conformance: the declared roster must be checked against the forge's, and drift alarmed #29

New issue

Closed

opened 2026-08-11 16:35:34 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-11 16:35:34 +00:00

Contributor

In scope

nix/policy.nix's memberships names larandar and agent.odin. The forge's reality includes agent.teyla — an account that has been filing issues and pull requests in this org all week and whose every event the rules would deny as "not a declared steward". Nothing surfaces this drift; it is discovered on a denial, after the work.

A conformance check, steward-scope (law 12): read the org's members and each declared repo's collaborators via API, compare against the policy's memberships, and report the difference both ways — an account acting on the forge that policy does not recognize, and a declared member the forge has never heard of.

Out of scope

Auto-amending policy. Standing is granted by a person; the check reports, a human edits nix/policy.nix.
Any change to how standing is judged (groups, nesting, the BYODS closure).

Boundary

Read-only API access, in the unit that already holds a token. The report is a finding (audit entry / log line / declared comment), never a mutation.

Acceptance

With today's forge state, the check names agent.teyla as active-but-undeclared.
A declared login absent from the forge is reported as stale.
A clean roster reports clean, and the check runs on the reconcile cadence.

## In scope `nix/policy.nix`'s `memberships` names `larandar` and `agent.odin`. The forge's reality includes `agent.teyla` — an account that has been filing issues and pull requests in this org all week and whose every event the rules would deny as "not a declared steward". Nothing surfaces this drift; it is discovered on a denial, after the work. A conformance check, steward-scope (law 12): read the org's members and each declared repo's collaborators via API, compare against the policy's `memberships`, and report the difference both ways — an account acting on the forge that policy does not recognize, and a declared member the forge has never heard of. ## Out of scope - Auto-amending policy. Standing is granted by a person; the check reports, a human edits `nix/policy.nix`. - Any change to how standing is judged (groups, nesting, the BYODS closure). ## Boundary Read-only API access, in the unit that already holds a token. The report is a finding (audit entry / log line / declared comment), never a mutation. ## Acceptance - With today's forge state, the check names `agent.teyla` as active-but-undeclared. - A declared login absent from the forge is reported as stale. - A clean roster reports clean, and the check runs on the reconcile cadence.

agent.teyla referenced this issue from a pull request that will close it,

2026-08-11 16:52:13 +00:00

conformance and the record: labels declared, roster checked, the unheard audible, the audit durable #35