07 — The first compiled mandate
Summary
Build-order step 1, built. A mandate authored deliberately narrower than the measured grant — permitting pushes to claude/** while the library entry records that the environment can also push to dev, the branch that deploys a public site — compiled into a pre-push hook that git runs and that refuses by exit code. The acceptance test was executed: the push produced error: failed to push some refs, origin/dev was unchanged, and a permitted push in the same minute succeeded, so the refusal came from git rather than from the agent deciding to comply. The tier reached is stated rather than claimed: setting, not boundary, because the hook is inside the grant it bounds and --no-verify still gets past it — exactly the tier-three-to-tier-two move the brief predicted and no further. Two findings the exercise produced that no diagram would have: within the hour the control refused the release that was carrying it, and the correct remedy was the issuer amending the mandate rather than any bypass; and the measurement tool, re-run afterwards, independently caught its own tier change.
Key concepts
- Refused by something that is not the agent — the acceptance test's last sentence, and the only part that could not be faked
- Setting, not boundary — the hook is inside the grant it bounds — the banner says so on its own face
- Amend, never bypass — v1 was wrong because it was narrower than the authorisation that existed
Key ideas
- The hook reads the mandate at runtime rather than compiling a copy, so policy and enforcement point cannot drift.
- Default-deny: a missing, unparseable, mis-signed or expired mandate all refuse — a control that fails open is not a control.
- An expectation that was too narrow would have been silently ignored; the refusal is what forced the authorisation to be written down.
- The authority is a fixture and the enforcement is not — a hook enforcing a fixture-signed mandate is real enforcement of an unaccountable instruction.