diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 08435a7e..73420ef2 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -1,7 +1,7 @@ # mos-remediation — LIVE BOARD (keep < 8 KB) -**Phase:** EXECUTING — RM-03 **GATE-READY**, merge-gate assigned, HELD for Jason. RM-02 CI in flight. -**Updated:** 2026-07-31 (mos-remediation orchestrator; seat active on `mosaic-fleet`). +**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 building. +**Updated:** 2026-08-01 — **ORCHESTRATOR ROTATION SEAM** (prior seat rotated at ~803k tokens, ~4x threshold). ## Head @@ -16,49 +16,43 @@ ## In-flight -| Task | Owner | State | -| ------------------------------ | ------------- | ------------------------------------------------------------------------------------ | -| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | -| RM-03 queue guard | merge-gate | **GATE-READY** @ `78ec47cd` — rev-974 APPROVED (id 66) + CI 9/9 JSON; HELD for Jason | -| RM-02 gate registry ★keystone | f10-coder | masking blocker fixed @ `f9746b23`; CI #2187 running; **not** gate-ready | -| RM-61 terminal-green exemption | unassigned | ruled B; negative control FIRST, then adopt — or fall to A | -| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** | -| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes it | +| Task | Owner | State | +| ----------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-03 queue guard | **Jason** | **merge-gate GO** @ `78ec47cd` (comment 20392) — **HELD FOR OWNER MERGE**. Head verified unmoved; GO is commit-bound and VOID if it moves — **do not push to #1032** | +| RM-02 gate registry ★keystone | — | **BLOCKED on RM-61.** Code complete @ `f9746b23`, own harness green in CI, 2 reviews clear, head FROZEN. Cannot certify terminal-green: `ci-postgres` FAIL on #2187 **and** #2188 | +| RM-61 CI-contract exemption | coder-mos1 | design APPROVED, **building**. Controls first → prove discrimination → then exempt | +| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** (A does not fix the ordering defect) | +| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes; live REQUEST_CHANGES, do **not** merge | -**RM-03 gate-ready evidence** (each element observed, not relayed): head triple all equal at -`78ec47cd97bf0abc49334401f08c5b86e5be3a1a`; latest review **id 66 APPROVED at the current head** (id 64 -`REQUEST_CHANGES` correctly superseded); `Closes #1019`; CI #2186 **9/9 JSON child-step scan**, confirmed -independently by two observers whose counts **agreed**. Reviewer attacked rather than read — real-failure -payload → exit 3 `ASSERTED_NOT_READY`, bypass re-attack rejected, 170 KiB payload rc0, both tri-state arms. +### For the incoming orchestrator — read this before acting -> ⚠ **The queue guard is still inert for this merge** — RM-03 _is_ the fix and is not merged. The gate -> records `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. -> **The last merge to pass through the broken gate is the one that fixes it.** After #1032 lands, that -> field becomes real evidence for the first time since it was written. +1. **Nothing is waiting on you that is urgent.** RM-03 waits on Jason; RM-02 waits on RM-61; RM-61 is + building. Read the record before touching any lane. +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 35 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in TASKS.md), every ruling with its rationale, and the + requirements each finding placed on RM-02/RM-34/RM-50/RM-55. +3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the + property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an + integrity claim dressed as a property · when a property cannot exist at its layer, bound it and track + the real guarantee · query for refutation, never for confirmation · redundant observation on + evidence-bearing steps. +4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=` is stripped by a context reset (**D-34**) — + every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials. +5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts. +6. **The queue guard is zero-information until RM-03 merges** (**D-23**) — never cite its green. +7. **The bounded CI re-roll used on RM-02 was a one-time stopgap, NOT policy.** A per-PR free re-roll is + D-21 normalisation. Do not repeat it; RM-61 is the fix. -## Delivery gates — DOCTRINE CHANGE 2026-08-01 +## Delivery gates — REFERENCE, do not restate -**The gate definition was incomplete from mission setup: the merge-gate verdict step was missing.** -Root cause (**D-26**): the gates were **restated from memory** into `MISSION.md`/`KICKSTART.md` instead of -**referenced**, and the omission propagated into every worker brief issued since. It then recurred _inside -the correction_ — which dropped five details including a security precondition and cited a file that does -not exist. +Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) and +`~/.config/mosaic/fleet/roles/validator.md`. Order + the freeze/zero-information rules are stated once in +[`MISSION.md`](./MISSION.md) and [`KICKSTART.md`](./KICKSTART.md) — **read them there.** -**Fix is render-not-restate, mechanically.