From 8b359dbf50115a9a1e4cbb4a1b04ac4f0fd5dda3 Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Tue, 15 Sep 2026 17:51:13 +0100 Subject: [PATCH 1/2] chore: file the interview-context intent and close the openpgp advisory finding itd-2609151541116052 is a draft refining itd-201: every question an interview puts to a human shows the thing being decided before it asks, at every step. Routed at an interactive question as a new intent rather than an amendment of itd-201 or a bare rule. iss-2609151542247232 records GHSA-6xpc-3w4h-frfh, the govulncheck notice on golang.org/x/crypto/openpgp, traced as unreachable: the binary imports no openpgp package, x/crypto is indirect through minisign and selfupdate, and the symbol-level scan is clean. Closed as won't-fix so the draft advisory can be closed against it. Assisted-by: Claude:claude-fable-5-1 --- ...d-interview-puts-to-a-human-shows-the-t.md | 43 +++++++++++++++++++ ...raft-govulncheck-go-2026-5932-reports-g.md | 19 ++++++++ 2 files changed, 62 insertions(+) create mode 100644 .abcd/development/intents/drafts/itd-2609151541116052-every-question-an-abcd-interview-puts-to-a-human-shows-the-t.md create mode 100644 .abcd/work/issues/wontfix/iss-2609151542247232-ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g.md diff --git a/.abcd/development/intents/drafts/itd-2609151541116052-every-question-an-abcd-interview-puts-to-a-human-shows-the-t.md b/.abcd/development/intents/drafts/itd-2609151541116052-every-question-an-abcd-interview-puts-to-a-human-shows-the-t.md new file mode 100644 index 00000000..1807fb0d --- /dev/null +++ b/.abcd/development/intents/drafts/itd-2609151541116052-every-question-an-abcd-interview-puts-to-a-human-shows-the-t.md @@ -0,0 +1,43 @@ +--- +id: itd-2609151541116052 +slug: every-question-an-abcd-interview-puts-to-a-human-shows-the-t +spec_id: null +kind: null +suggested_kind: null +reclassification_history: [] +builds_on: [] +severity: minor +impact: additive +origin: researcher-authored +production_mode: dictated-and-formatted +--- + +# Every question an abcd interview puts to a human shows the thing being decided before it asks: the acceptance criterion's full text before asking whether it stands, the press-release paragraph before asking to confirm or refine it, the open question before asking to resolve or defer it, the mechanism and scope-condition text before asking about them, at every step of every interview + +## Press Release + +> _Seeded from a quoted-text intent capture. Expand into the full press-release narrative before planning._ + +## Why This Matters + +Every question an abcd interview puts to a human shows the thing being decided before it asks: the acceptance criterion's full text before asking whether it stands, the press-release paragraph before asking to confirm or refine it, the open question before asking to resolve or defer it, the mechanism and scope-condition text before asking about them, at every step of every interview + +## Mechanism + +> _Prompted (the claim-recording gradient): why the authors expect this to work, as a falsifiable "we expect X because Y" — not the outcome restated. Replace this line with the claim, or with the exact token `None stated.` alone on its line to record the claim as considered and declined._ + +## Scope Conditions + +> _Required (the claim-recording gradient): the population, platform, scale, or assumptions this claim holds under, one per top-level bullet — `abcd intent plan` stamps each with a persistent identity. Replace this line with those bullets, or with the exact token `None stated.