THOTH-GQL-OPS-02: mutation-guard mode-control path on the production-applicable init command - #797
Conversation
…nit path
THOTH-GQL-OPS-02, closing capability gap 1 of THOTH-GQL-OPS-01.
The container's default command is `init`, which dispatches into the same
handler as `start graphql-api` but did not register the guard-mode argument.
Re-derived at the authorized base against pinned clap_builder 4.6.0, where
`ArgMatches::verify_arg` returns `UnknownArgument` only under
`cfg(debug_assertions)` and `MatchesError::unwrap` panics on `Err`: a release
build therefore resolved the `.unwrap_or("OFF")` fallback silently, a debug
build panicked, and the `value_parser` never ran so an invalid value was
silently accepted as OFF as well.
`init` now registers the same `arguments::mutation_guard_mode()` that
`start graphql-api` already used. That single registration restores all four
behaviours at once: the declared OFF default applies when the value is absent,
the THOTH_GRAPHQL_MUTATION_GUARD_MODE binding applies, the value parser
validates, and `verify_arg` succeeds so neither profile panics. No new
argument, no new environment variable, no parallel resolution path, and no
production container-command override -- an override would remove migration
execution from the deployment path and is out of bounded scope under CG-13.
This is NOT behaviour-neutral on the init path, and is not described as though
it were. Unset and OFF are unchanged (OFF). OBSERVE and ENFORCE intentionally
change from silently ignored/OFF to the supplied mode: such an invocation is
today silently not doing what it says. An invalid value intentionally changes
from a successful startup in OFF to a startup failure, aligning init with
start graphql-api and removing a silent-misconfiguration class.
Two behaviour-preserving extractions support the required tests.
`start::mutation_guard_mode(&ArgMatches)` makes the production accessor
callable, so the matrix asserts against the real resolution rather than a copy
that could drift. `commands::run_init(migrations, api)` makes the init sequence
callable with injected steps, so "migrations run first" and "a migration
failure aborts startup" are provable without a database or a bound socket;
it applies `?` to the migration step exactly as the previous inline sequence
did.
Every row of the compatibility matrix is pinned by its own test, and the module
runs under both profiles because the defect was profile-dependent. Further
tests pin that the argument is registered on init, its environment binding and
OFF default, the absence of a panic in whichever profile is running, that
`start graphql-api` is unchanged, that all eleven pre-existing init arguments
keep their name, environment binding and default, that store availability
remains derived only from ENFORCE, migration ordering and abort, and that the
new startup failure leaks no secret-bearing value. No existing test was
weakened.
The merged state stays inert and authorizes nothing: the default remains OFF,
no environment is transitioned, no mode is set anywhere, migration ordering and
failure behaviour are untouched, and the public GraphQL schema and generated
SDL are unchanged. CG-13 remains OPEN, the runtime-operations gate remains NOT
SATISFIED, and OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED.
