diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index aa4a0ca5..76d60a65 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -179,6 +179,48 @@ outage and defers the degraded path to "later", which in this codebase means **a under incident pressure**. Three such bypasses are already on the books; do not create the conditions for a fourth. +### RM-61 — the terminal-green exemption: ruled B, with a sequencing correction + +**Ruling (Mos, 2026-08-01):** exempt the #1000 teardown artifact from the terminal-green scan via a +**named, bounded, tracked** CI-contract exemption — signature-scoped, negative-control-proven, retiring +when #1000 is fixed. Rejected: **A-first** (blocks all delivery on infra work) and **C** (case-by-case +acceptance = silent normalisation with no audit trail). + +**Condition 1 tested — the signature IS stable.** All five observed failures share one shape: + +``` +pods "wp-svc--ci-postgres" not found # #2170 #2175 #2180 #2181 #2182 +``` + +A Kubernetes **orchestration-layer lookup miss** — the pod object was gone when status was collected — +structurally unlike a service-level failure (container exit code, image-pull error, crash, connection +refused). + +> ⚠ **BUT THE DISCRIMINATION IS UNPROVEN, AND THIS REORDERS THE CONDITIONS.** +> Every observation is of the artifact co-occurring with a **demonstrably working** database — #2180/#2181 +> test logs show PostgreSQL accepting connections and migrations completing. **We have never observed a +> real `ci-postgres` failure on this provider.** So the signature is _consistent_; it is not yet shown to +> _discriminate_. +> +> The dangerous case is concrete: if PostgreSQL genuinely crashes and the pod is garbage-collected, the +> status query may **also** return pod-not-found — in which case the exemption **over-matches and masks a +> real failure**, which is precisely what condition 1 exists to prevent. +> +> **Therefore conditions 1 and 2 are not independent — condition 2 is the _evidence for_ condition 1.** +> Correct order: **build the negative control first**, use it to establish that a real failure produces a +> _different_ signature, and only then adopt the exemption. Adopting first and testing after would run the +> exemption live on an unverified assumption. +> +> **Kill criterion, stated in advance:** if an injected real `ci-postgres` failure also yields +> pod-not-found, the signature does **not** discriminate, **B is unsafe, and we do A** (fix #1000). Naming +> the falsifier before running the test is the point — an exemption we cannot prove wrong is an exemption +> we cannot trust. + +**Ownership gap:** unassigned. `f10-coder` is on RM-02's blockers, `coder-mos1` on RM-03, `rev-974` is the +reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator rather than stacked onto a +busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next +otherwise-clean PR meets this. + ### D-29 — the registry's own coverage clause was SYNTACTIC, not semantic `rev-974` blocked PR #1030 with a finding that lands in the keystone's own enforcement: @@ -1241,19 +1283,20 @@ spread is itself information, and X1 says we calibrate on real merged PRs. ### P5 — Retirements, hygiene, conformance -| id | task | src | depends_on | est (S/O) | tier | -| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------- | ---------------- | ------ | -| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | -| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | -| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | -| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | -| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | -| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | -| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | -| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | -| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus | -| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus | -| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | +| id | task | src | depends_on | est (S/O) | tier | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ------------------------------------------ | ---------------- | ------ | +| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7) | O+S+live | RM-04 | 14K / 150K | sonnet | +| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet | +| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex | +| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus | +| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet | +| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus | +| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex | +| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex | +| RM-61 | **CI-contract exemption for the #1000 teardown artifact** — signature-scoped, negative-control-proven, bounded, retiring with #1000 (ruled B, Mos 2026-08-01) | mos-remediation | — (unassigned; no free write-capable seat) | 15K | sonnet | +| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus | +| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus | +| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50 | 8K | sonnet | **Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.