** `MISSION.md` and `KICKSTART.md` now **reference** -`~/.config/mosaic/fleet/roles.local/merge-gate.md` and `~/.config/mosaic/fleet/roles/validator.md` and -state only the gate **order**: - -> independent review (author ≠ reviewer) → remediation → **CI terminal-green at the exact head, full step -> scan** → **merge-gate verdict `GO`/`NO-GO`/`HOLD`** (commit-bound; **VOID on head move**; posted durably -> with enumerated evidence under its own minted identity) → **coordinator head-pinned merge** - -- **After a `GO`, pushes freeze** — a doc tweak voids the verdict. Gate-ready is a **freeze point**. -- The coordinator assigns the gate seat; the orchestrator owns getting a PR _gate-ready_. -- **Queue guard is ZERO-INFORMATION until RM-03 lands** (D-23) — record it as - `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. _A mandated field must not become a - manufactured one._ -- Gate seat identity: `gitea-mosaicstack-merge-gate` minted least-privilege, verified `push=False` — - it structurally cannot merge. +This board deliberately does **not** repeat the gate definition: restating it from memory is exactly how +the merge-gate step went missing from mission setup in the first place (**D-26**), twice, including once +inside the correction for it. ## Fleet seats @@ -70,48 +64,39 @@ state only the gate **order**: ## Gate status -- Delivery gates active: author≠reviewer, diff-blind pre-registered checks, CI-green, merged-PR completion. - Freeze: LIFTED for this workstream only. -- Git identity: `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what +- Git identity: orchestrator runs `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions. -- Capability check (D-11b): before dispatching seat X to provider Y, verify - `~/.config/mosaic/secrets/gitea-tokens/gitea--.token` exists. Token-file set = authoritative - capability registry. Mos owns provisioning; escalate missing pairs to him. +- Capability is **per-path** (D-11b → **superseded in part by D-13/D-15**): a token file is **necessary, + not sufficient**. Three layers — token file (raw-API), `tea` login (tea paths), **repository permission** + (writes). Before dispatch, assert `permissions.push == true` **as that seat**, not token existence and + not a 200 on a read. Mos owns provisioning; escalate missing pairs. - Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. -- Standing worker-brief doctrine (accreted, mandatory in every brief): don't weaken a RED test to make - it pass; if a check is unrunnable as written SAY SO, never silently substitute; `agent-send -f` never - `-m`; heavy artifacts off shared `/tmp`. +- Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**); + commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never + substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**). - Remote control: native `/remote-control` NOT wired in this runtime. Path is **Mos-relay** (Jason ↔ mos-claude via Discord ↔ mos-remediation via agent-send). Not a blocker. -## Sequencing (from MISSION.md) +## Sequencing — see [`MISSION.md`](./MISSION.md) -1. Spine + choke-point service (MACP wiring @ mosaic_orchestrator.py::run_single_task) + PG/Redis - ⚠ **CONTESTED — see DECISION-1.** Both planners independently reject this wire-in point: that - controller is `"enabled": false` and references a dispatcher that does not exist here. Charter text - left UNCHANGED pending Mos/Jason ruling; do not treat it as settled. -2. Rotation daemon (finish Mission Control Plane, reuse packages/coord) -3. Comms service (envelope→service→PG/Redis→adapters) -4. Hygiene + conformance harness - Cross-cutting retirements: flat-file tracking, 3 MACP islands, silent MOSAIC BYPASS. +Builds 1-5 and the cross-cutting retirements are stated once in the charter. **Not repeated here.** -## Dogfood evidence — live failure classes, not hypotheticals +⚠ **DECISION-1 is RULED, not contested** (this board previously said otherwise — stale for hours after the +ruling). The choke point targets a **new production Node `TaskExecutor` on the LIVE dispatch path** +(`packages/mosaic` launch + `packages/coord`); the disabled Python rail is **deleted, not ported**. -> Newest first. Oldest entries roll to `BOARD-LEDGER.md` via `board-roll.sh` when this file -> exceeds its 8 KB cap. Keystone detail is duplicated in `TASKS.md` §1a, so rolling loses nothing. +## Decisions log — full record in [`TASKS.md`](./TASKS.md) - +All 35 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in `TASKS.md`) and every ruling with its +rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this +board has now done three times in one night (gate list, capability registry, DECISION-1 status). - +Live rulings a fresh seat most needs: -## Decisions log - -- 2026-07-31 — Mission set up by Mos post-postmortem (15/15 decided). Dogfood posture active. -- 2026-07-31 — Mos: stale `.mosaic/orchestrator/mission.json` is RESIDUE of the disabled Python - orchestrator rail that this plan RETIRES. Do NOT invest in it; do NOT build on that rail. The 0/0 - milestone banner is cosmetic. (Supersedes any plan to repair it.) -- 2026-07-31 — Mos: planners must be dispatched with GUARANTEED clean context, not requested-clean. - Prior default-socket planner sessions predate this mission; dirty context is the indicted hygiene. -- 2026-07-31 — mos-remediation: worker briefs forbid all git ops and restrict each worker to a single - named output file, so two planners can share one checkout without a branch race (M2-era incident doctrine). +- **D-23** queue guard is inert → zero-information until RM-03 merges. Never cite its green. +- **D-33** scan CI from `-f json`; text mode omits `clone`. State counts. +- **D-34** a context reset strips `MOSAIC_GIT_IDENTITY` → re-export in every brief. +- **RM-61** exemption: controls FIRST, prove discrimination, THEN adopt — or fall to option A. +- The RM-02 bounded CI re-roll was a **one-time stopgap, never policy**.