From f934916e75fccae8e08d7dcca3bee73673aba38c Mon Sep 17 00:00:00 2001 From: Natoshi-moto Date: Sat, 25 Jul 2026 14:05:22 +0100 Subject: [PATCH 1/3] EMERGENCY STOP: raise T-01b (Agent pop-out storage hole) as current halt Adds root EMERGENCY_CURRENT_STATUS.md (plain-language, owner-facing) and escalates stop-the-line gate G-01 to name the pop-out/open-tab route (T-01b, PR #122) as the live RED that blocks launch. The T-01 iframe fix holds; G-01 stays RED because the pop-out route reopens the boundary. Owner must pick a fix path (remove buttons / separate origin / disclose). Proposal only. main untouched. status_authority: NONE. Co-Authored-By: Claude Code --- EMERGENCY_CURRENT_STATUS.md | 41 +++++++++++++++++++ .../NOTED_STOP_THE_LINE_001/HARD_GATES.md | 12 ++++++ 2 files changed, 53 insertions(+) create mode 100644 EMERGENCY_CURRENT_STATUS.md diff --git a/EMERGENCY_CURRENT_STATUS.md b/EMERGENCY_CURRENT_STATUS.md new file mode 100644 index 0000000..0bfa8b3 --- /dev/null +++ b/EMERGENCY_CURRENT_STATUS.md @@ -0,0 +1,41 @@ +# ๐Ÿ›‘ EMERGENCY โ€” CURRENT STATUS + +**Raised:** 2026-07-25 ยท **By:** operator (ring-0) ยท **status_authority:** `NONE` +*(This file records a halt. It is not accepted-state authority. It is a plain-language safety flag for the owner, and it is reversible.)* + +--- + +## THE LINE IS STOPPED + +Progress toward launching or calling **Noted** "safe to ship" is **HALTED** until the open security hole below is resolved by an owner decision. Any seat entering the Lab: read this before starting product work. + +## The one blocking thing + +**The Agent can still read and write everything Noted stores.** + +The embedded-frame version of this hole (**T-01**) was fixed and verified. But two buttons in the Agent's own title bar โ€” **"Pop out"** and **"Open tab"** โ€” open the Agent as a full page that owns the app's storage, walking straight around the fix. This was proven by a live test that read *and* wrote the host's stored data. + +- Tracked as: **T-01b** ยท gate **G-01** ยท evidence in **PR #122** +- Branch: `fable/t01-storage-boundary-001` โ€” contains the finding, a deliberately-failing test (`npm run ods:sec003`), and a hand-off brief. **Not merged.** +- Gate file: [`operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md`](operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md) โ†’ **G-01 = RED** + +## What must happen to clear it โ€” owner decision, pick one + +1. **Remove the two buttons** ("Pop out" / "Open tab") โ€” simplest; provably closes it. +2. **Serve the Agent from a separate web address** โ€” fixes the whole class of problem; more work. +3. **Keep them and disclose the risk plainly in the product** โ€” honest, zero engineering, but the hole stays open. + +Until one is chosen and verified on the shipped build: **no** "the Agent cannot read your notes" claim, **no** "safe for private journals" language, **no** launch. + +## Other open reds (still true, but not the emergency) + +- **CARD-11** โ€” a provider key is stored in plain text at rest. +- **No real-world token or economic value** โ€” by design, stated plainly. + +## How this gets lifted + +Owner authorizes one fix path above โ†’ it is implemented on a branch โ†’ the same live test passes on the shipped build โ†’ a receipt is filed โ†’ G-01 is closed or waived per `WAIVER_PROTOCOL.md` โ†’ this file is deleted or superseded. + +--- + +*Reversible. Not accepted state. `status_authority: NONE`.* diff --git a/operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md b/operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md index 8f5a023..02ac261 100644 --- a/operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md +++ b/operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md @@ -22,6 +22,18 @@ T-IDs refer to `../NOTED_SOVEREIGNTY_ASSAULT_001/THREAT_MODEL.md`. **Savage restatement:** Until G-01 is green, the chat widget is a raccoon with a key to the kitchen. Building more cabinets is not security. +> **ESCALATION 2026-07-25 โ€” T-01b, EMERGENCY STOP.