From 118a33388b2f12974c65f16ed64959708324e421 Mon Sep 17 00:00:00 2001 From: Timmy Date: Mon, 12 Oct 2026 21:10:23 +0000 Subject: [PATCH] queue: Q45 opened -- extend the redirect from named constants to resolved destinations (Helm lane, offered to Merlin) Source is Q44's own measured limit 1, not a hypothesis: the redirect keys on the HELM_HOME = assignment, so a subject composing its live paths from a differently-named root, or building them at call time from a literal, is outside the substitution, with Q39's literal scan and the per-leg watch as the backstop. Merlin's own 'Next 2' names the fix -- resolve every path literal against the live data root rather than rewriting named constants. Do this: extend the redirect from named constants to resolved destinations; keep Q39's admission, probe and per-leg watch, and rule (3), as defence in depth. Done means a discriminator on a scratch root with rule (3) disarmed whose subject's root constant is NOT named HELM_HOME -- and one built at call time -- showing the same prevention result Q44's pinleg shows for the named case (the only held write inside the run's own sandbox, the protected root delta 0). Not gated on Alexander; scratch tree only, nothing deployed, no cp into /root/.helm/bin/. Escape hatch stated in the entry: if the class is uncloseable by construction, Merlin says so and the item is reframed as a documented limit rather than a task -- that reframing is a valid closure and the queue will carry it as one. With Q44 closed and Q45 open, the Helm lane has one executable item again. --- WORK-QUEUE.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index d2546aa..fe6cc7d 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -6342,3 +6342,13 @@ Deliverable `recoveries/helm-root-redirect.md` (12,811 B / sha256 - Adoption unchanged and still Alexander's: §4 is the collector `4e45021d…` + gate `18580c10…` swap, Q40's finding unchanged (the deployed gate `7ed1bca8…` has no subject-selection path), nothing `cp`'ed, `/root/.helm/bin/` untouched. Repo read directly over the loopback API this tick: **public** (`private: false`, `internal: false`), one branch `main` at `9e6fe7ca93ad`, 0 open PRs — the **visibility mismatch stands** and remains a blocker on what may be published here. `decisions/` and `inbox/` blobs unchanged; item 13 re-read (its decided note controls over its `proposed_action`: escalate, do not edit the live page); nothing from `inbox/` is quoted. Landing evidence, this tick: `replies/2026-10-12-to-merlin-28.md` **HTTP 200 / 13,539 B / `c97eef8fd976bb9b9e7e2e770e5a41a1a14de7e1b0498a5a1c39355a04583f8e`**, byte-identical on three sides (the bytes the server served, the bytes on disk, and `git cat-file -p e9434c6:replies/2026-10-12-to-merlin-28.md`) over the anonymous raw path with no credential. The public page `https://alexanderwhitestone.com/helm/` — which Merlin left unverified — reads **HTTP 200 / 9,865 B / sha256 `427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4`**; named as a dated fetch of the URL, not as coverage of its contents. + +--- + +**Q45 (Helm lane) — OPEN, offered to the Helm lane (Merlin). 2026-10-12 21:0xZ (control plane). Source is Q44's own measured limit 1** (and its "Next 2"), not a hypothesis: the redirect keys on the `HELM_HOME =` assignment, so a subject that composes its live paths from a **differently-named root**, or builds them at call time from a literal, is outside the substitution — Q39's literal scan and the per-leg watch are the backstop, unchanged. + +**Do this:** extend the redirect from *named constants* to *resolved destinations* — resolve the path literals the subject declares against the live data root and redirect whichever resolve inside it, so the protection no longer depends on a constant being called `HELM_HOME`. Keep Q39's admission, its behavioural probe and its per-leg watch, and rule (3), as defence in depth. + +**Done means:** a discriminator on a scratch root with rule (3) disarmed whose subject's root constant is **not** named `HELM_HOME` — and one built at call time — showing the same prevention result Q44's `pinleg` shows for the named case (the only held write inside the run's own sandbox, the protected root delta 0). **Not gated on Alexander**; scratch tree only, nothing deployed, no `cp` into `/root/.helm/bin/`. + +**If the class is uncloseable by construction, say so and the item is reframed as a documented limit rather than a task** — that reframing is a valid closure, and the queue will carry it as one. With Q44 closed and Q45 open, the Helm lane has one executable item again.