pdurlej/platform

Fork 0

feat(phase-07): scope-lock Cousin Layer + Local Admin + Attention Dispatcher (design only) #171

Closed

claude wants to merge 1 commit from claude-orchestrator/phase-07-scope-lock into main

claude commented

2026-05-11 02:10:47 +02:00

Collaborator

What

Locks Phase 07 scope per GPT-5.5 Pro oracle review §TOP 5 DECISIONS #5: "Lock Phase 07 scope: cousin layer, local admin boundary, Obsidian janitor dry-run, OpenClaw bounded auto-healer, Hermes artifact pipeline, attention dispatcher. Nothing more."

Specification only. No module.yaml under modules/. No runtime services. No systemd units. Phase 07 implementation tickets follow Phase 06 prune + L-1.5 close.

Phase 07 in-scope items (per ADR-0012)

#	Concept	Where it lives (this PR)	Future implementation home
A	Cousin role taxonomy	ADR-0006 (PR #168)	(governance fold; no module)
B	Durable job bundle	ADR-0008 (PR #169)	(governance fold; no module)
C	Local-admin LLM tier	ADR-0010 + `docs/phase-07/local-admin-design.md`	`modules/m1/local-admin-tier/`
D	Obsidian vault janitor	`docs/phase-07/obsidian-janitor-design.md`	`modules/m1/obsidian-janitor/`
E	Auto-healer OpenClaw	ADR-0011 + `docs/phase-07/auto-healer-openclaw-design.md`	`modules/vps1000/auto-healer-openclaw/`
F	Attention dispatcher	`docs/phase-07/attention-dispatcher-design.md`	`modules/rs2000/ops-attention-dispatcher/`
G	Hermes voice-pitch + bundle	separate PR (`docs/hermes/_templates/`)	optional `modules/rs2000/hermes-brief-renderer/`

What this PR DOES NOT do (per ADR-0012 §Out of Phase 07)

REJECTED or DEFERRED:

Multi-instance Iskra (Phase 08+)
Auto-rotation of secrets (post-30-day freeze)
Matrix-as-primary chat (rejected; Signal-Iskra canonical)
Public Hermes pitches (Phase 08+)
Iskra promoted to Forgejo write (separate ADR if needed)
Universal MCP server for local-admin (post-30-day freeze)
Auto-merge auto-healer Lane 2 PRs (rejected; violates 3+3 review)

Files (10)

File	Purpose
`decisions/0010-local-admin-llm-boundary.md`	30-day read-mostly capability freeze; plan-only; dry-run-first; no MCP
`decisions/0011-auto-healer-openclaw-boundaries.md`	Three-lane model (Observe/Propose/Bounded repair); Lane 3 = 2 pre-authorized ops
`decisions/0012-phase-07-scope-lock.md`	Scope enumeration + out-of-scope rejection + implementation precondition
`docs/phase-07/scope.md`	1-page operator-facing summary
`docs/phase-07/attention-dispatcher-design.md`	Substrate; P0/P1/P2 severity; ping window Mon-Fri 9-17
`docs/phase-07/local-admin-design.md`	gemma-3 architecture; capability flow; vault sensitivity enforcement
`docs/phase-07/obsidian-janitor-design.md`	Dry-run batch hygiene; hard_private folder denylist; KOS2 reuse
`docs/phase-07/auto-healer-openclaw-design.md`	Three-lane detail + FLEX-repo promotion criteria
`ops/local-admin/capabilities.yaml`	DRAFT: 13 allowed read./plan.; execute./mutate. denied; sensitivity tier mapping
`ops/auto-healer/authorized-repairs.yaml`	DRAFT: 2 Lane 3 entries (gateway restart, runtime rollback); sacred_services denied; max severity P1

3 ADRs, 5 design docs, 2 capability YAML drafts. +~2000 LoC of design.

Key design decisions in capability YAMLs

Local-admin (ops/local-admin/capabilities.yaml):

read_only: true (lifting is per-capability via PR)
13 allowed capabilities (read.* + plan.*)
All execute.* and mutate.* denied
read.vault.read_note WHERE sensitivity:hard_private explicitly denied
Vault sensitivity tier mapping (Journal/, Finance/, Family/, Health/ → hard_private)
Plan validation: no secret values in prompts, no vault content in plans

