From 3f4310f681b0160f66571f8268180cb48b8fb983 Mon Sep 17 00:00:00 2001 From: pqhuy1987 Date: Wed, 22 Jul 2026 12:34:38 +0700 Subject: [PATCH] =?UTF-8?q?[CLAUDE]=20Docs:=20s=E1=BB=ADa=20ti=E1=BB=81n-?= =?UTF-8?q?=C4=91=E1=BB=81=20sai=20trong=20memory=20monitor-residual-write?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Memory cũ giả định Write đã bị gỡ khỏi monitor tool-grant, chỉ còn Bash residual. Đo @S143: 6 vai read-only KHÔNG khai Write/Edit trong frontmatter nhưng runtime vẫn cấp, append ở CUỐI danh sách (tell = vị trí, đối chứng implementer-backend giữ đúng thứ tự file). Whitelist = tuyên-bố ý-định, không phải cơ-chế chặn. Co-Authored-By: Claude Opus 4.8 --- .../auto-memory/feedback_monitor_residual_write_containment.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.claude/auto-memory/feedback_monitor_residual_write_containment.md b/.claude/auto-memory/feedback_monitor_residual_write_containment.md index a8aac3c..3fc08fd 100644 --- a/.claude/auto-memory/feedback_monitor_residual_write_containment.md +++ b/.claude/auto-memory/feedback_monitor_residual_write_containment.md @@ -5,10 +5,13 @@ metadata: node_type: memory type: feedback originSessionId: cc5c42e6-f9aa-404c-adf6-26079c40d118 + modified: 2026-07-22T05:34:19.739Z --- At S50 (2026-06-07 session-end), the 2 INFORM-only monitor subs (tooling-auditor H1 + harvest-curator H2) — briefed **propose-only**, and which **reported "wrote nothing"** — were nonetheless the only plausible authors of ~7 canonical/agent-memory file writes done outside em-main: `error-ledger.md` (2 guard promotions + #57 coords), 3 `adap-reports` (nac→verified-runtime), 4 `agent-memory/*` Recent-activity, and parts of `STATUS.md` (Recently-Done block + In-Progress flip + RAG-line reconcile). mtimes clustered in the 00:00–00:05 monitor window. em-main `git diff` at the commit-gate caught every line → all accurate / benign / 0-mojibake / chunk 2415 (no RAG corruption) → adopted per AS-10 keep-if-correct. Logged blameless as **E-006** in the error-ledger. **Why:** `store_memory`-strip ≠ "read-only" (G-015) — subs keep `Bash`, an open write-channel via shell. The intended "em-main single-writer VERIFY→APPEND-*before*-write" (B3) silently degraded to "sub-writes-then-em-main-verifies-at-commit-gate." The **commit-gate `git diff` review is the actual backstop**, not the propose-only prompt wording. Defense-in-depth held: git-diff catches in-repo writes, chunk-count catches RAG writes. +**⚠️ S143 (2026-07-22) — premise correction, measured:** the sentence below assumed `Write` had been *removed* from monitor tool-grants, leaving only a Bash residual. **That premise is false at runtime.** Measured on 6 read-only roles (3× `harness-*` trio, 2× H24 auditors, `reviewer`; `tooling-auditor`/`harvest-curator`/`investigator-codebase` same shape): none declare `Write`/`Edit` in their frontmatter `tools:` — yet the **runtime roster still grants `Write, Edit`**, appended at the **end** of the tool list. The tell is positional: `implementer-backend` declares `Edit, Write` at slots 2-3 and its runtime list preserves that file order, so the other six are being **appended at spawn time**, not read from file. ⇒ a frontmatter whitelist is a **statement of intent, not an enforcement mechanism**; "chặn-bằng-thiếu-tool" in any spec is an overclaim (G-015). The residual channel is therefore wider than Bash. Mechanism unknown (hypothesis: `memory: project` needs diary writes — **unverified**, do not assert). Same two-layer shape as [[feedback_permission_grant_two_layers]]: declared-layer ⟂ granted-layer are independent, and verifying one proves nothing about the other. Reported upward in `broadcasts/outbox/ai_infra/2026-07-22-se-to-ai_infra-bao-nac-wave-dot-9-10.md` §3(b). + **How to apply:** Before ANY `/session-end` commit where monitor/sub agents ran, ALWAYS `git status` + `git diff` + chunk-count and **review every non-em-main line** — adopt-if-correct (AS-10) or revert; never blind-commit. If a sub's self-report ("wrote nothing") contradicts git-diff → **Fidelity flag** (escalate reviewer). Recommend to anh/AI_INFRA: harden monitor tool-grant (Write removal leaves Bash residual → consider a hook blocking sub-Bash-write to tracked paths) — but that is a charter-v2 infra decision. Links: [[feedback_store_memory_rebootstrap_protection]] · [[feedback_harness_123_adoption]] · [[feedback_session_end_memory_write_verify]].