** The iframe path (T-01) +> was fixed and verified (ODS-SEC-001 PASS). G-01 stays **RED** anyway: two +> title-bar buttons โ€” "Pop out" (`window.open`) and "Open tab" +> (``) โ€” load the same Agent document top-level and +> unsandboxed, so it owns host storage regardless of the iframe fix. Proven +> live (read AND wrote host storage) โ€” see **PR #122**, receipt +> `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md`, deliberate red +> `npm run ods:sec003`. GREEN now additionally requires this route closed +> (buttons removed, or Agent served from a separate origin) or waiver W-G01. +> This is the Lab's current emergency stop โ€” see root +> [`EMERGENCY_CURRENT_STATUS.md`](../../../EMERGENCY_CURRENT_STATUS.md). + --- ## G-02 โ€” No unpinned brain surgery from the public internet (T-02) From 0fe405c4be2e05ba632a02737a10a63d8face44d Mon Sep 17 00:00:00 2001 From: Natoshi-moto Date: Sat, 25 Jul 2026 14:06:15 +0100 Subject: [PATCH 2/3] EMERGENCY STOP: add operator verbatim addendum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "All serious work will be taken back up with a fresh head." โ€” preserved verbatim on the root emergency-status file. Proposal only. main untouched. status_authority: NONE. Co-Authored-By: Claude Code --- EMERGENCY_CURRENT_STATUS.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/EMERGENCY_CURRENT_STATUS.md b/EMERGENCY_CURRENT_STATUS.md index 0bfa8b3..61a1275 100644 --- a/EMERGENCY_CURRENT_STATUS.md +++ b/EMERGENCY_CURRENT_STATUS.md @@ -36,6 +36,10 @@ Until one is chosen and verified on the shipped build: **no** "the Agent cannot Owner authorizes one fix path above โ†’ it is implemented on a branch โ†’ the same live test passes on the shipped build โ†’ a receipt is filed โ†’ G-01 is closed or waived per `WAIVER_PROTOCOL.md` โ†’ this file is deleted or superseded. +## Addendum โ€” operator, verbatim (2026-07-25) + +> All serious work will be taken back up with a fresh head. + --- *Reversible. Not accepted state. `status_authority: NONE`.* From 5e8aeaf1dd4ee6ee92c21c7aded750a4b4627078 Mon Sep 17 00:00:00 2001 From: Natoshi-moto Date: Sat, 25 Jul 2026 14:09:32 +0100 Subject: [PATCH 3/3] Authorize merge of PR-124 (operator explicit: 'Merge', pinned to content head 0fe405c4be2e05ba632a02737a10a63d8face44d) --- operations/merge_authorizations/PR-124.json | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 operations/merge_authorizations/PR-124.json diff --git a/operations/merge_authorizations/PR-124.json b/operations/merge_authorizations/PR-124.json new file mode 100644 index 0000000..6d8ca4f --- /dev/null +++ b/operations/merge_authorizations/PR-124.json @@ -0,0 +1,14 @@ +{ + "schema": "nexus.merge-authorization/v1", + "pr_number": 124, + "authorized_head_sha": "0fe405c4be2e05ba632a02737a10a63d8face44d", + "authorized_by": "operator (GitHub: Natoshi-moto)", + "authorized_at_utc": "2026-07-25T13:09:31Z", + "statement": "Operator received the plain-language merge card for the EMERGENCY STOP and said 'Merge'. Content is docs-only (root EMERGENCY_CURRENT_STATUS.md + append-only G-01 gate note + operator verbatim addendum); no code, snapshots, crypto chain, or control plane touched; branch up to date with main; no secrets. Authorizes exactly this commit.", + "status_authority": "OPERATOR_EXPLICIT", + "non_claims": [ + "This is not independent review.", + "This authorization covers only the exact head SHA recorded above; a new commit requires a new file.", + "This does not certify content is correct, safe, or complete - only that the operator explicitly reviewed and approved merging this exact commit." + ] +}