---
name: access-control-grill-2026-07
description: "2026-07-28/29 grill of releases#7-15 — shared-subnet threat model, two-key subnet, engine-room, wax seals, IO parser, now-signal; milestones A→B→C→D cut; PR #118 carries glossary+ADRs"
metadata: 
  node_type: memory
  type: project
  originSessionId: a201d152-890f-4c0c-9d52-127120816a5e
  modified: 2026-07-29T09:03:32.185Z
---

# Access-control grill (2026-07-28/29) — requests 7–15 RESOLVED

**Deliverables:** CONTEXT.md glossary entries + ADR-0051/0052/0053 on **spt-bs-core PR #118** (docs-only, thin lane, open). Rulings mirrored as comments on releases#7–#15; deferred now-signal categories minted as **releases#16 (PROJECTS)** + **#17 (FILE_ACCESS_HELPER)**.

## Alchemy board (formal process, 2026-07-29 — see [[alchemy-formal-milestone-process]])
Milestones minted as kind:MILESTONE issues + native sub-issue links + native dependency chain (#21 blocked-by #20, #22 by #21, #23 by #22):
- **#20 ACCESS-CONTROL** ← #15, #9, #10, #13 (monic store; surfacing in D per split ruling)
- **#21 WAX-SEAL** ← #7, #8, **#19** (new: Esc cancel at TOTP ceremony)
- **#22 IO-PARSER** ← #12 (also carries `;;text;;` seal-mint shortform)
- **#23 NOW-SIGNAL** ← #11, #14, #16, #17, **#18** (new: SEAL_BRIEF ≤2-sentence agent education payload)
NEEDS-OPERATOR flags cleared on #7–#15 (the grill = the operator discussion). States left BACKLOG — greenlit is milestone-level, operator's call.

## Milestone cut (ratified, order A→B→C→D)
- **A ACCESS-CONTROL** (soonest): two-key subnet, engine-room+empower, open/closed modes + resolution chain, CONSTANT_CASE surface vocab (v1 = existing 6 gate families + RC split + DISCOVER), knocking+knock-codes, trust warning, **monic STORE** (data model + delivery-edge triggers — trust-warning dependency), fail-closed flip (ADR-0053). **TLA+ spec rides A** (spec-pilot rig; needs java-on-kitsubito unblock).
- **B WAX-SEAL**: artifact + TOTP/FIDO2 ceremonies + subnet-scoped replication + sealed-message attr carriage. Minter-endpoint UX = downstream shell, NOT core.
- **C IO-PARSER**: state-edge payloads (busy=prompt, idle=end-of-turn), hybrid mid-turn via adapter digest, MSG_IN/OUT, shell-link IO frames, core-side `@<…@>` shortform (default-on, manifest opt-out), **`;;text;;` seal-mint shortform** (agent- or user-authored).
- **D NOW-SIGNAL**: funnel subsuming api hint; delta-only; v1 = HINTS, ENDPOINT_MENTIONS(+shared-subnets, =#14), MONICS surfacing, SHELLS (deprecates session-start spt-shells msg), LAST_MSGS, EDGE_TRANSITIONS.

## Load-bearing rulings (details in CONTEXT.md + ADRs)
- **Shared subnet**: nodes of different operators; humans trust each other; **adversary = agents**. "User" NEVER an identity — node = human-proxy. user-msg posture survives (node-level trust intact); per-(subnet,user) seam superseded.
- **Subject chain**: sender-endpoint → node → subnet-wildcard (per-endpoint) → per-node node/subnet entries → endpoint/node/captured-subnet modes. Reply exemption precedes.
- **Two-key subnet** (ADR-0051): member + admin TOTP seeds; both held everywhere, admin revealable NOWHERE (shown once at create; irrecoverable by design).
- **Engine-room** (ADR-0052): one per node, locked-down agent endpoint, TOTP bring-up (no elevation), local `rc --take` allowed (restarts+revokes), purge=elevated reset. `empower <subnet> --admin-code` = session-lifetime subnet-mode authority. Mode spread = advisory gossip + ER-only refresh verb.
- **Fail-closed** (ADR-0053): corrupt/missing access store degrades CLOSED always.
- **Trust warning**: closed ∧ passed-gate ∧ **no monic** (whitelist entry ≠ classified); knocker-monic fallback. Monics = **mind substrate** (replicate with agent).
- **Wax seal**: ONE system (7+8); content-hash-bound token; FIDO2 seam (Hello/libfido2, enrollment TOTP-gated, `E` enroll-and-submit at overlay); client-side ceremony over rc for remote controllers.

## Open tails
- ✅ PR #118 MERGED @ffc7e9e (CI green 2026-07-29; glossary + ADR-0051/52/53 on main).
- ⚠ main run @ffc7e9e RED (run 30436637478): `zombie_claim_refuses_never_attaches` (Win/hfenduleam, rc_attach_truth.rs:422) + `activity_frames_reach_a_linked_shell_through_the_real_daemon` (Linux/kitsubito, activity_link_push_e2e.rs:215, 30s timeout-shaped). Diff was DOCS-ONLY (suite-inert — cannot be causal) and pre-merge CI green at same tree. At-sha rerun dispatched per main-baseline procedure. 📌 WATCH both names: 2nd sighting anywhere ⇒ file as defect (hertz if test-side, todlando if product); note v0.45.0 note's open seam-red on #106 wake single-flight — check overlap if activity_link red repeats.
- Milestone A triage → waves + REQ minting = next gater action when operator calls the milestone.
- java-on-kitsubito unblock needed before A's TLA+ leg.