review fixup: close §M12 intra-batch bypass + authority_scope fallback

Addresses all 5 line-level findings from Gemini + Copilot on #31.

(1) Gemini SECURITY-HIGH — ADD+MUTATE intra-batch bypass (liveness.go:81):

Pre-fix: ApplyProgram ran checkLiveness (including §M12) against the
batch-initial state. A program that ADDed an ordinary node and then
MUTATEd a kernel-authority property on it bypassed §M12 because the
classifier saw the target missing from initial state and returned
false.

Fix: split liveness into two phases with different state-resolution
rules:

  - §M11 (emitter-context) runs in preflight against batch-initial
    state. Emitter references cannot depend on prior envelopes;
    initial-state-check is the documented doctrine (impl-plan §2.4).

  - §M12 (target-operation) runs per-envelope INSIDE the write-locked
    working-state loop in ApplyProgram. By the time envelope N runs,
    all nodes ADDed in envelopes 1..N-1 are visible; target
    classification is correct.

New method split in kernel/liveness.go:

  checkLivenessM11(env, state)  — emitter-context only
  checkLivenessM12(env, state)  — admin-scope only
  checkLiveness(env)            — both against rt.state (Apply helper)

ApplyProgram preflight loop calls checkLivenessM11 only; the working-
state loop adds a checkLivenessM12 call at the top of each iteration.

(2) Gemini SECURITY-HIGH — empty AuthorityScope bypass (session_context.go:333):

Pre-fix: authorityScopeForField trusted the live property's
AuthorityScope unconditionally, even when empty. An ADD that failed to
populate the metadata left the field classified as no-authority-scope
forever.

Fix: fall through to the registry type spec when the stored scope is
empty. The registry is authoritative — trust it over potentially-
missing node metadata. Same pattern the ValidateMUTATE additive path
already uses.

(3) Gemini MEDIUM — redundant kernel exclusion (session_context.go:315):

Pre-fix: case 2 had `if scope == "kernel" && node.TypeID != "kernel"`.
The kernel-type exclusion was redundant because case 1 would have
already returned true for kernel-typed nodes.

Fix: drop the kernel check. Code reads cleaner; behavior unchanged.

(4) Copilot — misleading test name (session_context_test.go:394):

TestAdminScopeRewrite_MUTATEKernelAuthorityFieldOnKernelNode_NotAdminScope
asserted admin-scope=true (via case 1). Renamed to
...MUTATEOnKernelNode_AdminScopeViaOntologyGovernedType.

(5) Copilot — misleading precedence comment (session_context.go:236):

The ontologyGovernedTypes docstring said ADD/MUTATE "requires
superadmin capability" without noting that kernel-actor and
infrastructure-bootstrap envelopes bypass §M12 via the §M11 allowlist
upstream. Added an IMPORTANT block clarifying the precedence.

Tests (4 new):

  operad.TestAdminScopeRewrite_MUTATETargetMissing_FailsClosed
  operad.TestAdminScopeRewrite_EmptyStoredAuthorityScope_FallsBackToTypeSpec
  kernel.TestApplyProgram_M12_IntraBatchADDThenKernelAuthorityMUTATE_Rejected
  kernel.TestApplyProgram_M12_IntraBatchADDThenOwnerMUTATE_Passes

Plus the existing test rename.

21 total §M12-related tests now (9 operad unit + 12 kernel integration).

go build ./...  # clean
go test ./...   # all packages pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MSD21091969

internal/kernel/liveness.go

@@ -8,7 +8,7 @@ import (
 	"moos/kernel/internal/operad"
 )
 
