mos-dt-0/stack
1
0
Fork 0
forked from mosaicstack/stack
Code Pull Requests Activity

docs(remediation): RM-61 terminal-green exemption ruled B, with sequencing correction

Browse Source 
Condition 1 tested: the signature is stable — pods "wp-svc-<ULID>-ci-postgres" not
found across all five observed failures, an orchestration-layer lookup miss structurally
unlike a service-level failure.

But discrimination is UNPROVEN: every observation co-occurs with a demonstrably working
database, and we have never seen a real ci-postgres failure on this provider. If
PostgreSQL crashes and the pod is GC'd, the status query may also return pod-not-found —
the exemption would over-match and mask a real failure.

So conditions 1 and 2 are not independent: 2 is the evidence for 1. Build the negative
control first, prove a real failure produces a different signature, then adopt the
exemption. Kill criterion stated in advance: if an injected real failure also yields
pod-not-found, B is unsafe and we do A.

Filed as RM-61, unassigned — no free write-capable seat; flagged rather than stacked
onto a busy lane.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-01 00:04:32 -05:00
co-authored by Claude Opus 5
parent 16d11cd6cd
commit bdf8932328
1 changed files with 56 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/TASKS.md
+56 -13
View File
@@ -179,6 +179,48 @@ outage and defers the degraded path to "later", which in this codebase means **a
under incident pressure**. Three such bypasses are already on the books; do not create the conditions
for a fourth.
### RM-61 — the terminal-green exemption: ruled B, with a sequencing correction
**Ruling (Mos, 2026-08-01):** exempt the #1000 teardown artifact from the terminal-green scan via a
**named, bounded, tracked** CI-contract exemption — signature-scoped, negative-control-proven, retiring
when #1000 is fixed. Rejected: **A-first** (blocks all delivery on infra work) and **C** (case-by-case
acceptance = silent normalisation with no audit trail).
**Condition 1 tested — the signature IS stable.** All five observed failures share one shape:
```
pods "wp-svc-<ULID>-ci-postgres" not found # #2170 #2175 #2180 #2181 #2182
```
A Kubernetes **orchestration-layer lookup miss** — the pod object was gone when status was collected —
structurally unlike a service-level failure (container exit code, image-pull error, crash, connection
refused).
> ⚠ **BUT THE DISCRIMINATION IS UNPROVEN, AND THIS REORDERS THE CONDITIONS.**
> Every observation is of the artifact co-occurring with a **demonstrably working** database — #2180/#2181
> test logs show PostgreSQL accepting connections and migrations completing. **We have never observed a
> real `ci-postgres` failure on this provider.** So the signature is _consistent_; it is not yet shown to
> _discriminate_.
>
> The dangerous case is concrete: if PostgreSQL genuinely crashes and the pod is garbage-collected, the
> status query may **also** return pod-not-found — in which case the exemption **over-matches and masks a
> real failure**, which is precisely what condition 1 exists to prevent.
>
> **Therefore conditions 1 and 2 are not independent — condition 2 is the _evidence for_ condition 1.**
> Correct order: **build the negative control first**, use it to establish that a real failure produces a
> _different_ signature, and only then adopt the exemption. Adopting first and testing after would run the
> exemption live on an unverified assumption.
>
> **Kill criterion, stated in advance:** if an injected real `ci-postgres` failure also yields
> pod-not-found, the signature does **not** discriminate, **B is unsafe, and we do A** (fix #1000). Naming
> the falsifier before running the test is the point — an exemption we cannot prove wrong is an exemption
> we cannot trust.
**Ownership gap:** unassigned. `f10-coder` is on RM-02's blockers, `coder-mos1` on RM-03, `rev-974` is the
reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator rather than stacked onto a
busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next
otherwise-clean PR meets this.
### D-29 — the registry's own coverage clause was SYNTACTIC, not semantic
`rev-974` blocked PR #1030 with a finding that lands in the keystone's own enforcement:
@@ -1241,19 +1283,20 @@ spread is itself information, and X1 says we calibrate on real merged PRs.
### P5 — Retirements, hygiene, conformance
| id | task | src | depends_on | est (S/O) | tier |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------- | ---------------- | ------ |
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet |
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus |
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet |
| id | task | src | depends_on | est (S/O) | tier |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ------------------------------------------ | ---------------- | ------ |
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet |
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
| RM-61 | **CI-contract exemption for the #1000 teardown artifact** — signature-scoped, negative-control-proven, bounded, retiring with #1000 (ruled B, Mos 2026-08-01) | mos-remediation | — (unassigned; no free write-capable seat) | 15K | sonnet |
| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus |
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet |
**Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.