RAGE worker substrate: identity, cyber scope gate, and StarIntel BBP-only policy #45

Closed
opened 2026-09-02 17:24:36 +00:00 by nsaspy · 0 comments
Owner

Slice

Implement the first executable slice of #30 in Hackmode core.

Add

  • typed RAGE worker identity/run state;
  • typed work-item envelope;
  • explicit cyber-task vocabulary;
  • pure authorization/scope decision function;
  • explicit :starintel scope rule: only authorized cyber/BBP work is eligible;
  • regression tests.

Required proofs

  • ordinary StarIntel implementation/product task -> rejected as starintel-cyber-only;
  • authorized StarIntel recon/security-review/fuzzing/finding-projection task -> accepted;
  • unauthorized operation -> rejected even for a cyber task;
  • non-cyber work is rejected by this worker class generally;
  • passive/active are valid worker modes; unrelated modes are rejected for this foundation.

This is intentionally the policy/identity substrate only. Provider orchestration, graph persistence, operational KB and LISH controls remain in #27/#30 follow-on slices.

## Slice Implement the first executable slice of #30 in Hackmode core. ### Add - typed RAGE worker identity/run state; - typed work-item envelope; - explicit cyber-task vocabulary; - pure authorization/scope decision function; - explicit `:starintel` scope rule: only authorized cyber/BBP work is eligible; - regression tests. ### Required proofs - ordinary StarIntel implementation/product task -> rejected as `starintel-cyber-only`; - authorized StarIntel recon/security-review/fuzzing/finding-projection task -> accepted; - unauthorized operation -> rejected even for a cyber task; - non-cyber work is rejected by this worker class generally; - passive/active are valid worker modes; unrelated modes are rejected for this foundation. This is intentionally the policy/identity substrate only. Provider orchestration, graph persistence, operational KB and LISH controls remain in #27/#30 follow-on slices.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/hackmode#45
No description provided.