EMERGENCY STOP: T-01b Agent pop-out storage hole (root status + G-01 escalation)

EMERGENCY_CURRENT_STATUS.md

@@ -0,0 +1,45 @@
+# 🛑 EMERGENCY — CURRENT STATUS
+
+**Raised:** 2026-07-25 · **By:** operator (ring-0) · **status_authority:** `NONE`
+*(This file records a halt. It is not accepted-state authority. It is a plain-language safety flag for the owner, and it is reversible.)*
+
+---
+
+## THE LINE IS STOPPED
+
+Progress toward launching or calling **Noted** "safe to ship" is **HALTED** until the open security hole below is resolved by an owner decision. Any seat entering the Lab: read this before starting product work.
+
+## The one blocking thing
+
+**The Agent can still read and write everything Noted stores.**
+
+The embedded-frame version of this hole (**T-01**) was fixed and verified. But two buttons in the Agent's own title bar — **"Pop out"** and **"Open tab"** — open the Agent as a full page that owns the app's storage, walking straight around the fix. This was proven by a live test that read *and* wrote the host's stored data.
+
+- Tracked as: **T-01b** · gate **G-01** · evidence in **PR #122**
+- Branch: `fable/t01-storage-boundary-001` — contains the finding, a deliberately-failing test (`npm run ods:sec003`), and a hand-off brief. **Not merged.**
+- Gate file: [`operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md`](operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md) → **G-01 = RED**
+
+## What must happen to clear it — owner decision, pick one
+
+1. **Remove the two buttons** ("Pop out" / "Open tab") — simplest; provably closes it.
+2. **Serve the Agent from a separate web address** — fixes the whole class of problem; more work.
+3. **Keep them and disclose the risk plainly in the product** — honest, zero engineering, but the hole stays open.
+
+Until one is chosen and verified on the shipped build: **no** "the Agent cannot read your notes" claim, **no** "safe for private journals" language, **no** launch.
+
+## Other open reds (still true, but not the emergency)
+
+- **CARD-11** — a provider key is stored in plain text at rest.
+- **No real-world token or economic value** — by design, stated plainly.
+
+## How this gets lifted
+
+Owner authorizes one fix path above → it is implemented on a branch → the same live test passes on the shipped build → a receipt is filed → G-01 is closed or waived per `WAIVER_PROTOCOL.md` → this file is deleted or superseded.
+
+## Addendum — operator, verbatim (2026-07-25)
+
+> All serious work will be taken back up with a fresh head.
+
+---
+
+*Reversible. Not accepted state. `status_authority: NONE`.*

operations/merge_authorizations/PR-124.json

@@ -0,0 +1,14 @@
+{
+  "schema": "nexus.merge-authorization/v1",
+  "pr_number": 124,
+  "authorized_head_sha": "0fe405c4be2e05ba632a02737a10a63d8face44d",
+  "authorized_by": "operator (GitHub: Natoshi-moto)",
+  "authorized_at_utc": "2026-07-25T13:09:31Z",
+  "statement": "Operator received the plain-language merge card for the EMERGENCY STOP and said 'Merge'. Content is docs-only (root EMERGENCY_CURRENT_STATUS.md + append-only G-01 gate note + operator verbatim addendum); no code, snapshots, crypto chain, or control plane touched; branch up to date with main; no secrets. Authorizes exactly this commit.",
+  "status_authority": "OPERATOR_EXPLICIT",
+  "non_claims": [
+    "This is not independent review.",
+    "This authorization covers only the exact head SHA recorded above; a new commit requires a new file.",
+    "This does not certify content is correct, safe, or complete - only that the operator explicitly reviewed and approved merging this exact commit."
+  ]
+}

operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md

@@ -22,6 +22,18 @@ T-IDs refer to `../NOTED_SOVEREIGNTY_ASSAULT_001/THREAT_MODEL.md`.
 
 **Savage restatement:** Until G-01 is green, the chat widget is a raccoon with a key to the kitchen. Building more cabinets is not security.
 
+> **ESCALATION 2026-07-25 — T-01b, EMERGENCY STOP.** The iframe path (T-01)
+> was fixed and verified (ODS-SEC-001 PASS). G-01 stays **RED** anyway: two
+> title-bar buttons — "Pop out" (`window.open`) and "Open tab"
+> (`<a target="_blank">`) — load the same Agent document top-level and
+> unsandboxed, so it owns host storage regardless of the iframe fix. Proven
+> live (read AND wrote host storage) — see **PR #122**, receipt
+> `operations/receipts/T01_FIX_20260725/CARD-04B-POPOUT.md`, deliberate red
+> `npm run ods:sec003`. GREEN now additionally requires this route closed
+> (buttons removed, or Agent served from a separate origin) or waiver W-G01.
+> This is the Lab's current emergency stop — see root
+> [`EMERGENCY_CURRENT_STATUS.md`](../../../EMERGENCY_CURRENT_STATUS.md).
+
 ---
 
 ## G-02 — No unpinned brain surgery from the public internet (T-02)