mirror of
https://github.com/microsoft/BCQuality.git
synced 2026-10-05 22:56:55 +01:00
9e5273443f
Implements every confirmed finding from the workflow-based audit of CURABIS Standard's agent model (7 finders + adversarial verification, 8 confirmed / 5 refuted): 1. Roemer/Florence phantom wiring - roemer.agent.md claimed Florence's heartbeat "may summon me when a ward smells of drift" with nothing in florence.agent.md or HEARTBEAT.md implementing it. Fixed by adding an explicit "Kald Roemer" instruction to HEARTBEAT.md ward 6 (agent visibility, his actual domain), mirroring ward 8's existing "Kald Weber" pattern, and correcting roemer.agent.md's own claim to match. 2. m365.agent.md's "Florence's morning brief pattern" was a one-way orphaned reference - a full 4-step pattern with nothing in florence.agent.md implementing it. Added it to florence.agent.md as an explicit on-demand capability, separate from the timestamp-gated Round protocol. 3. An Ergasterion "PROCEED WITH CHANGES" ruling had no way to be checked against the eventual diff - al-review's checklists never referenced it. Added ERGASTERION_RULING to the [CURABIS-STATE] vocabulary, wired Ergasterion to write it, and added a BLOCKing checklist item to al-review's Titus checklist that verifies required changes were actually implemented. 4. curabis-task-state-check.yml was headered "Deterministic enforcement (not LLM diligence)" but only checks checkbox order, only blocks anything if a human separately enabled branch protection (never verified anywhere), and doesn't exist at all for the PTE track. Corrected the header's claims and added Roemer station 14 to verify branch protection is actually configured. 5. Mode C's only safeguard against a support user reaching Curabis/QualityHub was a single manual eyeball check with no re-check ever. Strengthened Step 2 to cover team-inherited and org-default access paths, added an append-only support-user registry, and added Roemer station 15 to periodically re-verify every registered user against it. 6. Columbo's persona was presented as genuine autobiography with no disclosure of its fictional TV origin (Levinson & Link, Peter Falk), unlike Smiley which discloses explicitly. Added a reader-facing editorial note - never something Columbo says aloud, since unlike Smiley he actually performs the persona to customers.
14 lines
766 B
Markdown
14 lines
766 B
Markdown
# Support users onboarded via Mode C
|
|
|
|
Append-only registry of every Mode C (support-profile) onboarding — see
|
|
`curabis-standard.agent.md`'s MODE C section, Step 2.4. Never delete or edit
|
|
a row after the fact; if a user's access is later revoked or their profile
|
|
changes (e.g. promoted to full developer access), add a new row noting the
|
|
change rather than removing the original entry. This is what Rømer's
|
|
inspection round station 15 reads to periodically re-verify that every
|
|
support user still has no `Curabis/QualityHub` access and no Write+ role
|
|
anywhere — a registry with silently edited history defeats that check the
|
|
same way an edited `[CURABIS-STATE]` comment would.
|
|
|
|
| Name | GitHub-brugernavn | Dato | Tildelte repos | Status |
|
|
|---|---|---|---|---|
|