---
from: usc
to: all
utc: 20260719T232155Z
---

MS-LEAD → Mos: WI-6 PLAN for your sign-off (NOT dispatched yet; awaiting your GO).

issue# = #833 'WI-6: Constrained recovery command + mosaic-context-refresh skill wrapper' (milestone 188; issue body marks OPUS-SECREV MANDATORY — the single ungated mutator).

scope = BUILD-BRIEF §3.6 deliverable 6. The constrained recovery command = the SINGLE UNGATED MUTATOR; mosaic-context-refresh skill = its wrapper. Recovery MINTS A FRESH challenge + runs the IDENTICAL WI-5 receipt protocol (recovery parity C4) and CANNOT replay the normal-path receipt. Durable skill lands framework-native in packages/mosaic/ (NOT jarvis-brain, NOT ~/.config/mosaic directly), ships auto-symlink-reachable via the merged #824/#826 mosaic-skill bridge (d801d6c4). ACs (red-first): (1) T27 partial-delivery variants {prefix-trunc, tail-only, middle-drop, malformed} NONE promote; (2) recovery uses a FRESH challenge, not normal-path receipt replay; (3) skill ships auto-symlinked into ~/.claude/skills/. M1 = Claude+Pi only (Codex/other = scope-note).

review-lane = CODE terra (ms-wi6-code) for functional/non-security; SECREV = FRESH Opus §7 MANDATORY on the recovery/receipt/ungated-mutator surface (BUILD-BRIEF §7 no GPT/terra substitute), NEW distinct principal ≠ builder ≠ WI-3 planner-opus ≠ ms-wi4-secrev ≠ ms-wi5-secrev2 ≠ prior. (Legit Opus carve-out; weekly 85% noted.)

branch = feat/833-constrained-recovery-command off NEW main tip 07553ead (no-rebase pin discipline). builder = ms-wi6-build, pi terra:high (cost-tight code→Pi/terra default).

TWO BOUNDARY FLAGS needing your ruling before I dispatch:
(A) §4 LIVE-MUTATION FREEZE vs AC-3 'ships auto-symlinked into ~/.claude/skills/': propose BYTE-BUILD ONLY — ship the durable skill + rely on the #824 bridge's auto-symlink mechanism, VERIFY reachability via test/harness, but DEFER any LIVE install/symlink creation into ~/.claude/skills/ (live FS mutation outside repo) to the runtime-integration step — mirroring WI-5's deferred live-hook wiring. Confirm this boundary or widen it.
(B) ADMISSION PROBE: WI-6 recovery reuses the receipt protocol, so recovery-parity C4 (fresh-challenge recovery CANNOT replay the normal-path receipt) likely warrants a probe akin to P5. Propose: in-build red-first ACs against the SHIPPED recovery path + a standalone recovery-replay probe harness (unfired, Mos-gated FIRE) — same HYBRID shape as WI-5 Q2. Confirm whether WI-6 needs a P6-style FIRE admission or in-build red-first suffices.

On your GO (+ boundary rulings) I encode the directive + dispatch ms-wi6-build red-first. -- usc
