spec(profile): explicit Keld legacy profile key — one location, parse into admit(Legacy), ProfileState↔AuthorityProfile mapping, forfeit printing, unverified unscoreable by design #586

Generated by an AI agent (Claude Code) on behalf of @0monish during Wayfinder charting of the Electron compatibility program; rewritten 2026-10-07 by the doctrine-audit repair pass (change log at the end). Planning only — no implementation is authorized by this issue.

Parent

Epic #501 · Map #391 · Unit X03 · Kind: spec · Tier: Tier 1 · Maturity target: L0 · Size: S · Milestone: first-proof

What to build

Write the KEL-78 spec amendment that creates the profile key. The first proof runs draw.io 'under an explicitly declared legacy profile', and KEL-78 says the key 'does not exist today'.

The spec decides:

• one location for the key. This is the single owner question: keld.permissions.jsonc or the Keld app config. Recommendation: keld.permissions.jsonc, because arch 06 gives it the capability subset and the key changes authority, not lifecycle.
• the grammar profile: "strict" | "legacy";
• that Electron sandbox/appSandbox, fuses, package names and architecture never set the key;
• the mapping keld-guard ProfileState Legacy → evidence authority_profile legacy_sandbox_off;
• that unverified has no evidence value and is unscoreable by design (no enum addition);
• forfeit printing on the build, doctor and scoreboard surfaces (the KEL-78 T6 table);
• the implementation slice (X03-T7) with its gates.

Adjacent atoms owned elsewhere:

• migrate writing the key only after user acceptance is X02's (KEL-17 Done; migrate is unowned in Linear).
• strict admission itself is KEL-78's T-series.
• X02-T1 (the migrate key→owner table) and X02-T3 (the hand-authored draw.io artefact) consume the location this spec selects and are blocked by it. Neither pre-decides the file; X02-T1's profile row names X03-T5 (spec) and X03-T7 (implementation).

Acceptance criteria

• The spec is approved by exact content. It names one key location, the grammar, and the rule that no Electron option or package name selects a profile.
• The spec states the mapping legacy → legacy_sandbox_off and that undeclared (unverified) apps produce no scoreable record.
• The spec's test plan contains three fixtures: a config with the key reaches admit() as Legacy; a config without it is reported unverified; Electron sandbox:false with no key is never legacy.
• The spec names X03-T7 as the implementation slice with permission-model and public-API gates.

Negative controls (each names the one mutation that must fail)

• A draft that derives legacy from Electron sandbox:false is rejected under the KEL-78 rule.
• A draft that adds unverified to the evidence authority enum is rejected.

External predecessors (outside this tracker)

• The KEL-78 spec has no task for the key. Nearest is task T6 (doctor/build/release surfaces), which is unchecked. First action: add the key slice under KEL-78 (In Progress, GYLDLAB, Linear fetched 2026-10-07) via the workflow Agent-claim comment.

Ownership and gates

• Tracker of record: Linear KEL-78 (In Progress) — claims, status and handoffs happen there; this GitHub issue is the planning record and is linked from it. Basis: KEL-78 (In Progress, assignee GYLDLAB, fetched 2026-10-07) acceptance: 'sandbox-off legacy tier is explicit in build output, doctor, scoreboard and release metadata and forfeits the zero-authority claim.' Delegated direction: 'Preserve the explicit existing legacy profile as a disclosed exception. N
• Blocking edges: native GitHub blocked-by links on this issue (open blockers only: none, so it can start immediately)
• Linear owners and predecessors (repair-time analysis; statuses as fetched 2026-10-07): KEL-78 (In Progress, assignee GYLDLAB; Linear, fetched 2026-10-07)
• Review gates: permission model, public API
• Platforms: Platform-neutral spec. The first fixture runs on macOS.
• Electron members covered: —

The authoritative agent contract is the latest Agent Brief comment on this issue (triage skill); this body is the planning record.

Out of scope

Strict admission and the per-OS archive (KEL-78 T2–T5). The migrate UX (X02). Per-role profiles (legacy primary + strict addon worker), which stay a not-yet-specified question.

Notes

Owner-only question: key location, with the recommendation keld.permissions.jsonc. Falsifier for the recommendation: arch 06 or KEL-78 assigns authority-changing keys to the app config.

Change log (doctrine-audit repair, 2026-10-07)

• New ticket. The first proof depends on an explicit legacy key that does not exist and that no open task names (refuter invariants A4 correction and extra finding; semantics A4 sequencing edge).
• Records ProfileState↔AuthorityProfile mapping and 'unverified unscoreable by design, no enum workaround' (refuter invariants A4 consequence and extra finding on the two enumerations).
• Owner is KEL-78 with live status; KEL-15/KEL-19 removed as owners (refuter A4 both lenses; Linear fetched 2026-10-07).
• The decision packet's one remaining question (key location) carries a recommendation (task rule on user-owned decisions).
• Recorded X02-T1 and X02-T3 as consumers blocked by this spec's key-location choice, so neither pre-decides keld.config.ts (cross-check finding 4 (X02-T3 pre-decides the X03-T5 key location)).