…og entry Records the delivery of the mutation-guard mode-control path on the production-applicable `init` command, per PR #797. The report re-derives the defect at the authorized base rather than repeating the specification's narrative, quoting the pinned clap_builder 4.6.0 source that makes `verify_arg` reject an unregistered argument only under `cfg(debug_assertions)` -- confirmed, not refuted. It records the selected mechanism and why the alternatives were rejected, reproduces the binding production container-command override classification while confirming no override was made, specified or offered, and states the compatibility matrix per deployment class with the two intentional behaviour changes labelled intentional rather than described as no change. Exact commands and counts are recorded rather than a bare "tests pass": fmt, diff --check, workspace check and clippy all exit 0; 15/15 bin tests in the debug profile and 15/15 in the release profile, which is load-bearing because the defect was profile-dependent; 1163 passed and 8 pre-existing ignored across the workspace; and a manual matrix run against real release and debug binaries in a disposable environment, where every accepted value fails at PgConnection::establish inside run_migrations before the API starts, an invalid value exits 2 at parse time, and no row panics in either profile. The generated SDL is proven unchanged by building the base in a separate worktree and comparing bytes -- identical hash, identical size -- since the artefact is gitignored and build-generated, so `git status` would not be a valid check. AC-17 is recorded BLOCKED, with the section 2 container-command re-confirmation. The specification requires both external deployment facts to be re-confirmed at this task's own execution time and forbids inheriting them; neither a Route A sanitized metadata-only source nor Route B evidence from an authorized human operator or control owner was available, and no AI agent is a valid Route B source. The private authoritative deployment source was not read by any route, no secret-bearing production configuration was opened and no secret material was encountered. BLOCKED is the specification's required outcome rather than a widened read, and the residual deployment-facing risk it leaves open is stated plainly instead of being discharged by assumption. Also recorded as a known limitation, deliberately not fixed here: `thoth <cmd> --help` renders the values of env-bound arguments, including secret-bearing ones, because `main` loads `.env` before clap parses and clap prints `[env: NAME=value]`. It is pre-existing at the base, is neither introduced nor worsened by this task, and remedying it would change help output for arguments outside this task's boundary, which the non-goals forbid. No observed value appears in this repository, the report, the pull request or any commit. The merged state stays inert: CG-13 remains OPEN, the runtime-operations gate remains NOT SATISFIED, the mode-transition runbook remains PROVISIONAL, and OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED. THOTH-GQL-OPS-03 and THOTH-GQL-OPS-04 are not implemented and their branches do not exist. Lifecycle facts -- exact head, exact-head CI, review, authorization and merge -- are delegated to the pull request under ADR-0005 rather than transcribed.
Exact-head CI —
|
| Workflow | Conclusion | Jobs |
|---|---|---|
build-test-and-check |
success | classify, build, test, lint, format_check — all success |
run-migrations |
success | classify, run_migrations — both success |
check-changelog |
success | check-changelog success |
publish-to-dockerhub |
success | classify, build_and_push_staging_docker_image — both success |
Unlike the documentation-only PRs in this programme, nothing is skipped: this is a code change, so the classifier ran the full Rust gate. run_migrations passing is direct evidence that migration execution is unaffected, and the staging image build exercises the same cargo build --release path the production image uses.
Local gate at the same head, for completeness:
cargo fmt --all -- --check exit 0
git diff --check exit 0
cargo check --workspace exit 0
cargo clippy --all --all-targets --all-features -- -D warnings exit 0
cargo test --bin thoth 15 passed, 0 failed (debug)
cargo test --release --bin thoth 15 passed, 0 failed (release)
cargo test --workspace 1163 passed, 0 failed, 8 ignored
generated SDL byte-identical to the base
This comment is GitHub evidence only; it creates no repository commit. AC-17 remains BLOCKED — see the pull-request body. Fresh independent exact-head review and separate explicit CTO merge authorization remain required, and this comment is not an approval.
