|
| 1 | +# SPDX-License-Identifier: PMPL-1.0-or-later |
| 2 | +# must.k9.ncl — K9 trust-tier component of the must trident |
| 3 | +# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> |
| 4 | +# |
| 5 | +# Pairs with: Mustfile.a2ml (declaration) + must.ncl (runner). |
| 6 | +# Trident completeness is a hard precondition — a repo shipping |
| 7 | +# Mustfile without this file AND its runner is an invalid trident; |
| 8 | +# the contractile CLI's verify gate refuses partial publication. |
| 9 | +# |
| 10 | +# Verb: must (invariant assertion — release-blocking) |
| 11 | +# Tier: Hunt-read-only (capability: subprocess probes shell out |
| 12 | +# for grep/test/file-check; no mutation; |
| 13 | +# no network; no write) |
| 14 | +# Authority: blocking (HARD GATE — the canonical gating verb) |
| 15 | +# |
| 16 | +# must is the concrete + persistent verb — release-blocking invariants |
| 17 | +# that must hold. Complement to trust (concrete + ephemeral). Together |
| 18 | +# must + trust form the blocking-authority pair in the contractile set. |
| 19 | +# |
| 20 | +# Cardinality: ONE must trident per repo. |
| 21 | +# |
| 22 | +# Failure-mode focus: must is the primary catchment for subtle |
| 23 | +# invariant-erosion drift. Where trust catches "turn off the firewall" |
| 24 | +# (outrageous), must catches "this file that was required is now |
| 25 | +# missing" / "this forbidden pattern has reappeared" / "this schema |
| 26 | +# version regressed" (subtle). Key defense against A5 (commercial |
| 27 | +# fabrication of success "facts" — invariants ground truth against |
| 28 | +# marketing copy) and D1 (lore fabrication about what the repo contains). |
| 29 | + |
| 30 | +let base_k9 = import "../k9/template-hunt.k9.ncl" in |
| 31 | +let base = import "../_base.ncl" in |
| 32 | + |
| 33 | +{ |
| 34 | + pedigree = base_k9.pedigree_schema & { |
| 35 | + contractile_verb = "must", |
| 36 | + paired_xfile = "../must/Mustfile.a2ml", |
| 37 | + paired_runner = "../must/must.ncl", |
| 38 | + |
| 39 | + # α two-axis: Hunt tier (subprocess for grep/test/etc.) but |
| 40 | + # restricted to read-only operations. Blocking authority because |
| 41 | + # must is the canonical gating verb. |
| 42 | + tier = 'Hunt, |
| 43 | + authority = 'blocking, |
| 44 | + |
| 45 | + metadata = { |
| 46 | + name = "must-k9", |
| 47 | + version = "1.0.0", |
| 48 | + description = "Evaluates release-blocking invariants as a hard gate. Third trident instance. Complements trust (ephemeral blocking) with persistent invariant blocking.", |
| 49 | + paired_xfile = "Mustfile.a2ml", |
| 50 | + paired_runner = "must.ncl", |
| 51 | + author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>", |
| 52 | + }, |
| 53 | + |
| 54 | + security = { |
| 55 | + leash = 'Hunt, |
| 56 | + trust_level = "read-only invariant verification with subprocess", |
| 57 | + allow_network = false, |
| 58 | + allow_filesystem_write = false, |
| 59 | + allow_subprocess = true, |
| 60 | + probe_scope = 'read_only, # must probes NEVER mutate |
| 61 | + probe_kinds_allowed = [ |
| 62 | + 'file_existence, |
| 63 | + 'pattern_presence, |
| 64 | + 'pattern_absence, |
| 65 | + 'schema_match, |
| 66 | + 'version_equality, |
| 67 | + 'count_threshold, |
| 68 | + ], |
| 69 | + probe_kinds_denied = [ |
| 70 | + 'network_call, |
| 71 | + 'filesystem_mutation, |
| 72 | + 'external_api, |
| 73 | + 'exploit_attempt, # that's trust's safe_hacking territory |
| 74 | + ], |
| 75 | + }, |
| 76 | + }, |
| 77 | + |
| 78 | + # ------------------------------------------------------------------- |
| 79 | + # Variance schema — trust-style severity acknowledgement. |
| 80 | + # Because must is BLOCKING, variances carry real weight. Critical- |
| 81 | + # severity invariants can only be varied by maintainer-or-above. |
| 82 | + # ------------------------------------------------------------------- |
| 83 | + variance_schema = { |
| 84 | + entry_id | String, # which invariant id the variance applies to |