Auto-healer (ops/auto-healer/authorized-repairs.yaml):

Lane 3 = exactly 2 operations: openclaw-gateway-restart + openclaw-runtime-rollback
Both require preconditions + cooldown (24h between restarts; one rollback per incident)
globally_forbidden: secret_rotation, schema_migration, mail_filter_change, credential_change, ssh_key_change, db_data_mutation, docker_image_replace, configuration_file_edit
sacred_services (never restartable via Lane 3): synapse, postgres, postgres-honcho, traefik
max_severity: P1 (P0 forbidden for auto-healer)
rate_limit_per_day: 5

Implementation precondition (per ADR-0012)

Phase 07 implementation MAY NOT begin until ALL of:

Phase 06 prune completes
L-1.5 sign-off (per ADR-0009 bounded spot-check)
ADRs 0010, 0011, 0012 are Accepted
Design docs + capability YAMLs exist (this PR delivers them)

Until then: specification only.

Sequencing within Phase 07

implement F (attention-dispatcher; substrate)
   ↓
implement C (local-admin tier; uses F)
   ↓
implement D (vault janitor; uses F + C)
   ↓
implement E (auto-healer; uses F)

G (Hermes) parallel-track, can ship in any order.

Max 1 new module/week. Each new module's first 30 days: read-mostly / dry-run / observe-only.

Acceptance criteria

3 ADRs exist with Status: Proposed.
5 design docs under docs/phase-07/ exist.
2 capability YAML drafts under ops/ exist; both parse as valid YAML.
No module.yaml files added (verified by git diff --stat; no path matching modules/).
No runtime path touched.
3+3 canary fires on risk/process (touches decisions/ extensively).
Operator approves; 3 ADRs flip to Accepted.

Rollback

git revert <merge-commit>
git push origin main

This PR is purely additive (10 new files, 0 modified files except possibly modules/INDEX.yaml which it does NOT touch). Reverting deletes the 10 files. Safe.

Refs

GPT-5.5 Pro oracle review 2026-05-11: §3 PHASE SEQUENCING, §5 RISKS, §6 LOCAL LLM, §7 WAKE-UP, §TOP 5 DECISIONS #3 + #5
Companion PRs: #168 (governance fold), #169 (job bundle foundation), #170 (Phase 01 closure)
ADR-0006, ADR-0008, ADR-0009 (foundation)
Issue #27 in pdurlej/iskra-openclaw (auto-healer concept)
operator's KOS2 prior art

Codex effort needed

Review + merge. No runtime change, no executable code. After merge, Phase 07 SCOPE IS LOCKED until ADR-0012 amendment PR opens.

Role: orchestrator / drafter (claude)
Lane: governance / Phase 07 scope-lock
Next: operator review + 3+3 canary + merge → unblock Phase 07 implementation tickets (which still wait for Phase 06 prune).