Evidence-only follow-up on PR #797. No Rust, runtime, deployment, infrastructure, migration, schema, guard-semantic or authorization change; the implementation diff is byte-for-byte identical to the previously reviewed head. AC-17 and the section 2 container-command re-confirmation were recorded BLOCKED because neither evidence route could supply them at implementation time. That is now stale. Authorized CTO/control-owner operator evidence, sanitized and non-secret, was supplied on 2026-08-11 through Route B: the current Production GraphQL API uses the standard service deployment template, supplies no container-command override and so inherits the image default `init`, and does not configure THOTH_GRAPHQL_MUTATION_GUARD_MODE; the current Test GraphQL API matches Production on both relevant facts. A sanitized comparison showing that another service on the same mechanism explicitly supplies its command makes the absence on the GraphQL service meaningful rather than merely unobserved. Both criteria are therefore PASS, and the compatibility assessment now records both current deployment classes as taking the unset -> OFF row. The evidence is attributed to Route B and to an authorized human operator. No Route A success is claimed, the private infrastructure source was not inspected to verify the operator evidence, and the coverage of "no environment" was checked rather than assumed: environments.md and the runtime-operations control record identify exactly two current GraphQL API environments, production and test, and the operator evidence covers both. No claim extends beyond them. AC-18 is reconciled honestly rather than left as a statement the lifecycle evidence no longer supports. During the independent review preceding this follow-up, a reviewer-side read path unexpectedly exposed secret material; the reviewer stopped that path immediately, did not continue into the target files, did not use or reproduce the material, and obtained neither OPS-02 external fact from it. That is recorded at the minimum safe level as a review-time control/process exception, with no secret value, location, credential content, resource identifier or derived infrastructure detail. The report separates implementation execution, which satisfies every limb of AC-18, from that review-time exception. Because the approved AC-18 wording binds every AI agent "of any role, family or session" and carries no temporal qualifier -- unlike AC-17, which is explicitly scoped to the task's own execution time -- the implementing agent does not self-certify it PASS, and equally does not narrow the wording, invent a waiver or amend the specification. It is recorded as BLOCKED - control-owner disposition required, with both possible readings set out so the decision is visible to the reviewer and the CTO. Control state is unchanged and restated: capability gap 1 CLOSED in-repository, CG-13 OPEN, runtime-operations gate NOT SATISFIED, runbook PROVISIONAL, OBSERVE, ENFORCE and BE-02 runtime NOT AUTHORIZED, THOTH-GQL-OPS-03 and THOTH-GQL-OPS-04 NOT IMPLEMENTED. The new evidence authorizes no runtime transition; making the mode settable is still not setting it.
Exact-head CI —
|
| Workflow | Run | Conclusion | Jobs |
|---|---|---|---|
build-test-and-check |
31472324001 | success | classify, build, test, lint, format_check — all success |
run-migrations |
31472323933 | success | classify, run_migrations — both success |
check-changelog |
31472323923 | success | check-changelog success |
publish-to-dockerhub |
31472323880 | success | classify, build_and_push_staging_docker_image — both success |
This follow-up changed one documentation file. The Rust implementation is byte-for-byte identical to the previously reviewed head 149a05ff…:
git diff --name-only 149a05ff..81acd4c7
-> docs/.../THOTH-GQL-OPS-02-implementation-report.md (only)
git diff --exit-code 149a05ff 81acd4c7 -- src/ CHANGELOG.md \
Cargo.toml Cargo.lock Dockerfile .github/
-> exit 0, no output
The full Rust gate nevertheless re-ran green at this exact head, so no CI evidence is inherited from 149a05ff….
This comment is GitHub evidence only; it creates no repository commit. AC-18 remains BLOCKED — control-owner disposition required (PR body and report §8.2.1). Fresh independent exact-head review and separate explicit CTO merge authorization remain required, and this comment is not an approval.
CTO / control-owner disposition — THOTH-GQL-OPS-02 AC-18I confirm that I instructed the control review to inspect the Thoth infrastructure deployment definitions in order to resolve the external deployment facts required by THOTH-GQL-OPS-02. During that operator-directed control review, the AI reviewer unexpectedly encountered secret material and stopped that read path immediately. No credential was used, no deployment or deployment workflow was performed or dispatched, no production configuration was changed, and no guard mode was changed. The protected source supplied neither of the OPS-02 acceptance facts; those facts were subsequently supplied by me separately as sanitized Route B operator evidence. As CTO / control owner, I classify that review-time incident as a control-review exception arising from my instruction, not as the AI agent acting as a deployment actor, credential user, or production-configuration evidence source for THOTH-GQL-OPS-02. AC-18 remains unchanged and fully binding. This disposition does not create a standing exception, waiver, or authorization for any AI agent to access secret-bearing production configuration in this task or any successor task. For THOTH-GQL-OPS-02 / PR #797, I therefore determine:
