docs(adr): ADR-0041 narrow the blanket notable-exec corroboration arm to shapes - #328
Merged
Merged
Conversation
… to shapes Design pass (/idea) on unmasking the deferred reverse-shell corroboration shape. - ADR-0041 (Proposed): `Behavior::ProcessExec → false` in the flat corroboration arm (a bare interactive-shell/pkg-mgr exec becomes model-evidence-only, symmetric with PrivilegeChange/PtraceAttach/ModuleLoad, restoring the ADR-0011 on-call FP guard); exec-based corroboration re-homes in a new entry-scoped `reverse_shell_on_foothold` shape (interactive-shell exec + internet NetworkConnection within a symmetric 60s window, foothold-gated), clearing the ADR-0024 gate on the deferred shape. - Corrects the framing: the model never sees `corroborated` (removed by ADR-0034); narrowing buys deterministic auto-apply-gate precision + honest latent/live presentation + ADR-0024 unmasking, not model-input precision. - Safe now: Falco's Alert arm still backstops (falco.enabled: true), pre-arming in audit. One behavior change (inert under audit): shell-only + decisive-attack becomes a proposal not an auto-cut in enforce (ADR-0011-correct). A narrowing-delta counter feeds the retire-Falco parity bake (ADR-0037). - docs/ideas/corroboration-floor-narrowing.md: the settled brief. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Design-pass output (
/idea) for narrowing the blanket notable-exec corroboration arm so the deferred reverse-shell shape becomes load-bearing (clears the ADR-0024 gate).docs/adr/0041-…md(Proposed) — the load-bearing decisions.docs/ideas/corroboration-floor-narrowing.md— the settled brief.docs/adr/README.md— indexed.The decisions
Behavior::ProcessExec → falsein the flat corroboration arm — a bare interactive-shell/pkg-mgr exec becomes model-evidence-only (symmetric withPrivilegeChange/PtraceAttach/ModuleLoad), restoring the ADR-0011 on-call-engineer FP guard the blanket had suspended.reverse_shell_on_footholdshape — interactive-shell exec + internetNetworkConnectionwithin a symmetric 60s window, foothold-gated. This is the deferred reverse-shell shape, now load-bearing.is_alarming_now/menu-seeding untouched (model keeps its hands-on-keyboard signal).Reframing the design corrected
The model never sees
corroborated(removed from the prompt by ADR-0034). Narrowing buys deterministic auto-apply-gate precision + honest latent/live presentation + ADR-0024 unmasking — not model-input precision, which was never at stake.Why now / safety
Falco's
Alertarm still backstops (falco.enabled: true), so narrowing inaudit(default, pre-arming) changes zero operational recall. A narrowing-delta counter feeds the retire-Falco parity bake (ADR-0037). One real behavior change (inert under audit): a shell-only + decisive-attack incident becomes a proposal not an auto-cut in enforce (ADR-0011-correct) — called out for the arming-ladder operator.No code — docs only. Next:
/plan-sprintscopes the build (one engine PR + one observability PR).🤖 Generated with Claude Code
https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP