Merge pull request #21 from CentralInfraCore/docs/certpattern-occurrence-count

docs: correct the CertPattern occurrence count

Author: sinkog

proposals/atom-grammar/P0-4-MIGRATION.md

@@ -39,10 +39,12 @@ accept legacy scalars, so a half-migrated document fails loudly.
    then the library keeps reading grammar 1.
 2. `cic-primitive-engine` needs the same pin change; its Normalize stage can use the symbolic
    defaults of section 1 unchanged.
-3. **`cic-schema-registry` has a real defect this work exposed** (matrix F2): nine current
-   schemas (34 occurrences including versioned ones) write `modify: [OU=adapters, O=cic]`, which
-   YAML parses as two patterns in OR. Any certificate with `O=cic` would match, not only
-   adapters. The intended value is the single pattern `"OU=adapters,O=cic"`. That repository
-   is outside this PR; it needs its own fix.
+3. **`cic-schema-registry` had a real defect this work exposed** (matrix F2). Originally 33
+   files (one occurrence each: the nine current schemas and 24 frozen released versions) wrote
+   `modify: [OU=adapters, O=cic]`, which YAML parses as two patterns in OR, so any certificate
+   with `O=cic` would match, not only adapters. The intended value is the single pattern
+   `"OU=adapters,O=cic"`. The nine current schemas are fixed since cic-schema-registry#162, which
+   also adds a lint for ambiguous CertPattern flow lists; the 24 frozen released versions are
+   unchanged (a correction needs a new release, decided separately).
 4. No `PolicySurface` runtime exists in `cic-relay` today; the resolution here is the contract
    for it, not a change to it.

proposals/atom-grammar/p0-4-contradiction-matrix.md

@@ -38,7 +38,7 @@ korpuszbizonyíték**. Bármely döntés tervezési döntés, nem mért szabály
 ## Findings beyond the #17 text
 
 - **F1 — more type-foreign defaults.** `default_access: open` and `default_modify: owner` are symbols in `CertPattern[]`-typed slots, the same pattern as `access: inherit` in a `list<CertPattern>` key (row 10). Neither #17 nor ADR 0004 listed them. `surface_rules` default is the word `empty`, not a list.
-- **F2 — flow-list pattern split (security-relevant).** `modify: [OU=adapters, O=cic]` parses as two OR patterns (`['OU=adapters', 'O=cic']`), while `access.yaml` defines `"OU=adapters,O=cic"` as one AND pattern. Nine current `cic-schema-registry` schemas (34 occurrences with versioned ones) write the unquoted form, so any `O=cic` certificate would match the state-surface write rule. Covered by `resolution.pattern-or-across-list` and `resolution.pattern-and-within-pattern`.
+- **F2 — flow-list pattern split (security-relevant).** `modify: [OU=adapters, O=cic]` parses as two OR patterns (`['OU=adapters', 'O=cic']`), while `access.yaml` defines `"OU=adapters,O=cic"` as one AND pattern. Originally 33 `cic-schema-registry` files (one occurrence each: nine current schemas and 24 frozen released versions) wrote the unquoted form, so any `O=cic` certificate would match the state-surface write rule. The nine current schemas are fixed since cic-schema-registry#162; the 24 frozen released versions are unchanged. Covered by `resolution.pattern-or-across-list` and `resolution.pattern-and-within-pattern`.
 - **F3 — the corpus cannot ground `false` versus `0`.** No field-level `inherit` key and no `inherit_policy` other than `true` exists (33 versioned, 9 current). The semantics in the spec are a design, decided by vectors, not a measurement.
 - **F4 — contradictory open default.** `policy-surface.yaml` said "no PolicySurface: every field is accessible" while its own `default_modify` is `owner`. The spec narrows the sentence: read open (authenticated), write needs a trusted owner.
 - **Archived SPEC §6.4** uses a per-operation `read`/`modify` structure with its own `inherit`; it is not the six-field Access and its inheritance was explicitly left unresolved (INV-037). Not adopted.