This disposition does not authorize merge, deployment, A fresh exact-head independent review and separate explicit CTO merge authorization remain required. |
Evidence-only follow-up on PR #797. No Rust, runtime, deployment, infrastructure, migration, schema, guard-semantic, specification or activation change; the implementation is byte-for-byte identical to 149a05f. The CTO/control owner has issued the explicit disposition that the previous revision of this report anticipated and deliberately left open. PR #797 comment 5251314845 determines AC-18: PASS for THOTH-GQL-OPS-02. The report now attributes that PASS to the control owner rather than self-certifying it, and records the stated basis without reinterpretation or broadening: the review inspection was instructed by the CTO/control owner; the reviewer unexpectedly encountered secret material and stopped the read path immediately; no credential was used; no deployment was performed or dispatched; no production configuration and no guard mode was changed; the protected source supplied neither OPS-02 acceptance fact; and the control owner classifies the incident as a control-review exception arising from their own instruction rather than the AI acting as a deployment actor, credential user or production-configuration evidence source. The disposition's bounds are recorded because they bind successors: AC-18 itself is unchanged and fully binding, the determination creates no standing exception, waiver or authorization for AI access to secret-bearing production configuration in this or any successor task, no further AI access to that source is authorized, and it authorizes neither merge nor any production or runtime transition. The review-time exception is not erased. It remains recorded at minimum safe level, is still classified as a control/process exception rather than Route A evidence, and the protected source is still recorded as having supplied no acceptance fact. No secret value, location, credential content, resource, account, stack or task-definition identifier, or derived infrastructure detail is recorded anywhere. Contradictory unqualified claims are corrected rather than left standing. Every operational-actor line in section 8.2 is now explicitly scoped to the implementing agent, so no lifecycle-wide "no secret-bearing configuration was read" claim survives to contradict the recorded exception. Route B remains the sole evidence route for the external deployment facts, and the protected source is nowhere credited with satisfying them. AC-17 and the section 2 container-command re-confirmation remain PASS on the sanitized operator evidence of 2026-08-11, with both current deployment classes on unset -> OFF. Acceptance criteria are now AC-1 to AC-18 PASS, with zero blocked: AC-17 by Route B operator evidence and AC-18 by control-owner disposition, neither by self-certification. The changelog entry for #797 is reconciled to match. Control state is unchanged: capability gap 1 CLOSED in-repository, CG-13 OPEN, runtime-operations gate NOT SATISFIED, runbook PROVISIONAL, OBSERVE, ENFORCE and BE-02 runtime NOT AUTHORIZED, THOTH-GQL-OPS-03 and THOTH-GQL-OPS-04 NOT IMPLEMENTED. Fresh independent exact-head review and separate explicit CTO merge authorization remain required.
Exact-head CI and acceptance evidence —
|
| Workflow | Run | Conclusion | Jobs |
|---|---|---|---|
build-test-and-check |
31478948796 | success | classify, build, test, lint, format_check — all success |
run-migrations |
31478948785 | success | classify, run_migrations — both success |
check-changelog |
31478948782 | success | check-changelog success |
publish-to-dockerhub |
31478948786 | success | classify, build_and_push_staging_docker_image — both success |
Acceptance criteria — AC-1 to AC-18
PASS 18
BLOCKED 0
AC-1 to AC-16 on repository and test evidence. AC-17 and the section 2 container-command re-confirmation on authorized Route B operator evidence supplied 2026-08-11 — Route B remains the sole evidence route for those facts, and the protected source is nowhere credited with satisfying them.
AC-18: PASS — provenance: explicit CTO/control-owner disposition, PR #797 comment 5251314845. Not self-certified by the implementing agent, which recorded BLOCKED — control-owner disposition required and left the decision to the control owner.
The review-time control/process exception remains recorded at minimum safe level and is not erased: it is still not Route A evidence, and the protected source still supplied no acceptance fact. AC-18 itself is unchanged and fully binding; the disposition creates no standing exception, waiver or authorization for AI access to secret-bearing production configuration in this or any successor task, and no further AI access is authorized. No secret value or sensitive infrastructure detail is recorded anywhere.
Every operational-actor NONE line in the report and PR body is now explicitly scoped to the implementing agent, so no unqualified lifecycle-wide claim survives to contradict the recorded exception.
