Filed unassigned and unlabelled for triage routing by the dev seat on #9055 (session session_011RB4waLuNbdruCo6X9oobm), branch claude/issue-9055-realtime-authz-ci-claim. Not a claim. Found by reverse-verifying the tripwire mechanism while narrowing the prose claim on realtime-protocol.mdx; #9055 is fenced prose-only, so recording rather than fixing.
The gap
The realtime-delivery-authz tripwire note (packages/qa/dogfood/test/authz-conformance.matrix.ts:168) states the remedy for a wired transport as:
The transport tripwire probes in authz-conformance.test.ts turn a wired transport into an UNCLASSIFIED surface → red CI until this row is upgraded with the enforcement site.
The ledger does not require that. checkLedger requires an enforcement site only when state === 'enforced'. The realtime row is state: 'experimental', and an experimental row's covers keys classify a discovered surface exactly as an enforced row's do. So the shortest path from red back to green is to append the tripwire key to the experimental row — a row whose own summary is "realtime delivery fan-out has NO per-recipient authorization" — and CI is satisfied.
Measured on origin/main2cb69c31c
Two-step reverse verification, both legs run:
Wired a real transport — const probe = new EventSource('/api/v1/stream'); in packages/client/src/realtime-api.ts:
AssertionError: UNCLASSIFIED surface — add a ledger row (ADR-0060): realtime:client/realtime-api.ts:transport(TRANSPORT-WIRED)
Tests 2 failed | 13 passed (15)
Left the transport wired, wrote zero authorization, and appended only the key to the existing experimental row's covers:
Green, with a live client transport and the matrix still recording "no per-recipient authorization". Both mutations reverted; nothing was pushed.
Why it matters
The tripwire's value is that it forces the admission decision in front of a reviewer — that part is real and it fires. But the note tells the next author the gate will hold out for an enforcement site, and it will not: classification by the absence-recording row is accepted. The failure mode is quiet, because the author who silences the red is the same author who would have had to write the re-check, and the gate gives them a one-line exit that reads as compliance.
This becomes live work the moment #8347 (WS/SSE transport, scheduled v18) lands.
Possible directions (not a ruling — needs the row's owner)
- Have the ratchet refuse a
TRANSPORT-WIRED key classified by a row that is not enforced (narrow, targeted at the tripwire keys only). - Or require any row covering a
TRANSPORT-WIRED key to name an enforcement site regardless of state. - Or, minimally, correct the note so it describes what the gate actually accepts.
The third is cheap but leaves the hole; the first two change gate behaviour and are a decision for the matrix owner, not a drive-by.
Related: #9055 (the prose claim, PR #9082) · #8347 (transport, v18) · #8711 · ADR-0096 D4 · ADR-0060 · framework#2992.
Filed unassigned and unlabelled for triage routing by the dev seat on #9055 (session
session_011RB4waLuNbdruCo6X9oobm), branchclaude/issue-9055-realtime-authz-ci-claim. Not a claim. Found by reverse-verifying the tripwire mechanism while narrowing the prose claim onrealtime-protocol.mdx; #9055 is fenced prose-only, so recording rather than fixing.The gap
The
realtime-delivery-authztripwire note (packages/qa/dogfood/test/authz-conformance.matrix.ts:168) states the remedy for a wired transport as:The ledger does not require that.
checkLedgerrequires anenforcementsite only whenstate === 'enforced'. The realtime row isstate: 'experimental', and an experimental row'scoverskeys classify a discovered surface exactly as an enforced row's do. So the shortest path from red back to green is to append the tripwire key to the experimental row — a row whose own summary is "realtime delivery fan-out has NO per-recipient authorization" — and CI is satisfied.Measured on
origin/main2cb69c31cTwo-step reverse verification, both legs run:
Wired a real transport —
const probe = new EventSource('/api/v1/stream');inpackages/client/src/realtime-api.ts:Left the transport wired, wrote zero authorization, and appended only the key to the existing experimental row's
covers:Green, with a live client transport and the matrix still recording "no per-recipient authorization". Both mutations reverted; nothing was pushed.
Why it matters
The tripwire's value is that it forces the admission decision in front of a reviewer — that part is real and it fires. But the note tells the next author the gate will hold out for an enforcement site, and it will not: classification by the absence-recording row is accepted. The failure mode is quiet, because the author who silences the red is the same author who would have had to write the re-check, and the gate gives them a one-line exit that reads as compliance.
This becomes live work the moment #8347 (WS/SSE transport, scheduled v18) lands.
Possible directions (not a ruling — needs the row's owner)
TRANSPORT-WIREDkey classified by a row that is notenforced(narrow, targeted at the tripwire keys only).TRANSPORT-WIREDkey to name anenforcementsite regardless of state.The third is cheap but leaves the hole; the first two change gate behaviour and are a decision for the matrix owner, not a drive-by.
Related: #9055 (the prose claim, PR #9082) · #8347 (transport, v18) · #8711 · ADR-0096 D4 · ADR-0060 · framework#2992.