Permission-posture claims restated across unsynced surfaces — enumeration-based containment cannot close the class #353

Root cause

Claude Code permission-engine posture — what allowed-tools does, what a settings allow-rule does, where a local-review provider grant may live — is authored independently on N surfaces and kept correct by restatement. Every containment attempt so far has been an ENUMERATION at a different layer. An enumeration can only be complete with respect to what its author already knew; the next surface, the next paraphrase, or the next unrouted path reopens the class.

Four consecutive review iterations on one PR each found a DIFFERENT member. That is the signature of complete-the-known-set, not of a closed guard.

root_class: permission-posture-restated-across-unsynced-surfaces

Evidence — four iterations, four members, one branch

Corroborating detail: review cycle 4 enumerated three allowlisted surfaces asserting engine behavior. There are four — plugin/governance/security-policy.md:124 also carries the token. Whether :124 counts as an "engine behavior assertion" or a structural-containment claim is precisely the judgment an enumerated guard cannot make. The enumeration of the violations was itself incomplete.

What a genuinely class-eliminating fix would need

A different primitive than any tried. Every attempt to date compares a surface against a LIST:

• attempt 1 — list of surfaces that must carry the literal (safety-local-review-grant-single-home.json)
• attempt 2 — list of surfaces exempt from the claim ban (CHECK15_ALLOWLIST)
• attempt 3 — list of paths the validator routes (map_path legs)
• attempt 4 — list of one trigger token (CHECK15_TOKEN = 'allowed-tools'), which CHECK 15's own comment concedes is defeated by any paraphrase

A closing fix must instead compare a surface against a SOURCE. Two candidate primitives, neither yet attempted:

1. Single-source + transclusion. Permission-posture prose exists in exactly ONE file. Every other surface carries a generated include region; a check regenerates and diffs. "Out of sync" stops being expressible, and the paraphrase residual dies with it, because the check compares bytes against the source rather than pattern-matching for a token.
2. Derivation from ground truth. Assert the posture against the ACTUAL artifact — the seeded settings template, the agent frontmatter, the installed binary's behavior — rather than against prose in N documents. This is what would have caught member chore: address code review feedback #1 at authoring time.

Distinguishing property to test any future proposal against: does it compare a surface to a SOURCE, or to a LIST? If a LIST, it is another iteration of this class.

Open engine question (blocks part of the cluster)

Whether a skill's allowed-tools entry — e.g. Bash(node *) — suppresses the permission prompt for a provider binary invoked via node, including in a subagent context, is NOT established.

Recorded as a NON-FINDING in docs/adr/0010-permission-allowlist-posture.md, which forbids any surface from stating an answer until it is verified empirically against an installed Claude Code binary and the official permissions documentation.

Resolving this empirically would remove the standing reason several surfaces keep getting re-edited. It is a prerequisite for candidate primitive 2 on this specific claim, and is independently worth doing.

Linked surfaces

• docs/adr/0010-permission-allowlist-posture.md — Findings (authority home + NON-FINDING)
• docs/adr/0013-decoupled-leaf-pipeline-skills.md:31
• docs/adr/0018-declarative-workflow-state-machine.md:69
• plugin/governance/security-policy.md:124, :148
• README.md, CLAUDE.md, web/functionality.html — the three-surface grant literal
• plugin/skills/_shared/settings-merge.sh — the permission template and its NO-PROVIDER-GRANT invariant
• tools/policy_check.sh — CHECK 15
• tools/validate.sh — map_path
• tests/policy/safety-local-review-grant-single-home.json
• tests/policy/safety-permission-engine-claim-containment.json

Bounded impact — why this is deferred, not fixed now

Blast radius is documentation and CI accuracy only. Across all four iterations:

• No runtime behavior change in the shipped plugin. No public API, no packaged output, no compatibility contract.
• No security boundary. Every claim in question concerns PROMPT SUPPRESSION, never a grant or a deny. An allow-rule pre-approves and never denies; absence yields a prompt, not a refusal. A wrong doc costs a contributor one extra permission prompt.
• No data path, no user-facing surface.

Worst realistic case today: (a) a doc asserts an unverified engine behavior a contributor acts on and is mildly inconvenienced; (b) a CI guard advertises reach it does not have, so a violation authored in an unrouted doc is caught at push-to-main rather than at PR. Cycle 4 closes (b) for the .md/.html axis.

The fix-now/defer split: cycle 4 landed the four concrete correctness defects because they are bounded, verified green-safe, and each is a few lines. The structural primitive swap is deferred here because it is a design change touching a dozen surfaces plus a build/generation step, it would be the fifth structural attempt inside a patch release, and the impact it mitigates is documentation accuracy — not a defect any consumer can hit.

Residuals carried here, nothing dropped

The cluster members NOT fixed in cycle 4, all recorded above:

1. The paraphrase residual — CHECK 15 triggers on one literal token, so a restatement that never spells allowed-tools passes green. Accepted P17 non-mechanizable residue.
2. The surface-to-list comparison primitive — the actual root.
3. The open engine question.
4. A widening authored without the # CHECK15-ALLOW marker, or outside the CHECK15_ALLOWLIST array, is invisible to the line-scoped marker-anchored pin.
5. CHECK 15 neutered internally while its header, emitter and allowlist literals all stay intact.

Introduced by PR for fix/seed-hive-dead-codex-grant-a7f2 (plugin 2.40.10).