Control state — unchanged
capability gap 1: CLOSED in-repository
CG-13: OPEN
runtime-operations gate: NOT SATISFIED
runbook: PROVISIONAL
OBSERVE: NOT AUTHORIZED
ENFORCE: NOT AUTHORIZED
BE-02 runtime: NOT AUTHORIZED
OPS-03 / OPS-04: NOT IMPLEMENTED, no branches
No deployment, workflow dispatch, credential use, production configuration change or mode transition occurred. PR remains DRAFT and UNMERGED.
This comment is evidence only. It is not approval and not merge authorization. A fresh independent exact-head review at c6406f36… and a separate explicit CTO merge authorization against that final head both remain required; the AC-18 disposition comment is neither.
ja573
left a comment
ja573
left a comment
There was a problem hiding this comment.
Independent exact-head review — THOTH-GQL-OPS-02
Decision: APPROVED
Reviewer: independent GPT-5.6 Sol review; not the implementing model.
Exact head reviewed: c6406f36eaa068797e490a1c11fb7cad26374069
Authorized base: e2a44c54bac49079e3ee18b65af3336838023417
Risk: HIGH
Evidence assessed
- Full base-to-head diff: exactly five paths — three CLI source files,
CHANGELOG.md, and the OPS-02 implementation report. No migration, schema/model, GraphQL, policy, Cargo, Dockerfile, workflow, or deployment-configuration changes. - Final reconciliation commit over
81acd4c7...: exactly two documentation files (CHANGELOG.mdand the implementation report); Rust implementation unchanged. - Implementation mechanism is bounded and correct:
initregisters the existingmutation_guard_mode()argument;mutation_guard_mode(&ArgMatches)preserves the existing accessor logic;run_initpreserves migration-first ordering and abort-on-migration-failure semantics. - Required debug/release compatibility matrix and regression tests are present; no existing test was weakened.
- Fresh exact-head CI is green: 10 PASS / 0 SKIPPED / 0 FAIL across runs
31478948796,31478948785,31478948782, and31478948786. - AC-17 and the section-2 container-command re-confirmation are PASS solely on authorized sanitized Route B operator evidence covering the current Production and Test GraphQL API deployments.
- AC-18 is PASS by explicit CTO/control-owner disposition in PR comment
5251314845, not by implementing-agent self-certification. The review-time control/process exception remains recorded at minimum safe level; it is not Route A evidence and creates no standing waiver or further AI-access authorization. - The previously contradictory lifecycle-wide
NONEstatements are now explicitly scoped to the implementing agent. - Acceptance state: AC-1 through AC-18 PASS; BLOCKED 0.
- CG-13 remains OPEN; runtime-operations gate remains NOT SATISFIED; runbook remains PROVISIONAL; OBSERVE, ENFORCE, and BE-02 runtime remain NOT AUTHORIZED; OPS-03/OPS-04 remain unimplemented.
Review decision
APPROVED for merge-control progression at this exact head.
This review is not CTO merge authorization and does not authorize deployment, a mode transition, OFF -> OBSERVE, OBSERVE -> ENFORCE, BE-02 runtime, or any Production action. Because the task is HIGH risk, a separate explicit CTO merge authorization against this exact head remains required. If the head moves, this approval is stale and a fresh independent review is required.
CTO merge authorization — THOTH-GQL-OPS-02I authorize the merge of PR #797 into This authorization is valid only while:
This is merge authorization only. It does not authorize deployment, CG-13 remains OPEN, the runtime-operations gate remains NOT SATISFIED, the runbook remains PROVISIONAL, and runtime activation remains separately controlled. |
Terminal merge evidence — THOTH-GQL-OPS-02PR #797 has been merged into The merge was performed with the exact-head guard and This terminal merge record does not authorize deployment, CG-13 remains OPEN; the runtime-operations gate remains NOT SATISFIED; the runbook remains PROVISIONAL; OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED. No deployment, configuration change or mode transition was invoked as part of this merge-control action. |
1 participant
THOTH-GQL-OPS-02 — Mutation-guard mode-control path
Implements the approved
THOTH-GQL-OPS-02specification, closing capability gap 1 ofTHOTH-GQL-OPS-01.This PR is DRAFT. It authorizes nothing, activates nothing, and performs no production action.
