The onboarding chain gets a spine: its own model, and a delegation that cannot defeat it - #116

Merged

satvikOS merged 21 commits into

mainfrom

feat/onboarding-proposal-chain

Aug 21, 2026

Commits on Aug 21, 2026

Schema: OnboardingProposal and its append-only event log

satvikOS
and
claude
committed
188d39d
The onboarding chain gets a spine: store, delegation-safe actor, expiry

satvikOS
and
claude
committed
a0d2006
Register the models, pin the counts, resolve ADR-0013

satvikOS
and
claude
committed
2ad6314
ADR-0015, the index, and the ledger counts

satvikOS
and
claude
committed
9b0b78f
One implementation of R3, found by a negative control

satvikOS
and
claude
committed
93ba83d
Refusing a cross-tenant proposal must not write in the other tenant's log

satvikOS
and
claude
committed
7a0fe42
The deferred half is ADR-0009, which already owns it

satvikOS
and
claude
committed
2860a80
Say which cohort figures this repository can check, and which it cannot

satvikOS
and
claude
committed
d50c810
Say which of the grain figures this repository can actually check

satvikOS
and
claude
committed
8636dcb
Re-measure the grain figures from the workbook the repo actually tracks

satvikOS
and
claude
committed
a570d91
Say why there is no domain check, so nobody adds one

satvikOS
and
claude
committed
673ca26
Adversarial suite against a real database, and the three refusals it does not get
satvikOS
committed
fe1839b
The refusal audit, the address, the enumeration and the brand
claude
committed
30aaaab
Tests for each of them, and the control that missed the realistic leak
claude
committed
1749935
A compile-time control for the mint
claude
committed
5cd78ac
Keep the roster out of the fixtures, and the tenant out of a new file
claude
committed
00a5158
An outsider learns nothing from which refusal comes back
claude
committed
b07d03c
Merge origin/main into the onboarding proposal chain
claude
committed
22940ae
Merge remote-tracking branch 'origin/main' into pr116-merge-agent
claude
committed
ba5e488
Merge remote-tracking branch 'origin/main' into HEAD
claude
committed
499a614
Merge branch 'main' into feat/onboarding-proposal-chain
satvikOS
authored
7076da6

Navigation Menu

Uh oh!

The onboarding chain gets a spine: its own model, and a delegation that cannot defeat it - #116

The onboarding chain gets a spine: its own model, and a delegation that cannot defeat it#116
satvikOS merged 21 commits into
mainfrom
feat/onboarding-proposal-chain

Commits on Aug 21, 2026

Schema: OnboardingProposal and its append-only event log

The onboarding chain gets a spine: store, delegation-safe actor, expiry

Register the models, pin the counts, resolve ADR-0013

ADR-0015, the index, and the ledger counts

One implementation of R3, found by a negative control

Refusing a cross-tenant proposal must not write in the other tenant's log

The deferred half is ADR-0009, which already owns it

Say which cohort figures this repository can check, and which it cannot

Say which of the grain figures this repository can actually check

Re-measure the grain figures from the workbook the repo actually tracks

Say why there is no domain check, so nobody adds one

Adversarial suite against a real database, and the three refusals it does not get

The refusal audit, the address, the enumeration and the brand

Tests for each of them, and the control that missed the realistic leak

A compile-time control for the mint

Keep the roster out of the fixtures, and the tenant out of a new file

An outsider learns nothing from which refusal comes back

Merge origin/main into the onboarding proposal chain

Merge remote-tracking branch 'origin/main' into pr116-merge-agent

Merge remote-tracking branch 'origin/main' into HEAD

Merge branch 'main' into feat/onboarding-proposal-chain