docs(limitations): merge ded-furby boundary clarifications from #155#166
Merged
Conversation
) Rebase PR #155 onto current main: keep the consolidated LIMITATIONS.md structure and add the two sharper boundary statements from @ded-furby: signing-key custody in the HMAC claim and tool invocation outside the governed path. Co-authored-by: ded-furby <190979964+ded-furby@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves merge conflicts for community PR #155 by rebasing onto current
mainand applying @ded-furby's two sharper boundary statements to the consolidatedLIMITATIONS.md:The full alternate
LIMITATIONS.mdfrom #155 is superseded by the version already onmain; this PR lands only the net-new clarifications withCo-authored-by: ded-furby.Closes #117 when merged. After merge, we will close #155 with a pointer here.
Test plan
scripts/check-claim-discipline.shNote
Low Risk
Documentation-only edits to capability boundaries; no code, auth, or data-path changes.
Overview
LIMITATIONS.mdpicks up two boundary clarifications from community PR #155 (merged into the current doc onmain):The evidence boundary now states that HMAC integrity holds only assuming the signing key remains protected, not unconditionally after signing.
The tool-governance boundary adds that Talon cannot block the same tool if it is invoked outside the gateway path.
No runtime or policy code changes—documentation and claim discipline only.
Reviewed by Cursor Bugbot for commit 1b7e975. Configure here.