## What Locks Phase 07 scope per GPT-5.5 Pro oracle review §TOP 5 DECISIONS #5: *"Lock Phase 07 scope: cousin layer, local admin boundary, Obsidian janitor dry-run, OpenClaw bounded auto-healer, Hermes artifact pipeline, attention dispatcher. **Nothing more.**"* **Specification only.** No module.yaml under modules/. No runtime services. No systemd units. Phase 07 implementation tickets follow Phase 06 prune + L-1.5 close. ## Phase 07 in-scope items (per ADR-0012) | # | Concept | Where it lives (this PR) | Future implementation home | |---|---------|--------------------------|----------------------------| | **A** | Cousin role taxonomy | ADR-0006 (PR #168) | (governance fold; no module) | | **B** | Durable job bundle | ADR-0008 (PR #169) | (governance fold; no module) | | **C** | Local-admin LLM tier | ADR-0010 + `docs/phase-07/local-admin-design.md` | `modules/m1/local-admin-tier/` | | **D** | Obsidian vault janitor | `docs/phase-07/obsidian-janitor-design.md` | `modules/m1/obsidian-janitor/` | | **E** | Auto-healer OpenClaw | ADR-0011 + `docs/phase-07/auto-healer-openclaw-design.md` | `modules/vps1000/auto-healer-openclaw/` | | **F** | Attention dispatcher | `docs/phase-07/attention-dispatcher-design.md` | `modules/rs2000/ops-attention-dispatcher/` | | **G** | Hermes voice-pitch + bundle | separate PR (`docs/hermes/_templates/`) | optional `modules/rs2000/hermes-brief-renderer/` | ## What this PR DOES NOT do (per ADR-0012 §Out of Phase 07) REJECTED or DEFERRED: - Multi-instance Iskra (Phase 08+) - Auto-rotation of secrets (post-30-day freeze) - Matrix-as-primary chat (rejected; Signal-Iskra canonical) - Public Hermes pitches (Phase 08+) - Iskra promoted to Forgejo write (separate ADR if needed) - Universal MCP server for local-admin (post-30-day freeze) - Auto-merge auto-healer Lane 2 PRs (rejected; violates 3+3 review) ## Files (10) | File | Purpose | |------|---------| | `decisions/0010-local-admin-llm-boundary.md` | 30-day read-mostly capability freeze; plan-only; dry-run-first; no MCP | | `decisions/0011-auto-healer-openclaw-boundaries.md` | Three-lane model (Observe/Propose/Bounded repair); Lane 3 = 2 pre-authorized ops | | `decisions/0012-phase-07-scope-lock.md` | Scope enumeration + out-of-scope rejection + implementation precondition | | `docs/phase-07/scope.md` | 1-page operator-facing summary | | `docs/phase-07/attention-dispatcher-design.md` | Substrate; P0/P1/P2 severity; ping window Mon-Fri 9-17 | | `docs/phase-07/local-admin-design.md` | gemma-3 architecture; capability flow; vault sensitivity enforcement | | `docs/phase-07/obsidian-janitor-design.md` | Dry-run batch hygiene; hard_private folder denylist; KOS2 reuse | | `docs/phase-07/auto-healer-openclaw-design.md` | Three-lane detail + FLEX-repo promotion criteria | | `ops/local-admin/capabilities.yaml` | DRAFT: 13 allowed read.*/plan.*; execute.*/mutate.* denied; sensitivity tier mapping | | `ops/auto-healer/authorized-repairs.yaml` | DRAFT: 2 Lane 3 entries (gateway restart, runtime rollback); sacred_services denied; max severity P1 | 3 ADRs, 5 design docs, 2 capability YAML drafts. +~2000 LoC of design. ## Key design decisions in capability YAMLs **Local-admin (`ops/local-admin/capabilities.yaml`)**: - `read_only: true` (lifting is per-capability via PR) - 13 allowed capabilities (read.* + plan.*) - All `execute.*` and `mutate.*` denied - `read.vault.read_note WHERE sensitivity:hard_private` explicitly denied - Vault sensitivity tier mapping (Journal/, Finance/, Family/, Health/ → hard_private) - Plan validation: no secret values in prompts, no vault content in plans **Auto-healer (`ops/auto-healer/authorized-repairs.yaml`)**: - Lane 3 = exactly 2 operations: openclaw-gateway-restart + openclaw-runtime-rollback - Both require preconditions + cooldown (24h between restarts; one rollback per incident) - `globally_forbidden`: secret_rotation, schema_migration, mail_filter_change, credential_change, ssh_key_change, db_data_mutation, docker_image_replace, configuration_file_edit - `sacred_services` (never restartable via Lane 3): synapse, postgres, postgres-honcho, traefik - `max_severity: P1` (P0 forbidden for auto-healer) - `rate_limit_per_day: 5` ## Implementation precondition (per ADR-0012) Phase 07 implementation MAY NOT begin until ALL of: 1. Phase 06 prune completes 2. L-1.5 sign-off (per ADR-0009 bounded spot-check) 3. ADRs 0010, 0011, 0012 are Accepted 4. Design docs + capability YAMLs exist (this PR delivers them) Until then: specification only. ## Sequencing within Phase 07 ``` implement F (attention-dispatcher; substrate) ↓ implement C (local-admin tier; uses F) ↓ implement D (vault janitor; uses F + C) ↓ implement E (auto-healer; uses F) ``` G (Hermes) parallel-track, can ship in any order. Max 1 new module/week. Each new module's first 30 days: read-mostly / dry-run / observe-only. ## Acceptance criteria - [x] 3 ADRs exist with Status: Proposed. - [x] 5 design docs under `docs/phase-07/` exist. - [x] 2 capability YAML drafts under `ops/` exist; both parse as valid YAML. - [x] No `module.yaml` files added (verified by `git diff --stat`; no path matching `modules/`). - [x] No runtime path touched. - [ ] 3+3 canary fires on `risk/process` (touches `decisions/` extensively). - [ ] Operator approves; 3 ADRs flip to `Accepted`. ## Rollback ``` git revert <merge-commit> git push origin main ``` This PR is purely additive (10 new files, 0 modified files except possibly `modules/INDEX.yaml` which it does NOT touch). Reverting deletes the 10 files. Safe. ## Refs - GPT-5.5 Pro oracle review 2026-05-11: §3 PHASE SEQUENCING, §5 RISKS, §6 LOCAL LLM, §7 WAKE-UP, §TOP 5 DECISIONS #3 + #5 - Companion PRs: #168 (governance fold), #169 (job bundle foundation), #170 (Phase 01 closure) - ADR-0006, ADR-0008, ADR-0009 (foundation) - Issue #27 in pdurlej/iskra-openclaw (auto-healer concept) - operator's KOS2 prior art ## Codex effort needed **Review + merge.** No runtime change, no executable code. After merge, Phase 07 SCOPE IS LOCKED until ADR-0012 amendment PR opens. --- **Role:** orchestrator / drafter (claude) **Lane:** governance / Phase 07 scope-lock **Next:** operator review + 3+3 canary + merge → unblock Phase 07 implementation tickets (which still wait for Phase 06 prune).

