broader capability class — the verdict then says authorized-as-a-class by that policy, never that the broader members were individually vetted.
• Bounded globs clear; a deny/block pattern is no authority expansion; a precise single-capability grant is the clearing shape; undeterminable expansion fails closed, with no exhaustive future-name enumeration burden.
• The mirror is routing + interaction only: it owns no criterion copy, no clearers, no fail-closed wording, and no marker; it names the distinct-but-co-firing siblings (config self-propagation / authorization-default flip / MCP auto-registration).

Review

Design gate, two rounds, dual-blind (mutually blind, isolated dirs; identity from tool banners in all four runs: gpt-5.6-luna / gpt-5.6-sol, reasoning effort max). r1 = luna FIX-1 + sol FIX-2: convergent finding — the mirror restated the operative criterion and clearance fragments (an incomplete second authority) — plus sol's headline finding ("silently" wrongly implied disclosure could matter; the independently-authorized limb was missing). Both reproduced first-hand and fixed. r2 = 2/2 PROCEED, zero findings, all ten mandatory axes line-anchored by both reviewers (canonical/mirror separation and the authorized-as-a-class verdict language explicitly confirmed by both).

Landing fidelity

Landed blocks byte-identical to the r2-reviewed fenced blocks (machine-proven: each block exactly once; full diff pure additions; per-file added-line multisets equal exactly the reviewed blocks plus the owner-settled Provenance entry). DECLARED-LANDING-ADAPTATIONS: provenance entry + placement only — the single inline unprobed marker was already inside the r2-reviewed bytes. Neighbors byte-unchanged (instruction-files bullet, activation-gated-payload rule, skill-vetting's config-self-propagation / authorization-default-flip / MCP bullets, self-vouching + activation pointer). Static discrimination controls 9/9 (W1–W8 + W2b; W2b proves the carve-out records class authorization, never individual vetting). checks.py green, invisible-Unicode sweep included. Details in reviews/2026-08-30-trust-grant-breadth/FINAL-WORDING-RECONSTRUCTION.md.

Dup-check (orientation, owner-ratified PARTIAL-GAP; r2 reviewers confirmed axes 1 and 5): the adjacent homes — operational-rigor §2's install-gate family and skill-vetting §2's config-self-propagation / authorization-default-flip / MCP-auto-registration checks — each catch the write, the claimed authority, or the registration act; none evaluates effective grant breadth. Not found under those reads; orthogonality and gap closure reviewer-confirmed.

Probe debt

Behavioral transmission/effectiveness remains unprobed. Exactly one new unprobed marker (canonical rule only; the mirror carries none); the future behavioral probe joins the standing #115 queue.

The three locked sibling candidates (compiled-bytecode/decoy-source divergence; visible homoglyph deception; approval-fatigue reviewer-targeting) remain LOCKED — zero of their content here.

🤖 Generated with Claude Code

https://claude.ai/code/session_0132RthrKSsMkywcEwtkXhkx