` alone on its line._ + +## Acceptance Criteria + +> _Required (the itd-1 discipline): add at least one Given-When-Then bullet describing the verifiable bar for "shipped" before this draft can be planned._ + +## Open Questions + +_None recorded yet._ + +## Audit Notes + +_Empty. Populated by intent-auditor when intent moves to shipped/._ diff --git a/.abcd/work/issues/wontfix/iss-2609151542247232-ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g.md b/.abcd/work/issues/wontfix/iss-2609151542247232-ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g.md new file mode 100644 index 00000000..0382f5eb --- /dev/null +++ b/.abcd/work/issues/wontfix/iss-2609151542247232-ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g.md @@ -0,0 +1,19 @@ +--- +schema_version: 1 +id: "iss-2609151542247232" +slug: "ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g" +severity: "minor" +category: "security" +source: "agent-finding" +found_during: "security-advisory triage 2026-09-15" +origin: researcher-authored +production_mode: hand-written +found_at: "go.mod" +wontfix_reason: "The package is not in the binary: no import of golang.org/x/crypto/openpgp exists, x/crypto is indirect through minisign and selfupdate, and govulncheck's symbol scan is clean. The advisory is a module-level duplicate of a govulncheck candidate and closes against this record." +--- + +GHSA-6xpc-3w4h-frfh (draft, govulncheck GO-2026-5932) reports golang.org/x/crypto/openpgp as unmaintained and unsafe by design. Traced on main at 44261a68: the main module imports no openpgp package (go mod why: the main module does not need it; go list -deps finds zero openpgp packages), golang.org/x/crypto v0.55.0 is an indirect dependency reached only through internal/core/update via minio/selfupdate and aead.dev/minisign (blake2b), and govulncheck's symbol-level scan reports zero vulnerabilities the code calls, with the module-level notice covering only packages the binary never links. The advisory's own status field marks it a duplicate of the govulncheck candidate. Nothing in the tree uses the package, so there is nothing to replace or remove; the finding is recorded so the draft advisory can be closed against it. + +## Grounds + +- declined: replacing or removing a dependency the binary never links would change nothing the scan measures; if a future dependency pulls openpgp into the link, govulncheck's symbol scan in CI is what would show this record wrong From 3822d95829f6190b0da2f2306ced48fbc1ce11bf Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Tue, 15 Sep 2026 17:51:59 +0100 Subject: [PATCH 2/2] docs: list the interview-context draft in the later-phase index Assisted-by: Claude:claude-fable-5-1 --- .abcd/development/brief/06-delivery/03-out-of-scope.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.abcd/development/brief/06-delivery/03-out-of-scope.md b/.abcd/development/brief/06-delivery/03-out-of-scope.md index 7f6cb97f..c9c65946 100644 --- a/.abcd/development/brief/06-delivery/03-out-of-scope.md +++ b/.abcd/development/brief/06-delivery/03-out-of-scope.md @@ -108,6 +108,7 @@ gate. That is what keeps "not hand-counted" true after the day it was written. - `itd-175` — The product thinker writes down how this could be wrong, and what would show it (Phase 8; the defeater list an acceptance rests on) - `itd-176` — Whatever ships says how hard anyone looked at it (Phase 7) - `itd-201` — every question abcd's agents put to a human is asked one at a time, in plain language, in the addressee's register, with options that widen +- `itd-2609151541116052` — every question an interview puts to a human shows the thing being decided before it asks, at every step (refines itd-201) - `itd-2609091014076309` — Session and agent worktrees live in a machine-scoped store (`~/.abcd/worktrees///`) that abcd lists and reclaims, never beside the user's own projects (the rule is adr-2609091248200336; `builds_on` itd-118, whose worktree clause it supplies the store and the reclaim verb for) - `itd-2609091416295622` — A session sees the records its sibling worktrees hold before it mints or fixes one: a read-only ledger diff over `git worktree list --porcelain` (open there and absent here; open here and terminal there), a line on the `/abcd` board and on the record dispatch, no claim and no write (split from itd-2609091034175565 on the maintainer's ruling of 2026-09-09; the shippable piece) - `itd-2609091416304128` — `capture resolve` and `capture wontfix` refuse a record already terminal at the local `origin/main` ref as last fetched, stating the ref's age and performing no fetch; the same judgement rendered read-only on `abcd ` (split from itd-2609091034175565 on the same ruling; the third clause of iss-2609020716570699's remedy, RS001's answer moved earlier)