I3152 — Every known route around the preflight and the edit guard is a case or a stated limit
Enumerate the routes around entry and the edit guard (hooks disabled, a client without hooks, raw git, MAJORDOMUS_NO_BUILD, a missing executable, another machine) and give each a case that proves the refusal or a line in SECURITY.md's limits, held together by a structure check.
BLOCKED wave 0 · p3 · verification profile · parallel safe
Blocked. This issue cannot start until milestone:entry-proves-what-it-handed is done. The status is derived from that, not declared.
Objective
Enumerate the routes around entry and the edit guard (hooks disabled, a client without hooks, raw git, MAJORDOMUS_NO_BUILD, a missing executable, another machine) and give each a case that proves the refusal or a line in SECURITY.md's limits, held together by a structure check.
Why
The 2026-09-10 governance pack asked for a red-team bypass hunt. SECURITY.md lists three limits; the inventory records the edit-guard shim fails open on a missing executable and on MAJORDOMUS_NO_BUILD=1, which SECURITY.md does not list. Sources: chatgpt-majordomus:c103#5.
Current state
Cases exist for some refusals (I2735 edit guard, I2289 off-mesh task); the list is not joined to SECURITY.md.
Desired state
A declared route list where each route names its case or its limit line.
Scope
- SECURITY.md
- .ai/repo/ci/gates.yaml
- apps/majordomus-cli/tests/guard_hook.rs
- .ai/repo/automation/inventory.jsonl
Out of scope
- Closing a limit that a local tool cannot close
Dependencies
None. This issue is a root of the graph.
Acceptance criteria
- Each route names a case or a SECURITY.md line
- A route with neither fails the check
- Each new case named here takes its number from `scripts/case-numbers next` and is announced on the board before the file is written (ADR 0053); a case number written in this record before that is provisional
Validation
- cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test guard_hook
- bash test/run.sh 365_new_shell_is_refused
Evidence required
- case_bypass_routes_are_declared
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I3152.yaml. Read it back with majordomus plan show I3152.