loom/externals
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

confidentiality does not travel with the copy

Browse Source 
loom saw it while arranging access to a private cluster repository: then you would
have a file from a private repo in your repository, and that does not sound
kosher. It is not, and it is a hazard this convention creates by construction.

Adopting is copying, so a document from a repository somebody may not read ends up
in one they may, and the publisher loses control at the moment of adoption because
visibility is governed by the consumer's repository rather than theirs. Nothing in
a tree marks a copy as having come from somewhere private — a credential lets you
read and does not let you redistribute, and this convention had no way to say so.

Two ways out. Reference-only: record the lock, fetch on demand, keep no copy,
giving up offline reading which is most of what a copy is for. Or ask them to
publish, which is usually right because the thing you needed was almost certainly
not the confidential part — a repository that must stay private can have a public
sibling that publishes, and the split follows a line that already exists, since
the operational tree is what is sensitive and the pages telling somebody what to
decide are not.

Recorded as a rule rather than a case because the failure is silent and one-way:
once copied into a public tree it is published, and no later fix retrieves it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
jeffry
2026-09-07 15:09:47 -04:00
co-authored by Claude Opus 5
parent aff2065297
commit 544f895920
2 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.loom/event-log.md
+31
View File
@@ -103,3 +103,34 @@ twice and rejected twice.*
*Seven of the eight were byte-identical to upstream, so this host's raw serving
normalises nothing — **which is a fact about this host and not a licence.***
---
**Decided** (2026-09-07, loom + claude-substrate — `discovered`, `cart: marmalade`):
**do not adopt from a source less readable than the repository you are adopting
into.** *Reference-only, or ask them to publish.*
**Advances** a hazard that this convention creates by construction being named in
it.
**Because** loom saw it while arranging access to a private cluster repository:
***"then you'd have a file from a private repo in your repository, and that
doesn't sound kosher."*** **It is not.**
> **Adopting is copying, and confidentiality does not travel with the copy.**
> *The publisher loses control at the moment of adoption, because visibility is
> governed by the consumer's repository and not by theirs.*
**Nothing in a tree marks a copy as having come from somewhere private.** *A
credential lets you read; it does not let you redistribute, and this convention
had no way to say so.*
*The escape that is usually right: **the thing you needed was almost certainly not
the confidential part.*** **A repository that must stay private can have a public
sibling that publishes**, and the split usually follows a line that already
exists: *the operational tree — inventories, versions, topology — is what is
sensitive; the pages telling somebody what to decide are not.*
*Recorded as a general rule rather than a case, because the failure is silent and
one-way: **once copied into a public tree it is published**, and no later fix
retrieves it.*