docs(gatekeeper): formalize operator token resolution model and calibrated 0.69 decision thresholds #2

Merged

clawdie merged 2 commits from docs/gatekeeper-token-and-thresholds into main 2026-09-23 12:57:41 +02:00

Conversation 0 Commits 2 Files changed 1 +60 -12

clawdie commented 2026-09-23 12:43:44 +02:00

Owner

Copy link

Summary

1. Operator Authorization Token Model (§4):
   • Primary: Memory-only environment variable (CLAWDIE_OPERATOR_TOKEN), leaving zero filesystem trace.
   • Secondary (secure file fallback): Cross-platform non-world-readable runtime paths (Linux /run/user/<UID>/clawdie/operator.token on tmpfs, FreeBSD /var/run/clawdie/operator.token with mode 0700 and security.bsd.see_other_uids=0 isolation).
   • Strict prohibition against storing tokens in /tmp.
2. Calibrated Decision Thresholds (§5):
   • Sets requires_operator_token >= 0.69 based on empirical 16-scenario clustering.
   • is_grounded < 0.30 hard block on hallucinations.
   • ssh_keys_in_sync < 0.30 redirect to keygen.
   • Offline fail-closed regex fallback.
3. Hook Pattern Updates (§7): Updated snippets and renumbered sections.

## Summary 1. **Operator Authorization Token Model (§4)**: - Primary: Memory-only environment variable (`CLAWDIE_OPERATOR_TOKEN`), leaving zero filesystem trace. - Secondary (secure file fallback): Cross-platform non-world-readable runtime paths (Linux `/run/user/<UID>/clawdie/operator.token` on tmpfs, FreeBSD `/var/run/clawdie/operator.token` with mode `0700` and `security.bsd.see_other_uids=0` isolation). - Strict prohibition against storing tokens in `/tmp`. 2. **Calibrated Decision Thresholds (§5)**: - Sets `requires_operator_token >= 0.69` based on empirical 16-scenario clustering. - `is_grounded < 0.30` hard block on hallucinations. - `ssh_keys_in_sync < 0.30` redirect to keygen. - Offline fail-closed regex fallback. 3. **Hook Pattern Updates (§7)**: Updated snippets and renumbered sections.

clawdie added 1 commit 2026-09-23 12:43:44 +02:00

docs(gatekeeper): add operator token resolution model and calibrated 0.69 decision thresholds 9a8a768e69

clawdie added 1 commit 2026-09-23 12:55:43 +02:00

docs(gatekeeper): calibrate is_grounded and ssh_keys_in_sync thresholds to <= 0.33 based on empirical sweep ac78af2c4f

clawdie merged commit b306394d19 into main 2026-09-23 12:57:41 +02:00

clawdie deleted branch docs/gatekeeper-token-and-thresholds 2026-09-23 12:57:41 +02:00

clawdie referenced this pull request from a commit 2026-09-23 12:57:42 +02:00

Merge pull request 'docs(gatekeeper): formalize operator token resolution model and calibrated 0.69 decision thresholds' (#2) from docs/gatekeeper-token-and-thresholds into main

clawdie referenced this pull request from a commit 2026-10-20 12:29:19 +02:00

Merge pull request 'guardrail: forbid tmux kill-server/kill-session in all sessions' (#2) from docs/syncing-upstream into main

clawdie referenced this pull request from a commit 2026-10-20 12:29:44 +02:00

feat: session naming with unique titles, auto-lineage, rich listing, resume by name

clawdie referenced this pull request from a commit 2026-10-20 12:29:44 +02:00

fix: harden session title system + add /title to gateway

clawdie referenced this pull request from a commit 2026-10-20 12:29:46 +02:00

fix(cli): dispatch /steer inline while agent is running (#13354)

clawdie referenced this pull request from a commit 2026-10-20 12:29:46 +02:00

fix(mcp): add half-open state to circuit breaker

clawdie referenced this pull request from a commit 2026-10-20 12:29:46 +02:00

ci(nix): auto-fix stale npm hashes on push to main (#16285)

clawdie referenced this pull request from a commit 2026-10-20 12:29:47 +02:00

test(send_message): cover _check_send_message gating paths

clawdie referenced this pull request from a commit 2026-10-20 12:29:47 +02:00

tui: make URLs clickable + hover-highlight in any terminal (#25071)

clawdie referenced this pull request from a commit 2026-10-20 12:29:47 +02:00

feat(codex-runtime): optional codex app-server runtime for OpenAI/Codex models (#24182)

clawdie referenced this pull request from a commit 2026-10-20 12:29:47 +02:00

fix(install.ps1): address Copilot review on #27224

clawdie referenced this pull request from a commit 2026-10-20 12:29:48 +02:00

test(streaming): pin partial-stream-stub finish_reason + continuation contract

clawdie referenced this pull request from a commit 2026-10-20 12:29:48 +02:00

fix(dashboard-auth): share /api/* public allowlist between legacy and OAuth gates

clawdie referenced this pull request from a commit 2026-10-20 12:29:48 +02:00

Add Hermes desktop app (#20059)

clawdie referenced this pull request from a commit 2026-10-20 12:29:48 +02:00

fix(docker): add /usr/bin/tini compatibility shim for legacy wrappers (#34192) (#34382)

clawdie referenced this pull request from a commit 2026-10-20 12:29:48 +02:00

fix(gateway,windows): reliability — JOB breakaway + status --deep probes + test-leak fix (#40909)

clawdie referenced this pull request from a commit 2026-10-20 12:29:49 +02:00

fix(sessions): let a compression continuation reclaim its base title

clawdie referenced this pull request from a commit 2026-10-20 12:29:49 +02:00

feat(compression): in-place compaction option that keeps one session id (#38763)

clawdie referenced this pull request from a commit 2026-10-20 12:29:49 +02:00

fix(gateway): stop per-turn agent-cache eviction from model + message_id signature churn

clawdie referenced this pull request from a commit 2026-10-20 12:29:49 +02:00

fix(delegation): route native-SDK providers through runtime resolver; fail on '(empty)' sentinel

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

feat(cli): promote Fireworks AI to #2 in the hermes model provider list (#65214)

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

fix(title): reconcile atomic auto-title writes with collision dedup retry

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

feat(desktop): promote Fireworks AI to #2 in onboarding provider picker (#66432)

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

feat(tui+cli): change your Nous plan from the terminal (/subscription, /topup, terminal-billing UX) (#51639)

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

feat(desktop): billing settings tab (#61054)

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

fix(desktop, ink): don't wipe messages before final message (#65919)

clawdie referenced this pull request from a commit 2026-10-20 12:29:50 +02:00

fix(desktop): address review — overlay a11y, e2e typecheck, nits

clawdie referenced this pull request from a commit 2026-10-20 12:29:52 +02:00

fix(curator): make the autonomous write policy consistent (#67140)

clawdie referenced this pull request from a commit 2026-10-20 12:29:53 +02:00

fix(desktop): Branch button silently does nothing inside a branched chat tile (#71969)

clawdie referenced this pull request from a commit 2026-10-20 12:29:53 +02:00

fix(cli): route keyless first run into provider onboarding instead of a broken chat

clawdie referenced this pull request from a commit 2026-10-20 12:29:53 +02:00

fix(gateway): bound the stall-notify adapter.send (re-review #2)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/hermes-bsd!2

No description provided.