From 6302dcb50ea3da43a0cc99e0c0eea968eaee603b Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Wed, 23 Sep 2026 04:45:06 -0400 Subject: [PATCH] FABRIC-3.7.md: record Phase 8 v3 closure (in-system block-copy defense) Distinguishes it clearly from the still-accepted "cloned outside StarshipOS entirely" limitation this document already settled -- Phase 8 v3 closes a narrower, different threat: cloning block content using StarshipOS's own console primitives, now refused by MOVE/CMOVE/CMOVE>/ RELOCATE-BLOCK for cross-device copies. Co-Authored-By: Claude Sonnet 5 --- FABRIC-3.7.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/FABRIC-3.7.md b/FABRIC-3.7.md index deba8630..c99187c9 100644 --- a/FABRIC-3.7.md +++ b/FABRIC-3.7.md @@ -185,6 +185,17 @@ Corrected per §2's re-read above. Concretely, when Phase 8 next picks this up: `feedback_no_knowledge_factor_identity`) — **do not revisit a knowledge-factor approach here.** Any future work in this space needs a fundamentally different mechanism (not something typed and known) or stays an accepted limitation. +- **Phase 8 v3, 2026-09-23 — done, a distinct and narrower concern from the item above.** The + "accepted limitation" above is about a drive image copied *outside* StarshipOS entirely (e.g. + imaged on an external computer) — that's still accepted, unchanged by this item. Captain Bob + separately asked to close a narrower, different threat: **cloning a device's block content + from *within* StarshipOS's own console**, using its own stock, unpinned words + (` BLOCK BUFFER 1024 MOVE`/`RELOCATE-BLOCK`). That's now closed — `MOVE`/`CMOVE`/ + `CMOVE>`/`RELOCATE-BLOCK` all refuse a same-VM, cross-device copy, verified live on all three + architectures. See `/home/rajames/.claude/plans/jiggly-cuddling-stallman.md`'s "Phase 8 v3" + section for the full design and verification record. The identity record itself + (seed/pubkey/cert) was already unreachable from FORTH before this — this closes the one real + gap the research found: ordinary block content, not the identity record. ## 5. What this document is not