diff --git a/docs/remediation/BOARD-LEDGER.md b/docs/remediation/BOARD-LEDGER.md index ac24c624..3d2c4005 100644 --- a/docs/remediation/BOARD-LEDGER.md +++ b/docs/remediation/BOARD-LEDGER.md @@ -70,3 +70,10 @@ board is one of the six stale restatements below. not a 200 on a read. Mos owns provisioning; escalate missing pairs. - Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. + + + +### Why the board must not restate the delivery gates (D-26) + +Restating the gate from memory is how the merge-gate step went missing from mission setup twice, +once inside the correction for it (**D-26**). diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index ea4d9c49..1675c5f2 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -34,11 +34,9 @@ 2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 48 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in TASKS.md), every ruling with its rationale, and the requirements each finding placed on RM-02/RM-34/RM-50/RM-55. -3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the - property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an - integrity claim dressed as a property · when a property cannot exist at its layer, bound it and track - the real guarantee · query for refutation, never for confirmation · redundant observation on - evidence-bearing steps. +3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here. + Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45, + third arrival) and **no universally-quantified check may pass over an empty set** (D-44/D-46). 4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=` is stripped by a context reset (**D-34**) — every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials. 5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts. @@ -50,8 +48,7 @@ Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) + `~/.config/mosaic/fleet/roles/validator.md`. Order and the freeze/zero-information rules: `MISSION.md` -and `KICKSTART.md`. **Read them there** — restating the gate from memory is how the merge-gate step -went missing from mission setup twice, once inside the correction for it (**D-26**). +and `KICKSTART.md`. **Read them there** (why: **D-26**, in `BOARD-LEDGER.md`). ## Fleet seats diff --git a/docs/remediation/MISSION.md b/docs/remediation/MISSION.md index 789f694f..090f9491 100644 --- a/docs/remediation/MISSION.md +++ b/docs/remediation/MISSION.md @@ -117,6 +117,51 @@ gate/program; the LLM handles only genuine judgment. > not yet a hypothesis. Where the answer is consequential, **reproduce** rather than accept — two > independent runs beat one confident report. +### First-class principle — the anchor must live outside the audited party's authority + +> **You cannot fix "the author controls X" by deriving X from something the author ALSO controls.** +> Deriving merely **moves** the control point; it does not remove it. +> +> Promoted to the charter by Mos (2026-08-01) on the **THIRD INDEPENDENT ARRIVAL** of the same +> conclusion, each reached while trying to ship something else, each from a different direction: +> +> | arrival | the audited party controls… | found as | +> | ----------------- | ------------------------------------------------------------------- | -------- | +> | manifest | the tree that certifies its own generated state (same-UID, CWE-345) | **D-19** | +> | sandbox | the code that enters the sandbox, before the boundary exists | **D-25** | +> | **registry seam** | **WHEN the tracked path is introduced, hence the derived boundary** | **D-45** | +> +> Round 1 the value was an author-settable **field**, so it was **derived**. Round 2 the derivation +> depended on **when the author introduces the path**. Same authority, new costume. **Three +> impossibility-derivations of one conclusion is not a coincidence to note — it is the strongest +> architectural evidence this mission has produced**, and it is precisely what **forces Builds 1–2** +> rather than making them a preference. +> +> **Operationally:** anchor to a reference the audited party cannot move. A git **merge-base against +> `main`** is such a reference for a PR author (they own their branch; they do not own `main`). +> **State the bootstrap in BOTH directions (D-19):** that anchor is sound against an author who cannot +> rewrite `main` — the threat in scope — and **NOT** sound against an attacker who can. **That residual +> is what Builds 1–2 close, and it must be recorded as a tracked dependency, never implied.** + +### First-class principle — no universally-quantified check may pass over an empty set + +> **"All registered cases ran" is VACUOUSLY TRUE when there are no registered cases.** +> **Non-emptiness and anchoring are PRECONDITIONS asserted before the quantified check runs — not +> properties hoped for after it.** +> +> Promoted by Mos (2026-08-01) after the identical vacuity appeared **twice, at two different levels**: +> `activationCommit = HEAD` emptied the **commit range** (D-44), and an emptied manifest — `criteria`, +> `gates`, `proseClaims`, `compatibilityScenarios` all `[]` — emptied the **registry population** +> (D-46), each yielding **exit 0**. The first was fixed **as an instance**; the principle was never +> extracted, **so it returned one level up.** +> +> **Delete every gate and every criterion TOGETHER and no remaining reference complains — because every +> reference went with them.** A check that quantifies over a population must actually **range** over it, +> and that population must be **provably complete and non-empty**. +> +> **Corollary (same disease):** a clause written for the instance that produced it is not a clause. +> **Do not relabel the originating instances as the general clauses** — quantify over the population. + ### First-class principle — redundant observation on evidence-bearing steps > **Two observers of the same evidence, disagreeing, catch what neither catches alone.** Apply redundancy