-// §M11 liveness gate and §M12 admin-capability hook for kernel rewrites.
+// §M11 liveness gate and §M12 admin-capability gate for kernel rewrites.
 //
 // Doctrine:
 //
@@ -18,49 +18,64 @@ import (
 //   - §M12 says admin-scope rewrites additionally require the actor (after
 //     has-occupant resolution) to hold the superadmin role via WF02 governs.
 //
-// This file integrates both checks into Runtime.Apply / Runtime.ApplyProgram
-// as small helpers so the main Apply body stays readable. §M12 is plumbed
-// here via operad.AdminScopeRewrite + operad.CheckAdminCapability and ships
-// as dormant in PR 3 (AdminScopeRewrite returns false until PR 4 fills it in).
-
-// checkLiveness is the §M11 gate. Called from Apply / ApplyProgram BEFORE
-// operad validation so we fail fast on missing session context without
-// paying structural-validation cost. Read-only over state; no locking
-// required because Apply/ApplyProgram are already serialised by rt.mu in
-// the caller (or read-lock during validation).
+// Evaluation surface:
+//
+//   - §M11 evaluates emitter-context: the session this envelope runs under.
+//     That session must pre-exist. For ApplyProgram, §M11 runs in preflight
+//     against the batch-initial state — emitter references cannot depend on
+//     prior envelopes in the same batch (see the initial-state-check
+//     doctrine note in kb/research/kernel/20260421-t171-m11-m12-implementation-plan.md §2.4).
 //
-// Order of checks:
-//  1. System-internal allowlist (sweep, kernel-actor, infrastructure ADD).
-//     These are below the governance line and always pass.
-//  2. Session-context resolution via operad.ResolveSessionForEnvelope.
-//     Explicit env.SessionURN wins; inferred from Actor when unambiguous;
-//     reject when ambiguous or absent.
-//  3. (PR 4 hook) admin-scope classification + capability check. Dormant
-//     in PR 3.
+//   - §M12 evaluates target-operation: what the envelope does. That operation
+//     can depend on nodes created earlier in the same batch. For ApplyProgram,
+//     §M12 runs per-envelope inside the working-state loop — a MUTATE on a
+//     node ADDed in envelope N-1 sees that node's type when classifying at
+//     envelope N. Closes the Gemini PR 31 security-HIGH where §M12 was
+//     evaluated against initial state and ADD-then-MUTATE could bypass the
+//     admin gate.
+
+// checkLiveness runs both §M11 and §M12 against rt.state (no working state
+// evolves). Used by Apply. The combined form is safe here because Apply
+// handles a single envelope — the target either exists at call time or it
+// doesn't, and ApplyProgram's mid-batch scenario cannot arise.
 //
-// Returns nil on pass, a fmt.Errorf wrapping the failure mode on reject.
-// Error messages name the doctrine section so log readers can trace back.
+// Caller must hold rt.mu at least for read. Returns nil on pass; a
+// fmt.Errorf naming the doctrine section on reject.
 func (rt *Runtime) checkLiveness(env graph.Envelope) error {
-	// Registry-less mode (no --ontology): liveness is a no-op. The kernel
-	// still replays and applies rewrites; it just does not enforce the
-	// occupancy invariant. Matches the existing pattern where validators
-	// short-circuit when registry is nil.
+	if err := rt.checkLivenessM11(env, rt.state); err != nil {
+		return err
+	}
+	return rt.checkLivenessM12(env, rt.state)
+}
+
+// checkLivenessM11 is the §M11 emitter-context gate. Single-phase: the
+// session URN the envelope runs under must exist in the passed state and
+// must have the actor as has-occupant (or the actor must itself be an
+// occupied session node).
+//
+// Parameter `state` is explicit so callers can choose whether to evaluate
+// against rt.state (Apply, single-envelope) or some other snapshot. For
+// ApplyProgram we always pass the batch-initial state because §M11 is an
+// emitter-pre-existence rule — emitter references cannot depend on prior
+// envelopes in the batch.
+//
+// Returns nil on pass; a fmt.Errorf for each resolver failure kind.
+func (rt *Runtime) checkLivenessM11(env graph.Envelope, state graph.GraphState) error {
 	if rt.registry == nil {
 		return nil
 	}
 
-	// Step 1 — system-internal allowlist. Sweep, kernel actors, and
-	// bootstrap-infrastructure ADDs are below the liveness line.
+	// System-internal allowlist precedes all M11/M12 enforcement. Sweep,
+	// kernel actors, and bootstrap-infrastructure ADDs are below the
+	// governance line and bypass both gates.
 	if operad.SystemInternalEnvelope(env) {
 		return nil
 	}
 
-	// Step 2 — resolve session context. Pass the live state so reverse
-	// has-occupant walks see the most recent seat assignments.
-	res := operad.ResolveSessionForEnvelope(rt.state, env)
+	res := operad.ResolveSessionForEnvelope(state, env)
 	switch res.Kind {
 	case operad.ResolveSessionExplicit, operad.ResolveSessionInferred, operad.ResolveSessionActorIsSession:
-		// Pass: a single, verified session context was resolved.
+		return nil
 	case operad.ResolveSessionExplicitMismatch:
 		return fmt.Errorf("kernel(§M11): envelope names session_urn=%s but that session is missing, not of type session, or does not have has-occupant -> actor=%s",
 			res.SessionURN, env.Actor)
@@ -71,20 +86,37 @@ func (rt *Runtime) checkLiveness(env graph.Envelope) error {
 		return fmt.Errorf("kernel(§M11): no session context for actor=%s (no has-occupant relation in state and no session_urn on envelope)",
 			env.Actor)
 	}
+	return nil
+}
 