| 85 | + reason | String, |
| 86 | + approved_by | String, # maintainer or above for critical-severity |
| 87 | + scope | String, # path glob | session-id | "until-<date>" |
| 88 | + expires | String, # absolute date; must variances cannot be open-ended |
| 89 | + review_notes | String | optional, |
| 90 | + severity_acknowledged | [| 'critical, 'high, 'medium |], |
| 91 | + waived_consequence_description | String, # plain language — what breaking the invariant actually does |
| 92 | + }, |
| 93 | + |
| 94 | + execution = { |
| 95 | + triggers = [ 'session_close, 'on_demand, 'pre_push, 'pre_merge ], |
| 96 | + |
| 97 | + # Per-invariant execution. Failed invariant = blocked merge. |
| 98 | + per_invariant = { |
| 99 | + run_probe = true, |
| 100 | + record_outcome = true, |
| 101 | + respect_variance = true, # active variance suppresses the gate |
| 102 | + on_unmet = 'fail, # BLOCKING |
| 103 | + severity_escalation = 'honour, |
| 104 | + # Subtle-erosion defense: track per-invariant trend over sessions. |
| 105 | + # An invariant that passes once and then starts failing in a |
| 106 | + # later session without explicit amendment = suspect drift; |
| 107 | + # surface as high-priority drift log entry. |
| 108 | + track_per_session_trend = true, |
| 109 | + flag_suspicious_regressions = true, |
| 110 | + }, |
| 111 | + |
| 112 | + evidence_sinks = [ |
| 113 | + { |
| 114 | + kind = 'verisimdb, |
| 115 | + table = "contractile_executions", |
| 116 | + schema = "contractile_execution_v1", |
| 117 | + aux_tables = [ "must_invariant_history" ], # per-invariant trend record |
| 118 | + }, |
| 119 | + { |
| 120 | + kind = 'drift_log, |
| 121 | + path = ".machine_readable/6a2/DRIFT.a2ml", |
| 122 | + append_only = true, |
| 123 | + }, |
| 124 | + ], |
| 125 | + |
| 126 | + # Session-close hook — re-evaluate all invariants. Block close on |
| 127 | + # critical drift (same policy as trust). |
| 128 | + on_close = { |
| 129 | + re_execute_all_invariants = true, |
| 130 | + diff_against_last_ratification = true, |
| 131 | + emit_drift_entries_for_new_failures = true, |
| 132 | + surface_expired_variances = true, |
| 133 | + # Critical must drift blocks session close — consistent with trust. |
| 134 | + block_session_close_on_critical_drift = true, |
| 135 | + # Must-specific: if a previously-passing invariant is now failing |
| 136 | + # without an associated variance or amendment, that's suspected |
| 137 | + # silent regression — surface prominently at next session open. |
| 138 | + flag_silent_regression = true, |
| 139 | + }, |
| 140 | + |
| 141 | + # ----------------------------------------------------------------- |
| 142 | + # Session-open hook — NEGOTIATION + RATIFICATION + ACCOUNTABILITY |
| 143 | + # (inherited from intend.k9.ncl v2.0.0 + trust.k9.ncl extensions) |
| 144 | + # ----------------------------------------------------------------- |
| 145 | + on_open = { |
| 146 | + # --- Context presentation --- |
| 147 | + render_summary = 'plain_language, |
| 148 | + include_drift_log_from_last_close = true, |
| 149 | + include_active_variances = true, |
| 150 | + include_recent_anchors = true, |
| 151 | + anchor_lookback_weeks = 8, |
| 152 | + |
| 153 | + # Must-specific: surface any silent regressions flagged at last |
| 154 | + # close so they can't quietly persist across sessions. |
| 155 | + include_silent_regressions = true, |
| 156 | + |
| 157 | + # --- Negotiation phase (five mandatory inputs) --- |
| 158 | + negotiation = { |
| 159 | + required = true, |
| 160 | + ai_required_inputs = [ |
| 161 | + 'timeline_realism, |
| 162 | + 'industry_standards, # what invariants derive from external standards |
| 163 | + 'audience_feasibility, # who is the invariant protecting |
| 164 | + 'resulting_invariants, # what NEW must entries result from the work |
| 165 | + 'ecosystem_dependencies, # what the invariants depend on |
| 166 | + ], |