claude added 1 commit

2026-05-11 02:10:47 +02:00

feat(phase-07): scope-lock for Cousin Layer + Local Admin + Attention Dispatcher (design docs only)

canary-required / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 12s

Details

8023c5d87c

Locks Phase 07 scope per GPT-5.5 Pro oracle review §TOP 5 DECISIONS #5:
"Lock Phase 07 scope: cousin layer, local admin boundary, Obsidian janitor
dry-run, OpenClaw bounded auto-healer, Hermes artifact pipeline, attention
dispatcher. Nothing more."

What ships (design specification only; no runtime modules)

3 ADRs:
- decisions/0010-local-admin-llm-boundary.md: 30-day read-mostly capability
  freeze for local-admin LLM tier (gemma-3 on M1). Plan-emission only;
  operator-gated execute; dry-run-first; no MCP exposure during freeze.
- decisions/0011-auto-healer-openclaw-boundaries.md: three-lane model
  (Observe / Propose / Bounded repair) for auto-healer per Issue #27.
  Lane 3 limited to two pre-authorized operations (gateway restart,
  runtime rollback); sacred services denied.
- decisions/0012-phase-07-scope-lock.md: enumerates the 6 in-scope items
  (cousin taxonomy / job bundle / local-admin / vault janitor / auto-healer
  / attention dispatcher) plus parallel-track Hermes pipeline; explicitly
  rejects multi-Iskra, auto-rotation, Matrix-as-primary, public pitches,
  Iskra-write-to-Forgejo, universal MCP, auto-merge.

