statecraft.
Catalog/aicortex

013-write-gate-and-redaction

The write gate: refuse secrets, cap size, establish origin, quarantine the rest

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Everything that enters the store passes one gate, and the gate runs before the transaction opens. It refuses credentials rather than redacting them, because a redacted secret is still a secret that was transmitted, stored in a log, and possibly embedded. It caps size, requires an establishable origin, and quarantines rather than admits when origin is doubtful. Every refusal is a ledgered Decision with a reason code and never the offending content. The rule set is data, the corpus of fixtures is committed, and the gate is a pure function so its verdicts are reproducible in review.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/Cargo.toml"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/lib.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/candidate.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/normalize.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/rules.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/secrets.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/limits.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/src/verdict.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/tests/gate.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/tests/capture.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/tests/common/"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/tests/compile_fail/"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-gate/testdata/corpus/"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/aicortex-store/src/decision_key.rs"
}
  • extends
    {
  "nature": "additive",
  "spec": "010-chassis-adoption-and-workspace",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "011-memory-model",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-types/src/provenance.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "011-memory-model",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-types/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/Cargo.toml"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/src/memory_repo.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/src/migrations.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/src/provenance_repo.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/tests/repo.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/tests/schema.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "012-store-schema-and-repositories",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/tests/common/"
  }
}
  • constrains
    {
  "flavor": "invariant-freeze",
  "note": "no insert path exists that has not passed a Verdict",
  "unit": {
    "kind": "file",
    "path": "crates/aicortex-store/src/memory_repo.rs"
  }
}

Source headings

  1. 013: The write gate
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. Verification

Frozen anchors

No frozen anchors declared.