-	// Step 3 — admin-scope gate (§M12). Classifies the envelope via the
-	// registry's AdminScopeRewrite method (sees type specs for property
-	// authority_scope lookup); if the envelope touches admin surface,
-	// the actor must hold superadmin capability via WF02 governs. Fails
-	// closed on any missing hop. The §M11 allowlist above already let
-	// kernel-actor envelopes through — they never reach this path.
-	if rt.registry.AdminScopeRewrite(env, rt.state) {
-		if !operad.CheckAdminCapability(rt.state, env.Actor) {
-			return fmt.Errorf("kernel(§M12): actor=%s lacks WF02 superadmin capability for admin-scope rewrite",
-				env.Actor)
-		}
+// checkLivenessM12 is the §M12 admin-capability gate. Classifies the
+// envelope via the registry's AdminScopeRewrite method against the passed
+// state — if classified admin-scope, the actor must hold WF02 superadmin
+// capability. The state parameter matters: for ApplyProgram, the caller
+// passes the working state AFTER earlier envelopes in the batch have been
+// folded so a MUTATE on a mid-batch-ADDed node sees the node's type
+// correctly.
+//
+// The §M11 allowlist (SystemInternalEnvelope) is re-checked here to keep
+// checkLivenessM12 safe to call in isolation — if a future caller uses it
+// without first running checkLivenessM11, kernel-actor and infrastructure
+// envelopes still bypass correctly.
+//
+// Returns nil on pass; a fmt.Errorf naming §M12 on reject.
+func (rt *Runtime) checkLivenessM12(env graph.Envelope, state graph.GraphState) error {
+	if rt.registry == nil {
+		return nil
+	}
+	if operad.SystemInternalEnvelope(env) {
+		return nil
+	}
+	if !rt.registry.AdminScopeRewrite(env, state) {
+		return nil
+	}
+	if !operad.CheckAdminCapability(state, env.Actor) {
+		return fmt.Errorf("kernel(§M12): actor=%s lacks WF02 superadmin capability for admin-scope rewrite",
+			env.Actor)
 	}
-
 	return nil
 }
 

internal/kernel/liveness_test.go

@@ -677,6 +677,95 @@ func TestSeedIfAbsent_M12_OntologyGovernedADD_BypassesBoth(t *testing.T) {
 	}
 }
 
+// TestApplyProgram_M12_IntraBatchADDThenKernelAuthorityMUTATE_Rejected
+// pins the Gemini security-HIGH fix on PR 31: a batch that ADDs a new
+// program node and in the same batch MUTATEs a kernel-authority property
+// on it previously bypassed §M12 because the preflight checker saw the
+// target missing from the batch-initial state and classified as
+// not-admin-scope. Post-fix, §M12 runs against the working state inside
+// the write-locked loop; by envelope 2, the program node exists and its
+// kernel-authority field is correctly classified admin-scope.
+func TestApplyProgram_M12_IntraBatchADDThenKernelAuthorityMUTATE_Rejected(t *testing.T) {
+	rt := newAdminRuntime(t)
+	injectOccupancy(rt,
+		"urn:moos:session:sam.a",
+		"urn:moos:agent:claude",
+		"agent",
+	) // claude occupies a session, passes §M11, no superadmin
+
+	preLen := rt.LogLen()
+
+	program := []graph.Envelope{
+		{
+			RewriteType: graph.ADD,
+			Actor:       "urn:moos:agent:claude",
+			NodeURN:     "urn:moos:program:freshly-baked",
+			TypeID:      "program",
+		},
+		{
+			RewriteType: graph.MUTATE,
+			Actor:       "urn:moos:agent:claude",
+			TargetURN:   "urn:moos:program:freshly-baked", // created in envelope 1
+			Field:       "target_t",                        // authority_scope=kernel per type spec
+			NewValue:    200.0,
+		},
+	}
+	_, err := rt.ApplyProgram(program)
+	if err == nil {
+		t.Fatalf("ADD+kernel-authority-MUTATE batch without superadmin must be rejected")
+	}
+	if !strings.Contains(err.Error(), "§M12") {
+		t.Errorf("error should cite §M12; got %q", err.Error())
+	}
+	if got := rt.LogLen(); got != preLen {
+		t.Errorf("atomic rejection should leave log unchanged; pre=%d post=%d", preLen, got)
+	}
+}
+
+// TestApplyProgram_M12_IntraBatchADDThenOwnerMUTATE_Passes confirms the
+// fix does not over-reject: a batch that ADDs a program and then
+// MUTATEs an owner-authority field on it (e.g. status) still passes §M12
+// because the mid-batch classification correctly sees the target as a
+// program (not ontology-governed) and the field as owner-authority.
+func TestApplyProgram_M12_IntraBatchADDThenOwnerMUTATE_Passes(t *testing.T) {
+	rt := newAdminRuntime(t)
+	injectOccupancy(rt,
+		"urn:moos:session:sam.a",
+		"urn:moos:agent:claude",
+		"agent",
+	)
+	// Register WF18 so ValidateMUTATE is happy.
+	rt.registry.RewriteCategories[graph.WF18] = operad.RewriteCategorySpec{
+		ID:              graph.WF18,
+		AllowedRewrites: []graph.RewriteType{graph.ADD, graph.MUTATE, graph.LINK},
+		MutateScope:     []string{"status"},
+	}
+
+	program := []graph.Envelope{
+		{
+			RewriteType: graph.ADD,
+			Actor:       "urn:moos:agent:claude",
+			NodeURN:     "urn:moos:program:ordinary",
+			TypeID:      "program",
+			Properties: map[string]graph.Property{
+				"status":    {Value: "active", Mutability: "mutable", AuthorityScope: "owner"},
+				"owner_urn": {Value: "urn:moos:agent:claude", Mutability: "immutable"},
+			},
+		},
+		{
+			RewriteType:     graph.MUTATE,
+			Actor:           "urn:moos:agent:claude",
+			TargetURN:       "urn:moos:program:ordinary",
+			Field:           "status", // owner-authority
+			NewValue:        "checkpoint",
+			RewriteCategory: graph.WF18,
+		},
+	}
+	if _, err := rt.ApplyProgram(program); err != nil {
+		t.Fatalf("owner-authority MUTATE on same-batch-ADDed program must pass §M12; got %v", err)
+	}
+}
+
 // Test 8 — fold.Replay of pre-PR-4 rewrites that would now be admin-scope
 // still replays cleanly. fold doesn't call checkLiveness, so §M12 has no
 // retroactive effect. Mirrors the prospective-only invariant for §M11