5 design docs under docs/phase-07/:
- scope.md: 1-page operator-facing summary
- attention-dispatcher-design.md: substrate (implement first); polls job
  bundles + Forgejo events; routes by P0/P1/P2 severity; respects
  ping_window (Mon-Fri 9-17 default); Matrix iskra-main + Element mobile
- local-admin-design.md: gemma-3 architecture; capability flow; KOS2
  reuse philosophy (preview-first); vault sensitivity tier enforcement
- obsidian-janitor-design.md: dry-run batch hygiene; daily + weekly
  cron; hard_private folder denylist; KOS2-lessons-applied
- auto-healer-openclaw-design.md: 3-lane operational detail + FLEX-repo
  promotion criteria (operator vision 2026-05-10 + Issue #27)

2 capability YAML drafts under ops/:
- local-admin/capabilities.yaml: 13 allowed (read.* + plan.*), all
  execute.*/mutate.* denied; vault_sensitivity_tier_mapping; plan
  validation rules (no secret values in prompts; no vault content in plans)
- auto-healer/authorized-repairs.yaml: 2 Lane 3 entries (gateway restart,
  runtime rollback); globally_forbidden + sacred_services lists; max
  severity P1 (never P0); rate_limit_per_day:5

What this PR DOES NOT

- Does NOT create any module.yaml under modules/ (Phase 07 implementation
  tickets follow Phase 06 prune)
- Does NOT touch any runtime path or sacred path
- Does NOT introduce executable code (only specifications + capability YAMLs)
- Does NOT promote auto-healer to GitHub FLEX repo (Phase 07
  implementation decision)
- Does NOT lift the 30-day local-admin freeze
- Does NOT add MCP server exposure for local-admin

Refs

- GPT-5.5 Pro oracle review 2026-05-11:
  - §3 PHASE SEQUENCING ("Do not insert tonight's work before Phase 06")
  - §5 RISKS amplified by 81 modules (#1 module sprawl, #3 operator-bandwidth)
  - §6 LOCAL LLM LAYER feasibility (capability boundary, KOS2 reuse, MCP later)
  - §7 WAKE-UP mechanism final pick (Forgejo → dispatcher → Matrix)
  - §TOP 5 DECISIONS #3 (30-day local-admin freeze) and #5 (Phase 07 scope-lock)
- ADR-0006 (cousin role taxonomy) — names the cousins Phase 07 organizes
- ADR-0008 (durable job bundle) — substrate Phase 07 modules consume
- ADR-0009 (bounded L-1.5 closure) — prerequisite for Phase 07 start
- Issue #27 in pdurlej/iskra-openclaw (auto-healer concept origin)
- operator's KOS2 (github.com/pdurlej/KOS2) — vault janitor prior art

**Role:** orchestrator / drafter (claude)

claude referenced this pull request

2026-05-11 02:15:26 +02:00

ops: ADR-0013 4th replica = Synology + encrypted Dropbox combo (closes BLOCKERS §2) #172

claude referenced this pull request

2026-05-11 02:19:14 +02:00

ops: ADR-0014 Phase 06 prune Q2-2026 additional sunset candidates + silverbullet migration spec #173

claude referenced this pull request

2026-05-11 02:23:14 +02:00

docs(hermes): canonical 7-deliverable bundle templates (Phase 07 §G + GPT §7) #174

claude referenced this pull request from a commit

2026-05-11 02:24:55 +02:00

state/reports: WAKEUP_BRIEF for operator after overnight session 2026-05-11

claude referenced this pull request

2026-05-11 02:25:31 +02:00

state/reports: WAKEUP_BRIEF for operator after overnight session 2026-05-11 #175

claude commented

2026-05-11 07:43:58 +02:00

Author

Collaborator

Role: orchestrator (claude)
Intent: operator-feedback-applied
Needs owner: no (operator has spoken on these via voice-note 2026-05-11 07:26)

Three operator directives from voice-note 2026-05-11 (Hermes voice/privacy/family Q&A) that amend this PR's design — proposed as follow-up amendments, not blocking this PR's merge:

1. Vault sensitivity tier mapping — `Health/` is SOFT_PRIVATE, not HARD_PRIVATE

Operator: "Health nie jest hard private. Nawet leki i badania wydaje mi się, że są raczej ok, dlatego że same one osobno, o ile tam nie będą jakieś ekstremalnie prywatne rzeczy, no to nie powinny dawać wystarczająco dużo jego problemu."

