CR-133: Settle revoked-identity health semantics (proposal only) - #177
Merged
Conversation
Record an unsettled lifecycle-semantics question found during a read-only comparison of the archived wip/identity-doctor branch against main: a cleanly revoked identity is accepted by `tc identity check` and reported as erroneous by `tc identity doctor`, with no test establishing whether that is intentional. Evidence is anchored to symbol names at main@770d9f2, with line numbers given only as a reading convenience for that revision. Proposal only. No implementation authority is requested or granted, and no regression behavior is pinned until the semantic question is settled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Deploy Preview for poetic-quokka-0fd859 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…nal state Human design decision of 2026-08-14 selects option (a): a correctly revoked identity is a valid terminal lifecycle state — healthy as revoked, but intentionally not operationally usable or capability-ready. Rotation-specific invariants do not automatically apply to revocation, and private-key disposition on revocation remains a separate unresolved question. Records the controlling invariant LifecycleHealthy != OperationallyUsable, and notes that a future change must make that distinction explicit rather than let it emerge from the ACTIVE_STATUS filter and the generic non-active-history loop. Lifecycle-only update. Implementation authority remains withheld; merge, release, and closeout authority are not granted. The four deferred doctor-level regression tests remain unauthorized. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…straints Records the read-only census conducted against main@770d9f2: a four-file allowlist (agent_identity.py, tc_cli.py, tests/test_doctor_cli.py, docs/security/identity_rotation_recovery_policy.md), the surfaces that are already correct and excluded, and the required regression set. Records the post-change-state trap: today's non-zero exit for `tc identity doctor --agent-id <revoked> --for-capability X` is produced solely by the no_active_key health error. A change confined to check_health() would make that invocation exit 0 with no capability error and no capability_ready line, reporting success for an identity the accepted semantics say is not capability-ready. Hence tc_cli.py is necessary, not conditional, and the existing missing_requested_capability code must not be reused. Records the acceptance constraint that CR-133 must not change COMPROMISED_STATUS health semantics, naming both violating vectors, including the case where suppression keyed on "no active identity" rather than "terminal revoked" changes compromised behavior without touching the historical loop. Lifecycle-only update. Implementation authority remains withheld; naming the allowlist bounds a future slice rather than enabling one. Merge, release, and closeout authority are not granted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…nd exhausted The CR text still read "Implementation authority: Still withheld", which no longer matched the governance state: a bounded single-slice grant was made by the human operator on 2026-08-14 and exercised as PR #178. The durable record had not caught up with the decision. Records the grant verbatim as its own section -- four-file allowlist, the shared terminal-revoked helper explicitly in scope, the narrowly bounded predicate, the permitted changes, and the preserved constraints -- then notes that the grant is exhausted now that the reviewable candidate exists, and that implementation acceptance was reviewed and withheld pending two evidence repairs. Also repoints statements the grant would otherwise contradict: Scope, Human Approval Requirement, Required Regression Set, Explicit Exclusions, Deferred Work, and Stop Point, which now stops a fourth time before acceptance rather than a third time before implementation. The deferred archived-design coverage gaps are stated as still outside the grant. Recorded on the CR branch rather than folded into PR #178, and without rewriting a5ed999. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…bb36d4 Implementation acceptance was granted by the human operator on 2026-08-14, following implementation-design review, code review, and two evidence repairs (the authority record at f952e26, the exit-code pins at bbb36d4). Acceptance attaches to that specific revision and settles correctness, not landing. Repoints the passages the grant makes stale: the acceptance withholding is restated as first-review history with its resolution, and the Stop Point now stops a fifth time before merge authority rather than a fourth time before acceptance. Records the recommended merge ordering -- #177 first, then #178 -- with its rationale. The two PRs have no file overlap, so nothing forces that order, which is why it is written down: landing the authority and acceptance record before the runtime change it authorized gives repository history the same causal order as the governance process. Merge, release, and closeout authority remain ungranted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
A proposal-only CR. It adds exactly one file —
docs/change/requests/CR-133-revoked-identity-health-semantics.md— and changes no code, tests, backlog, or change log.The observation
A cleanly revoked agent identity is accepted by
tc identity checkand simultaneously reported as erroneous bytc identity doctor. No test establishes whether that difference is intentional.Verified read-only against
main@770d9f2:tests/test_doctor_cli.pycontains no revoked-identity case, so nothing in the suite observes the divergence.What this CR deliberately does not do
checkmay legitimately mean structural consistency whiledoctorapplies a stronger operational-health standard. The requirement is only that an apparent contradiction follow an explicit documented distinction rather than emerge from implementation mechanics.agent_identity.py,tc_cli.py, identity tests, or lifecycle behavior.Evidence anchoring
Observations are anchored to symbol names plus
main@770d9f2, with line numbers given only as a reading convenience for that revision, so the citations survive later refactors.Provenance
Findings were extracted from a read-only comparison against the archived
wip/identity-doctorbranch, which is preserved unmodified as evidence. This branch is cut frommainand deliberately does not inherit that branch's history — the archived implementation is superseded and is not proposed as a patch. Its passing-revocation test is recorded as historical design evidence, not current authority.Requested review
Human review of the semantic question only. The next governed step is a decision selecting (a), (b), or (c) — or rejecting the framing.
🤖 Generated with Claude Code