THOTH-GQL-OPS-02e2a44c54bac49079e3ee18b65af33368380234175245229651feature/shared-architecture/graphql-guard-mode-entrypointdevelopTerminal state
The defect, re-derived at the exact base
Not taken on trust from the specification — re-derived from the code and the pinned dependency:
DockerfilerunsCMD ["init"], builtcargo build --release;initdispatched into the same handler asstart graphql-api, which readsget_one::<String>("mutation-guard-mode").unwrap_or("OFF"), butinitdid not register the argument;clap_builder4.6.0,ArgMatches::verify_argreturnsErr(UnknownArgument)only undercfg(debug_assertions), andMatchesError::unwrappanics onErr.So a release build silently resolved the fallback
OFF, a debug build panicked, and thevalue_parsernever ran — an invalid value was silently accepted asOFFtoo. Confirmed, not refuted.Mechanism
Register the existing argument on the production-applicable command:
One registration fixes all four behaviours at once: the
value_parserruns, the declaredOFFdefault applies, theTHOTH_GRAPHQL_MUTATION_GUARD_MODEbinding applies, andverify_argsucceeds so neither profile panics. No new argument, no new environment variable, no parallel resolution path, no container-command override.Two behaviour-preserving extractions support the specification's required tests:
commands::start::mutation_guard_mode(&ArgMatches)— so tests assert against the production accessor, not a copy;commands::run_init(migrations, api)— so migrations run first and a migration failure aborts startup are provable without a database or a bound socket.Changed paths
0 migration, schema, model, GraphQL,
policy.rs,Cargo,Dockerfileor workflow files.Compatibility — NOT behaviour-neutral, and not described as though it were
THOTH_GRAPHQL_MUTATION_GUARD_MODEoninitOFFOFFOFFOFFOFFOBSERVEOFFOBSERVEENFORCEOFFENFORCEOFF, startup succeedsAn invocation already supplying
OBSERVE/ENFORCEis today silently not doing what it says; after this it does. An invalid value now fails startup, aligninginitwithstart graphql-apiand removing a silent-misconfiguration class.Migration preservation
initstill runsrun_migrations(arguments)?and only thenstart::graphql_api(arguments).run_initapplies?to the migration step exactly as the previous inline sequence did. Pinned by two tests:init_runs_migrations_before_starting_the_apianda_migration_failure_aborts_startup_and_the_api_never_starts, plus a manual run against an unreachable database.Test evidence
Every matrix row has its own test, and the module runs under both profiles.
Supporting tests pin: the argument is registered on
init(direct regression test for the exact defect); the env binding andOFFdefault; no panic in either profile;start graphql-apiunchanged; all 11 pre-existinginitarguments keep name, env binding and default;store_available()true only forEnforce; migration ordering and abort; and that the new startup failure leaks no secret-bearing value. No existing test was weakened.Generated SDL: proven unchanged. The artefact is gitignored and build-generated, so
git statusis not a valid check. The base was built in a separategit worktreeand the two compared byte-for-byte — identical hash1e08b46b…, 160799 bytes in both. Structurally it could not have differed:git diff --statbetween base and head overthoth-api/,thoth-client/,thoth-api-server/,thoth-errors/,thoth-export-server/,Cargo.tomlandCargo.lockis empty — the entire diff is three files undersrc/bin/.Known limitation, pre-existing and deliberately not fixed here
thoth <cmd> --helprenders the values of env-bound arguments —mainloads.envbefore parsing andclapprints[env: NAME=value]— so help output can printDATABASE_URL,PRIVATE_KEYandAWS_SECRET_ACCESS_KEY. Present at the base, neither introduced nor worsened by this task (the guard-mode variable is a non-secret enumerated value), and remedying it would change help output for arguments outside this task's boundary, which the non-goals forbid.Arg::hide_env_values(true)on the secret-bearing arguments is the bounded remedy, in its own separately specified task. No value observed during local manual verification appears in this repository, the report, this pull request or any commit.External evidence — Route B operator evidence, supplied 2026-08-11
The specification requires two external facts to be re-confirmed at this task's own execution time, and forbids inheriting them. Both were initially unobtainable and recorded
