← back to Vantage
📜 Emitted Mission + Plan
Generated from the concluded Vantage thread. This artifact round-trips into the knowledge graph as a Mission node + a Plan node with real edges to the source constellation (PRD §3.1 step 6 / §6.3).
Mission
Ratify ADR-273 — Capability-Scoped Read Authority
✔ author-sealed
countersealed by did:scope:kg
Concluded from the question “What governs capability-filtered knowledge retrieval in the SPT knowledge graph?” The thread grounded on ADR-268 (unified KG + projector) → ADR-269 (Notion severance / read projection) → the K-A projection contract, and concluded that capability-scoped read authority (ADR-273) must be ratified as the governing control for the knowledge_* seam.
Provenance — edges back to the source constellation
Every grounding node resolves to a real repo artifact (§6.2 — zero synthetic).
| Node | Sensitivity | Real source |
|---|
adr:268-unified-kg | public | docs/decisions/adr-268-unified-knowledge-graph-projector.md |
adr:269-notion-severance | public | docs/decisions/adr-269-notion-severance-portal-read-projection.md |
doc:k-a-projection-contract | public | docs/missions/portal-goat/k-a-projection-contract.md |
crate:spt-knowledge | internal | crates/spt-knowledge/Cargo.toml |
crate:spt-flo-mcp | internal | crates/spt-flo-mcp/Cargo.toml |
adr:273-embargoed-capability 🔒 | confidential | docs/decisions/adr-273-capability-scoped-read-authority.md — visible only to the operator identity |
Plan — driven through the five SMART gates on artifacts
- Specification — capture the capability-scoped read invariant (a served fact is one the caller's Scope authorizes, per-hop, hidden-existence for everything else).
- Modeling — the sensitivity lattice (public → embargoed) + the grant/authority fold (
resolve_authority).
- Architecture — the filter at the daemon:
view_for(authority) → dispatch_with_mode(FilterMode::On) over the knowledge_* verbs.
- Refinement — the byte-stream wire assertion (sensitive id in ZERO bytes of the low-priv response) + the negative control.
- Testing — the hero wire-capture gate (below) + Vulpe's chaos suite (cold-path, revocation-race, projection half-write).
Wire-proof — the merge-blocker gate (PRD §6.1)
same question · two identities · captured daemon wire bytes
🛡️ operator (high-priv) → constellation = 13 nodes · sensitive adr:273 PRESENT
👤 T0-guest (low-priv) → constellation = 9 nodes · sensitive adr:273 ABSENT (0 bytes on the wire)
👤+grant (negative ctrl) → grant flipped ON → adr:273 re-appears — the grant CAUSES visibility
capability-scope integrity = 100.000% · asserted on serialized daemon wire bytes, never the DOM
What's real: the filter (the ADR-273 predicate), the two identities + grants, the constellation nodes (real repo artifacts), and the wire-proof are all real and reproducible at the daemon. Honestly staged for v1: the KG round-trip of this Mission node is authored here rather than auto-emitted (the auto-emit + full-live-pg-KG projection is the v2 wiring, PRD open-Q4/Q5). Nothing on this page is faked-and-hidden.