Fold research/0002 consequences into the threat model and RFC-0004

[MatejGomboc]

What

Turns the second prior-art review's findings into the permanent design record — the parts that are mine to author. The three proposed constitution §3 graves stay flagged for your verdict, not taken here.

Threat model — seven new obligations + an O-15 amendment

Appended with the next free numbers per §11's "new surface, new obligation" rule (never renumbered):

• O-21 mediation auditability, O-22 broker compromise containment, O-23 fail-closed mediation — the three broker obligations that close O-10's neighbourhood. O-10 (confused deputy) was the only obligation of the original twenty that the review's completeness critic found unfed.
• O-24 update closure integrity (mix-and-match + wrong-software), O-25 bounded update transfer (endless-data).
• O-26 bounded service per client — A5's userspace half, where O-7 is its kernel half.
• O-27 explicit authority at spawn — the runc leaked-fd escape (CVE-2024-21626) as a capability obligation.
• O-15 gains a fast-forward clause (author-key-signed epoch reset).

Phase table binds each; Built ratio restated honestly as three of twenty-seven — the additions raised the denominator, not the numerator.

RFC-0004 — budget-expiry amendment

An Amendments section commits to the budget-expiry-inside-passive-server protocol inherited from seL4 MCS's named hole (the temporal twin of §8's withheld-reply denial): a minimum-budget threshold checked at call, plus a defined kernel-initiated error-completion on the reply object.

How it was hardened

An adversarial three-lens panel (redundancy against the existing O-1…O-20, factual grounding against research/0002, house-rules conformance), 14 agents, every finding verified by an independent skeptic. 11 raw → 6 confirmed → all folded in. The confirmed fixes:

• [major] The phase table placed the broker in Phase 2, contradicting constitution §10 (broker = Phase 3 — Soul). Corrected to Phase 3, matching binding law; O-21…O-23 bound there. (See "For your attention" below — a pre-existing wrinkle remains.)
• [minor] RFC-0004 budget-expiry recovery wrongly claimed the reply object surfaces the failure "exactly as a withheld reply is surfaced" — but §8 surfaces a withheld reply via the userspace watchdog, not the reply object. Corrected to state the asymmetry: budget expiry is kernel-detectable, so the kernel completes the wait with an error; the mechanism is new, the scheduler RFC's to define.
• [minor] O-27 miscited Capsicum (which actually inherits the fd table across fork — a counter-example); dropped, leaving runc + Landlock as research/0002 grounds them.
• [nit] O-26 dropped the AWS Kinesis citation (research/0002 grounds that in O-7, not the userspace-multiplexing obligation).
• [nit] RFC-0004 "cite this obligation" → "cite this commitment" (obligation is a term of art for O-numbers).

For your attention

Correcting the broker to Phase 3 exposed a pre-existing wrinkle I did not touch: the threat model's §8 already binds O-10 (a broker obligation) in Phase 2, while §10 puts the broker in Phase 3. The likely reality is that a minimal mediation appears in Phase 2 with the scheme registry (schemes are broker-mediated by the primitive), ahead of the full broker pillar in Phase 3. Reconciling that is either a one-line §8 note or a §10 clarification — the latter is constitution text, so I've left it for you rather than choosing.

Markdown and British-spelling gates clean (66 files).

🤖 Generated with Claude Code