BLOCKED. Authorized CTO/control-owner operator evidence, sanitized and non-secret, has since supplied both.Production GraphQL API
initTHOTH_GRAPHQL_MUTATION_GUARD_MODEabsentTest GraphQL API
THOTH_GRAPHQL_MUTATION_GUARD_MODEabsentSanitized control comparison — another service on the same mechanism, the Export API, explicitly supplies its command (
start/export-api). Command overrides are therefore expressible, so their absence on the GraphQL service is meaningful, not merely unobserved.Both current deployment classes therefore take the compatibility matrix's
unset -> OFFrow after OPS-02. Coverage was checked, not assumed:environments.mdand the runtime-operations control record identify exactly two current Thoth GraphQL API environments — production and test — and the operator evidence covers both. No claim extends beyond them, and this is point-in-time evidence rather than a standing guarantee.No secret value was supplied as Route B evidence, and no infrastructure definition, resource identifier or configuration value has been copied into the repository or this PR. The implementing agent did not read the private deployment source and did not attempt to verify the operator evidence by opening protected configuration.
Review-time control/process exception
Recorded at the minimum safe level, because it must not be smoothed over:
No secret value, location, credential content, resource identifier or derived infrastructure detail is recorded anywhere in this PR.
AC-18 — PASS by explicit CTO/control-owner disposition
The approved AC-18 binds "No AI agent or model of any role, family or session — the implementing agent or any other" from, among other things, reading secret-bearing production configuration. It carries no temporal qualifier, unlike AC-17 which is explicitly scoped to "the task's own execution time".
The implementing agent therefore did not self-certify AC-18, and did not narrow the approved wording, invent a waiver, or amend the specification. It recorded
BLOCKED — control-owner disposition requiredand left the decision to the actor entitled to make it.The control owner has now made that decision.
The control owner's stated basis, recorded without reinterpretation: the review inspection was instructed by the CTO/control owner; the reviewer unexpectedly encountered secret material and stopped immediately; no credential was used; no deployment was performed or dispatched; no production configuration and no guard mode was changed; the protected source supplied neither OPS-02 acceptance fact; and the incident is classified as a control-review exception arising from that instruction, not the AI acting as a deployment actor, credential user or production-configuration evidence source.
Bounds of the disposition — these bind successors:
The review-time exception is not erased by the disposition: it remains recorded above, it is still not Route A evidence, and the protected source is still recorded as having supplied no acceptance fact.
No deployment, no activation
Each line is scoped to the implementing agent deliberately. An unqualified, lifecycle-wide
NONEwould contradict the control-review exception recorded above, and this PR does not make that claim.All testing was local and disposable. The default remains
OFFand the merged state stays inert: making the mode settable is not setting it.Boundaries held
CG-13 remains OPEN · runtime-operations gate remains NOT SATISFIED · runbook remains PROVISIONAL ·
OBSERVE,ENFORCEandBE-02runtime remain NOT AUTHORIZED ·THOTH-GQL-OPS-03andTHOTH-GQL-OPS-04are not implemented and their branches do not exist · PR #788 and issue #765 untouched · no credential remediation or rotation · public GraphQL schema and generated SDL unchanged.Merge controls
Not self-reviewed and not self-approved. Fresh independent exact-head review and separate explicit CTO merge authorization are both required and outstanding. Merge authorization is not production activation authorization:
OFF -> OBSERVEandOBSERVE -> ENFORCEeach still require their own explicit CTO approval underADR-0006§7.2.1.No acceptance criterion remains open: AC-1 to AC-18 are
PASS. AC-17 and the command re-confirmation rest on authorized Route B operator evidence; AC-18 rests on the explicit CTO/control-owner disposition in comment5251314845. Neither is self-certified. The AC-18 disposition is not merge authorization, and the review-time control exception remains on the record.