Proposed amendment to ops/local-admin/capabilities.yaml (apply post-merge as separate PR):

vault_sensitivity_tier_mapping:
  soft_private:
    - "02 Areas/**"
    - "05 System/**"
    - "Health/**"           # MOVED FROM hard_private — meds/exams OK, per-file frontmatter override for extreme
  hard_private:
    - "Journal/**"
    - "Finance/**"
    - "Family/**"           # stays hard_private; Kasia not yet secondary operator per ADR-0006 §Iskra

2. Auto-healer FLEX-repo promotion — dogfood-first criterion

Operator: "Najpierw dogfooding. Najpierw zrobienie dogfooding a potem najwyżej split form, wydzielenie z repozytorium i pokazanie tego światu."

Proposed amendment to ADR-0011 §FLEX-repo promotion criteria (clarification, not new criterion):

Criterion #1 stays: ≥30 days production without Lane 3 incident.
Criterion #5 (NEW, operator-confirmed 2026-05-11): operator has personally observed value-delivered (e.g. ≥3 successful Lane 2 upgrade proposals merged + smoke green) before split-from-repo + public release.

This makes "dogfood proves value" gate explicit before public visibility.

3. Architecture inversion — Włóczykij as physical-separation safety, beats read-time filtering

Operator (voice-note 2026-05-11): "Jeśli czegoś nie chce widzieć u agentów no to to jest Włóczykij a jeśli coś akceptuje, że może być u agentów no to jest Iskra-i-Piotr."

This inverts the original capabilities.yaml vault_sensitivity_tier_mapping model (read-time path-policy filter). Operator's preferred model is two physical vaults:

/Users/pd/Obsidian/Iskra-i-Piotr/ — agent-accessible surface (cloud_ok / soft_private per file)
/Users/pd/Obsidian/Włóczykij/ — physical denylist; agents never see this path
One-way sync (Iskra-i-Piotr → Włóczykij; agentic stuff stays in Iskra-i-Piotr)

Safety-by-definition: agents reading at a path that doesn't exist on their side can't leak content. No filter to mis-configure.

Proposed amendment: vault_sensitivity_tier_mapping keeps current per-folder semantics WITHIN Iskra-i-Piotr, AND ops/local-admin/capabilities.yaml adds a top-level vault_roots field:

vault_roots:
  accessible:
    - "/Users/pd/Obsidian/Iskra-i-Piotr/"   # agents may read per sensitivity tier
  denylist:
    - "/Users/pd/Obsidian/Włóczykij/"        # agents NEVER read; not in scope
    - "/Users/pd/Obsidian/100 Projects/"     # operator-confirmed; not in scope
    # ... operator amends as new vaults are created

The pseudo-anonymization read-layer (separate follow-up issue, see #178 once opened) provides defense-in-depth ON TOP of physical separation.

Next: these 3 directives become follow-up PRs after this one merges. No change to this PR.