internal/kernel/runtime.go

@@ -184,16 +184,15 @@ func (rt *Runtime) applyWithOptions(env graph.Envelope, opts applyOptions) (grap
 // §M11 liveness is checked per-envelope before structural validation so a
 // single session-less envelope fails the whole batch fast.
 func (rt *Runtime) ApplyProgram(envelopes []graph.Envelope) ([]graph.EvalResult, error) {
-	// Preflight under read-lock: §M11 liveness checks read rt.state maps,
-	// so we must hold the read-lock for the entire batch preflight. Held
-	// across all envelopes so liveness observations are consistent with
-	// each other. Release before acquiring the write-lock below (RWMutex
-	// does not support upgrade). Same apply-time guarantee as Apply:
-	// fold.EvaluateProgram under the write-lock is the authoritative
-	// check; preflight rejects early on clearly-bad batches.
+	// Preflight under read-lock: §M11 (emitter-context) checks read rt.state
+	// maps, so we hold the read-lock across the entire batch preflight. §M11
+	// is evaluated against the batch-initial state — emitter references
+	// cannot depend on prior envelopes in the batch (see impl-plan §2.4).
+	// §M12 is NOT checked here; it runs per-envelope inside the write-locked
+	// working-state loop below so target-classification sees mid-batch ADDs.
 	rt.mu.RLock()
 	for _, env := range envelopes {
-		if err := rt.checkLiveness(env); err != nil {
+		if err := rt.checkLivenessM11(env, rt.state); err != nil {
 			rt.mu.RUnlock()
 			return nil, err
 		}
@@ -229,6 +228,17 @@ func (rt *Runtime) ApplyProgram(envelopes []graph.Envelope) ([]graph.EvalResult,
 		}
 		injected[i] = env
 
+		// §M12 admin-scope gate against working state. Per-envelope so a
+		// MUTATE on a node ADDed in an earlier envelope of this batch sees
+		// the node's type when classifying. Closes the PR 31 Gemini
+		// security-HIGH where initial-state preflight let a batch ADD a
+		// target and then MUTATE its kernel-authority property without
+		// triggering the admin check. §M11 preflight already ran above;
+		// if we reach here the emitter-context check has passed.
+		if err := rt.checkLivenessM12(env, workingState); err != nil {
+			return nil, err
+		}
+
 		// Strata enforcement (M5) + Gate check (M8) against the working state.
 		if env.RewriteType == graph.LINK && rt.registry != nil {
 			if err := rt.registry.ValidateStrataLink(env, workingState); err != nil {