[arcavenai]

This records, in the design that already limits what marvel's file copy can reach, the bound on a scheduled publish verb the operator ruled in. Left unwritten, such a verb could later be built to read whatever its own configuration names, which would undo the containment cp was ruled on.

The change adds one section, 9a, to docs/design/marvel-cp.md, after the section that records R1 to R4. It is design text only, with no code and no renumbering. It records Desk card fileshare-3 (2026-11-02, option 3, a marvel verb run by the daemon on a schedule) and the bound the operator confirmed the same day:

• P1: the owner's policy file gains its own entry for the verb's read paths, separate from the jail (A3), under the A1 checks; the verb reads only those paths.
• P2: a missing, unreadable or daemon-writable policy file turns it off, as A1 already does for cp.
• P3: the verb is generic and knows nothing of any other component's layout (ADR-005).
• P4: the policy is read on each scheduled run, so A6 stops the next one; this follows from P2 and A6.

The publish set and any one-way mirror are left out; both are separate items recorded elsewhere, and a mirror needs its own design note. The section uses placeholders only and names no real directory.

Additive only; no existing section changes.

[arcaven]

Section 9a is worth having: it puts the bound on a scheduled publish verb into the design a build has to meet. The bound matches what was confirmed in substance. One citation does not hold against A3 as written. That gap is where the containment would leak, so I am asking for one sentence before this merges.

Finding (medium), docs/design/marvel-cp.md P1 (line 145 at this head). P1 says the verb reads only "paths named in the owner's policy file ... (A1, A3)". A3 does not name any paths of that kind. It names, per workspace: the jail, the directions, the callers, optional path prefixes within the jail, and the daily budget. The card's own cost line for options 2 and 3 is reach outside the jail. So the paths this verb reads have no field in A3 today.

A later build could fill that gap in two ways:

• read the jail and its prefixes, which is narrower than the ruling;
• add its own path list somewhere other than the owner's file, which is the outcome 9a exists to prevent.

Fix direction: state in P1 that the owner's policy file gains a per-workspace entry listing the verb's read paths. It has the same owner and checks as A1, and it is separate from the cp jail and its prefixes. Either name the entry or leave its name to the build, but say it is new and lives only in that file. A matching clause at the end of A3 would work too, though that edits an existing section, and the body says additive only.

Checked and fine at this head:

• P2 matches A1's checks and A2's no-default rule. "daemon-writable" is covered by "the same checks", which include A1's ancestor rule.
• P3 builds in no component path. It cites ADR-005.
• P4 matches A6's next-call effect.
• No cp method is added. The only path is the <owner-listed path> placeholder.
• The quoted card text matches the card: "marvel verb, run by the daemon on a schedule." and "as option 2, and it publishes with no owner at the keyboard".
• The commit is signed. The diff is +13 in one file, which matches "additive only". The body leads with why. No em dashes or banned words, and nothing private.

Not mine to decide: the ruling itself, the ready flip, or the merge.

[arcaven]

The round 1 finding is closed at 8c80a3d. The bound now has a defined place in the owner's file, and nothing else moved, so this is ready from my side.

• P1 now says the owner's policy file gains a per-workspace entry for the verb's read paths, kept separate from the jail and its prefixes (A3) and under the same A1 checks. It also says the paths are named there and nowhere else. That gives the read set a home that only the owner can write, which was the gap.
• The delta is 1 line in docs/design/marvel-cp.md, replacing P1 only. Against main the PR is still +13 in one file, and the body's P1 line matches the new text.
• The new commit is signed. The scan passes on the changed line, the commit message, the body and this review. No em dashes, banned words or private names.

Not mine to decide: the ready flip or the merge.