— claude, 2026-05-11 voice-note rejestracja

**Role:** orchestrator (claude) **Intent:** operator-feedback-applied **Needs owner:** no (operator has spoken on these via voice-note 2026-05-11 07:26) Three operator directives from voice-note 2026-05-11 (Hermes voice/privacy/family Q&A) that amend this PR's design — proposed as **follow-up amendments**, not blocking this PR's merge: ### 1. Vault sensitivity tier mapping — `Health/` is SOFT_PRIVATE, not HARD_PRIVATE Operator: *"Health nie jest hard private. Nawet leki i badania wydaje mi się, że są raczej ok, dlatego że same one osobno, o ile tam nie będą jakieś ekstremalnie prywatne rzeczy, no to nie powinny dawać wystarczająco dużo jego problemu."* Proposed amendment to `ops/local-admin/capabilities.yaml` (apply post-merge as separate PR): ```yaml vault_sensitivity_tier_mapping: soft_private: - "02 Areas/**" - "05 System/**" - "Health/**" # MOVED FROM hard_private — meds/exams OK, per-file frontmatter override for extreme hard_private: - "Journal/**" - "Finance/**" - "Family/**" # stays hard_private; Kasia not yet secondary operator per ADR-0006 §Iskra ``` ### 2. Auto-healer FLEX-repo promotion — dogfood-first criterion Operator: *"Najpierw dogfooding. Najpierw zrobienie dogfooding a potem najwyżej split form, wydzielenie z repozytorium i pokazanie tego światu."* Proposed amendment to ADR-0011 §FLEX-repo promotion criteria (clarification, not new criterion): > Criterion #1 stays: ≥30 days production without Lane 3 incident. > Criterion #5 (NEW, operator-confirmed 2026-05-11): operator has personally observed value-delivered (e.g. ≥3 successful Lane 2 upgrade proposals merged + smoke green) before split-from-repo + public release. This makes "dogfood proves value" gate explicit before public visibility. ### 3. Architecture inversion — Włóczykij as physical-separation safety, beats read-time filtering Operator (voice-note 2026-05-11): *"Jeśli czegoś nie chce widzieć u agentów no to to jest Włóczykij a jeśli coś akceptuje, że może być u agentów no to jest Iskra-i-Piotr."* This **inverts** the original `capabilities.yaml` `vault_sensitivity_tier_mapping` model (read-time path-policy filter). Operator's preferred model is **two physical vaults**: - `/Users/pd/Obsidian/Iskra-i-Piotr/` — agent-accessible surface (`cloud_ok` / `soft_private` per file) - `/Users/pd/Obsidian/Włóczykij/` — physical denylist; agents never see this path - One-way sync (Iskra-i-Piotr → Włóczykij; agentic stuff stays in Iskra-i-Piotr) Safety-by-definition: agents reading at a path that doesn't exist on their side can't leak content. No filter to mis-configure. Proposed amendment: `vault_sensitivity_tier_mapping` keeps current per-folder semantics WITHIN `Iskra-i-Piotr`, AND `ops/local-admin/capabilities.yaml` adds a top-level `vault_roots` field: ```yaml vault_roots: accessible: - "/Users/pd/Obsidian/Iskra-i-Piotr/" # agents may read per sensitivity tier denylist: - "/Users/pd/Obsidian/Włóczykij/" # agents NEVER read; not in scope - "/Users/pd/Obsidian/100 Projects/" # operator-confirmed; not in scope # ... operator amends as new vaults are created ``` The pseudo-anonymization read-layer (separate follow-up issue, see #178 once opened) provides defense-in-depth ON TOP of physical separation. --- **Next:** these 3 directives become follow-up PRs after this one merges. No change to this PR. — claude, 2026-05-11 voice-note rejestracja

claude referenced this pull request

2026-05-11 07:43:59 +02:00

Phase 07+ ADR proposal: pseudo-anonymization read-layer for cloud-agent vault access (openai/privacy-filter) #177

claude referenced this pull request

2026-05-11 07:43:59 +02:00

Phase 08+ scope: Włóczykij as second-tier curated vault (physical-separation safety architecture) #178

codex commented

2026-05-24 07:59:21 +02:00

Collaborator

Fork A triage (codex): closing as superseded/stale, with ideas to be lifted later if needed.

This Phase 07 scope-lock PR predates ADR-0021 bounded contexts and the current milestone roadmap. It also introduces historical ADR numbers 0010/0011/0012 for concepts that now collide with current ADR numbering and context boundaries.

Relevant ideas should be rewritten under Milestone 06 (agent-coordination) or Milestone 08 (persona-bridge) using ADR-0021 context structure, not merged as this old Phase 07 package.

Fork A triage (codex): closing as superseded/stale, with ideas to be lifted later if needed. This Phase 07 scope-lock PR predates ADR-0021 bounded contexts and the current milestone roadmap. It also introduces historical ADR numbers 0010/0011/0012 for concepts that now collide with current ADR numbering and context boundaries. Relevant ideas should be rewritten under Milestone 06 (`agent-coordination`) or Milestone 08 (`persona-bridge`) using ADR-0021 context structure, not merged as this old Phase 07 package.

codex closed this pull request

2026-05-24 07:59:21 +02:00