Skip to content

M6 independent verification

Verdict

VERIFIED on 2026-07-27.

  • Initial implementation: 7c655e1
  • Tenant/integrity remediation: a413aa3
  • Final profile/exclusion remediation: 07f59c1
  • Focused M5/M6 tests: 34 passed
  • Complete service suite: 157 passed

Second-organization canary

Synthetic org.northstar-coop compiled a complete candidate profile using different roles, approval subjects, privacy classes, estate vocabulary, and providers. A real ControlPlane.prepare consumed profile-bound Linear and GitLab evidence plus portable core metadata. Its serialized context contained no Hector, Notion, or GitHub evidence.

Partial onboarding produced blocking gaps. Valid answers produced only non-binding candidate policy units. Wrong-typed and non-portable nested answers failed before candidate status.

Organization authorization

The plan bundle, prepared context, review artifact, authorization, execution binding, feedback, learning experiences, review cursors, candidates, listings, and proposal drafts carry or enforce organization_id.

Independent attacks confirmed:

  • cross-organization prepared sources are rejected;
  • instance corpus/adapters cannot be relabeled for another organization;
  • search, write, export, import, learning deduplication, candidate listing, and proposal drafting do not cross the organization boundary;
  • delegated subject changes do not change organization, Initiative, or pack identity.

Authenticated portability

Exports preserve stable IDs, versions, relationships, authority, privacy, and provenance. A server-held HMAC-SHA256 key authenticates each bundle. Recomputing the public digest after changing authority/content/provenance did not permit import.

Import revalidates the complete profile and resource contracts before an atomic write. The reviewer created a trusted, correctly re-signed bundle with roles changed from an array to an object; semantic validation still rejected it. Identical replay is idempotent, while conflicting stable-ID reuse fails.

Secret and local-state exclusion

Secret names and provider references remain portable; values do not. Exact review probes covering clientSecret, accessToken, authMaterial, an AWS access-key signature, .codex/instructions, .codex/skills, instructionDirectory, localInstructions, and AGENTS.md were rejected.

Organization profiles are internal configuration metadata visible only with the privileged export capability. Resource privacy filtering applies in addition and was independently reproduced.

Repository checks

  • 34 focused M5/M6 tests passed.
  • 157 complete service tests passed.
  • Profile, adapter, export, plan, context, review, authorization, feedback, experience, candidate-review, and candidate schemas execute.
  • M2 validation passed: 73 typed units and 40 complete stages.
  • Corpus/documentation coverage passed.
  • Strict MkDocs build passed.
  • Branch diff checks passed.
  • The three pre-existing _mcp_* scratch files remain untouched.

M6 exit conditions are satisfied. The M0-M6 roadmap is complete.