S36 · Security & Access Control

36.F1 · A documented confirm tier covering every mutating tool.

Tier F · done · Verification: hermetic-test

Gate: `test_confirm_tier_documented.py`

• unverified-import · undated · docs/SYSTEMS-DETAILS.md:3677

36.F2 · Deterministic refusal of catastrophic actions, independent of the model.

Tier F · done · Verification: hermetic-test

Gate: `test_security_hardening.py`, `test_safety_autonomy.py`

• unverified-import · undated · docs/SYSTEMS-DETAILS.md:3679

36.F3 · Identity as a second factor for protected actions, failing *open* only when the sensor

Tier F · done · Verification: hermetic-test

Gate: `test_face_second_factor.py`

• unverified-import · undated · docs/SYSTEMS-DETAILS.md:3681

36.F4 · A park switch that halts every role on every host.

Tier F · done · Verification: hermetic-test

Gate: `test_maintenance_lock.py`

• unverified-import · undated · docs/SYSTEMS-DETAILS.md:3683

36.F5 · Secrets have exactly one home (password store), and the repo proves it.

Tier F · done · Verification: unregistered-test

Gate: `check_public_clean.py` extended.

• unverified-import · undated · docs/SYSTEMS-DETAILS.md:3685

36.R1 · Session-scoped elevation: a confirmed sensitive action does not silently authorise the

Tier R · done · Verification: hermetic-test

Gate: `test_companion_safety.py` [confirm gate] (36.R1) - a yes covers the tool that was put to the owner, once per batch: a different gated tool in the same turn is held, a second copy is held, and the next gated call needs its own yes.

• hermetic-green · 2026-10-17 · bench/test_companion_safety.py

36.R2 · Anomaly alerting on the audit trail — unusual command patterns raise a signal.

Tier R · open · Verification: hermetic-test

Gate: `test_error_tracking.py` extended.

36.R3 · Guest mode: a non-owner gets a strictly reduced surface, by construction.

Tier R · open · Verification: planned-test

Gate: new `test_guest_mode.py` - planned gate. new `test_guest_mode.py`

36.E1 · An adversarial pass: 30 attempts to talk Mushegh past the gates, zero successes.

Tier E · open · Verification: planned-test

Gate: new `test_adversarial_prompts.py` - planned gate. new `test_adversarial_prompts.py`

36.F6 · **Hard rate and cost governor over autonomous action** — a ceiling on calls, spend and wall-clock per autonomous run, enforced in code and not by prompt. Jev: must ship before the unpark (P=0.69); the failure has already happened once on this owner's infrastructure, so it is demonstrated, not hypothetical.

Tier F · done · Verification: hermetic-test

Gate: `test_action_governor.py` — each of the calls, spend and runtime ceilings refuses independently and deterministically (the model is never consulted), the refusal is audited with a rule naming the ceiling, and the ledger survives a restart.

• recorded-note · 2026-09-20 · TODO.md

36.F7 · **Explicit actor field on every action and audit record** — one value today, but carried. Jev p=1.00, conf 0.99, the most confident actionable directive in a thousand: retrofitting an identity concept later is the expensive part; carrying it is nearly free.

Tier F · done · Verification: hermetic-test

Gate: `test_actor_field.py` — no audit line can carry an empty actor, the autonomous worker's tool calls are audited at all (they were not before), and an unattended action is never attributed to the owner.

• recorded-note · 2026-09-20 · TODO.md

36.R4 · Every credential in the environment is inventoried, mapped to a decision, and justified: a key that contradicts one (cloud TTS vs D-17, cloud wake spotting vs D-19, model evaluation vs D-47) is removed or recorded as an accepted exception with a date (D-62).

Tier R · open · Verification: planned-test

Gate: new `test_credential_inventory.py` — every credential-shaped setting in .env.example maps to a row in docs/CREDENTIALS.md naming its system, its decision, and whether it is configured.