| 167 | + user_engagement_required = true, |
| 168 | + user_engagement_mode = 'per_input_response, |
| 169 | + specification_translation = { |
| 170 | + ai_produces_spec_form = true, |
| 171 | + user_reviews_in_domain_language = true, |
| 172 | + schema_authoring_is_ai_responsibility = true, |
| 173 | + translation_faithfulness_auditable = true, |
| 174 | + }, |
| 175 | + }, |
| 176 | + |
| 177 | + # --- Accountability pledge --- |
| 178 | + # Must's pledge parallels trust's but around invariants rather |
| 179 | + # than threat model. User pledges not to disable invariants to |
| 180 | + # unblock merges; AI pledges to hold the line on declared |
| 181 | + # invariants even against enthusiastic scope expansion. |
| 182 | + accountability_pledge = { |
| 183 | + required = true, |
| 184 | + parties = [ |
| 185 | + { |
| 186 | + role = 'user, |
| 187 | + pledge = "I have reviewed the declared invariants and the consequences of breaching them. I accept accountability for meeting these invariants and understand that failed invariants block merges. I will raise a variance (with severity acknowledgement) or an amendment rather than disabling a probe to unblock a merge.", |
| 188 | + signature_required = true, |
| 189 | + }, |
| 190 | + { |
| 191 | + role = 'ai_agent, |
| 192 | + pledge = "I will hold the declared invariants. I will refuse to weaken probes to unblock merges; I will refuse scope-creep suggestions that would remove an invariant silently; I will surface silent regressions at session close; I will require variance-with-severity or amendment for any legitimate scope shift, not quiet probe disablement.", |
| 193 | + signature_required = true, |
| 194 | + }, |
| 195 | + ], |
| 196 | + signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml", |
| 197 | + must_precede_work = true, |
| 198 | + }, |
| 199 | + |
| 200 | + ratification_record_shape = { |
| 201 | + includes_negotiation_transcript = true, |
| 202 | + includes_both_pledges = true, |
| 203 | + includes_invariant_summary = true, # must-specific |
| 204 | + signed = true, |
| 205 | + dated = true, |
| 206 | + session_id = 'required, |
| 207 | + contract_hash = 'required, |
| 208 | + }, |
| 209 | + }, |
| 210 | + }, |
| 211 | + |
| 212 | + # ------------------------------------------------------------------- |
| 213 | + # Failure-mode defenses — must's specialisation is subtle-invariant |
| 214 | + # erosion. Overlaps with trust on blocking authority but focused on |
| 215 | + # persistent invariants rather than ephemeral transactional state. |
| 216 | + # ------------------------------------------------------------------- |
| 217 | + failure_mode_defenses = [ |
| 218 | + # Category A — enthusiasm capture |
| 219 | + 'A1_enthusiasm_capture, # scope breach via blocking authority |
| 220 | + 'A5_grandiose_scale_hype, # invariants are ground truth vs commercial hype |
| 221 | + # Category C — scope/capability erosion |
| 222 | + 'C1_scope_creep, # feature-adjacent changes flagged if they break invariants |
| 223 | + 'C2_capability_collapse, # invariant removal requires amendment |
| 224 | + 'C3_helpfulness_inflation, # added features must respect declared invariants |
| 225 | + # Category D — epistemic failures |
| 226 | + 'D1_lore_fabrication, # invariants are verifiable truth, not AI-recollection |
| 227 | + 'D2_completeness_illusion, # invariant probe must cite behavioural check, not build-success |
| 228 | + 'D3_test_theatre, # invariants require real verification not mock-passing |
| 229 | + 'D4_error_hiding, # on_unmet = 'fail makes hiding impossible |
| 230 | + # Category E — refactor/churn |
| 231 | + 'E1_refactor_stampede, # refactor must preserve invariants |
| 232 | + 'E3_premature_abstraction, # abstraction must not violate invariants |
| 233 | + # Category F — session drift |
| 234 | + 'F1_across_session_forgetting, # track_per_session_trend catches re-introduction |
| 235 | + ], |
| 236 | +} |
0 commit comments