docs(adr): record isolation and signing posture decisions (amend 0013, 0019, 0027) #471

Merged

hexajon merged 1 commit from docs/adr-posture-decisions into main

2026-09-08 21:17:08 +00:00

hexajon commented

2026-09-08 21:17:06 +00:00

Owner

Summary

Record three cross-cutting posture decisions as dated ADR amendments, from the needs-decision triage. Decision records only; the implementation stays tracked on each issue.

ADR 0019 + 0027: a working directory the operator adds at runtime (roots/list_changed) is in-scope for reads and writes to its own origin. The agent cannot add a root, so this is an operator-authorized grant, not agent self-widening. Refs #416.
ADR 0019: the forge-API write path (owner_repo= with no local clone) inherits the immutability rule via a non-overridable, forge-state-keyed tool-layer guard - allow empty, refuse populated - with no agent-flippable confirm. Refs #418.
ADR 0013: madtea never custodies a commit signing key; git delegates to the OS/agent/hardware, and the signing guard gates on the repo's actual require_signed_commits. Refs #424.

Index rows updated to point at the amendments. No code change; behavior and reference-doc updates land with each implementation.

## Summary Record three cross-cutting posture decisions as dated ADR amendments, from the needs-decision triage. Decision records only; the implementation stays tracked on each issue. - ADR 0019 + 0027: a working directory the operator adds at runtime (roots/list_changed) is in-scope for reads and writes to its own origin. The agent cannot add a root, so this is an operator-authorized grant, not agent self-widening. Refs #416. - ADR 0019: the forge-API write path (owner_repo= with no local clone) inherits the immutability rule via a non-overridable, forge-state-keyed tool-layer guard - allow empty, refuse populated - with no agent-flippable confirm. Refs #418. - ADR 0013: madtea never custodies a commit signing key; git delegates to the OS/agent/hardware, and the signing guard gates on the repo's actual require_signed_commits. Refs #424. Index rows updated to point at the amendments. No code change; behavior and reference-doc updates land with each implementation.

hexajon added 1 commit

2026-09-08 21:17:06 +00:00

docs(adr): record isolation and signing posture decisions (amend 0013, 0019, 0027)

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in -2s

Details

ci / gate (push) Successful in 22m39s

Details

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 1m8s