Skip to content

Commit 40f7ae2

Browse files
authored
docs: add example trace with gate
1 parent 671755e commit 40f7ae2

1 file changed

Lines changed: 49 additions & 0 deletions

File tree

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
EXECUTION BOUNDARY LAB — Trace With Gate (Selective)
2+
=====================================================
3+
4+
Gate: SelectiveGate (denies writes to /shared, allows all else)
5+
6+
7+
Case: contaminated_case_1 (Implicit Authority Escalation)
8+
---------------------------------------------------------
9+
[0001] GATE: verdict=DENY | {'operation': 'write', 'target': '/shared/config.yaml'}
10+
11+
Result: {"status": "blocked", "verdict": "DENY"}
12+
Outcome: Gate blocked write to /shared path. No state mutation occurred.
13+
14+
15+
Case: contaminated_case_2 (Hidden Default Scope Expansion)
16+
----------------------------------------------------------
17+
[0001] GATE: verdict=ALLOW | {'operation': 'delete', 'target': '/temp'}
18+
[0002] EXEC_START: op=delete target=/temp
19+
[0003] DELETE: deleted /temp | {'recursive': True}
20+
[0004] EXEC_END: op=delete result=ok
21+
22+
Result: {"status": "ok", "deleted": "/temp", "recursive": true}
23+
Outcome: SelectiveGate does not check recursive scope — a more complete
24+
gate implementation would HOLD or DENY this case.
25+
26+
27+
Case: clean_case_1 (Control — No Contamination)
28+
------------------------------------------------
29+
[0001] GATE: verdict=ALLOW | {'operation': 'write', 'target': '/user/local/notes.txt'}
30+
[0002] EXEC_START: op=write target=/user/local/notes.txt
31+
[0003] WRITE: wrote to /user/local/notes.txt | {'content': 'meeting notes'}
32+
[0004] EXEC_END: op=write result=ok
33+
34+
Result: {"status": "ok", "wrote": "/user/local/notes.txt"}
35+
Outcome: Clean bundle passed gate. Execution proceeded. State consistent.
36+
37+
38+
Summary
39+
-------
40+
With gate present:
41+
- contaminated_case_1: BLOCKED (DENY)
42+
- clean_case_1: ALLOWED
43+
44+
The selective gate demonstrates partial coverage. A production-grade gate
45+
would evaluate all six contamination categories defined in SPEC.md.
46+
47+
This trace illustrates the architectural difference:
48+
Without gate: 6/6 contaminated cases corrupt state.
49+
With gate: Blocked cases produce zero state mutation.

0 commit comments

Comments
 (0)