mos-dt-0/stack
1
0
Fork 0
forked from mosaicstack/stack
Code Pull Requests Activity

docs(remediation): bank D-52 — the fifth arrival defeated both the orchestrator and the coordinator

Browse Source 
coder-mos2 built blocker 2's "protected/base artifact" fix, ran independent code AND security review on
its own fix, and returned HIGH CWE-353 against its own work: the baseline is not protected because
verifier, manifest, baseline, tests and lifecycle code are all PR-controlled, so rewriting them
consistently self-certifies. It stopped rather than invent a fourth local anchor.

Both of us authored the error in the same turn. I dispatched blocker 2 as "must come from a
protected/base artifact"; Mos ruled blockers 2+3 fixable in-PR; and the same brief told the seat that
blocker 1 had no local fix because PR code executes before the gate. My own pre-registered P2 had
already named it — the seven required gate IDs are an anchor list, and if the author can edit it that
is D-45 one level in. I registered the check, rev-974 confirmed it as a blocker, and I dispatched a
remediation reproducing it one level down.

That is the strongest evidence the principle is real: it defeats the people who wrote it, every time,
until the anchor is external. Knowing the rule does not protect you from it.

Ruled (b) honest narrowing, and the sibling distinction is what makes it correct rather than a
climbdown. Blocker 1's local check can be vacuously passed — seam=HEAD certifies over nothing — so the
claim is REMOVED. Blocker 2's baseline genuinely detects accidental drift and fails only against an
adversary rewriting baseline, manifest and verifier consistently, so the claim is NARROWED and the
check kept. Accidental drift is most real-world drift.

The wording is the whole ruling, because this is D-48 territory and neither seat may repeat it: no
"protected" or "independently anchored" over a same-checkout baseline, positive claim and adversarial
gap in the same breath, plus a negative control that goes RED if the check ever claims protection it
does not have.

Increment trajectory surfaced to Jason: two RM-02 anchors now require RM-60 and each thins the
(d)-strict increment. If a third needs the same boundary the increment may thin past worth.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-01 14:43:09 -05:00
co-authored by Claude Opus 5
parent 33caf78744
commit d9207d4c1a
2 changed files with 59 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/BOARD.md
+4 -4
View File
@@ -20,7 +20,7 @@
| ------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
| RM-03 queue guard | Jason (re-sync) | ✅ **MERGED** `58b971ab` (#1032), #1019 closed. ⚠ **NOT DELIVERED**: installed guard still the broken one (291 lines / 0 `ASSERTED_NOT_READY` vs main 482 / 5). Re-sync via `mosaic upgrade`, then **prove it blocks a KNOWN-RED pipeline** — **D-51** |
| RM-02 registry ★key | **coder-mos2** | **Round 4 dispatched** @ `fbb61912` (3rd NO-GO). Blockers 2+3 + **(d)-strict** history removal per Jason INCREMENT. **NO 4th anchor — RM-60 is the anchor, tracked.** f10-coder parked read-only as reference |
| RM-02 registry ★key | **coder-mos2** | Round 4 @ `fbb61912`. Blocker 2 hit **RM-60 again (D-52, CWE-353)** — seat stopped, both orchestrator AND coordinator had authored the error. Ruled **(b) honest narrowing**; blocker 3 + (d)-strict unchanged. **2 anchors now need RM-60** |
| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` |
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
@@ -31,8 +31,8 @@
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
sole-written and has no independent verifier.
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 52 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-51 + D-38c in TASKS.md), every ruling with its rationale, and the
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 53 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in TASKS.md), every ruling with its rationale, and the
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
@@ -78,6 +78,6 @@ Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
All 52 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-51 + D-38c in `TASKS.md`) and every ruling with
All 53 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in `TASKS.md`) and every ruling with
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
docs/remediation/TASKS.md
+55
View File
@@ -586,6 +586,61 @@ is that discipline without a mechanism eventually fails."_
> a failed round **or by a lucky manual sweep.** Interim: both coordinator and orchestrator sweep — and
> **the mechanism retires the sweep.**
### D-52 — the FIFTH arrival defeated the orchestrator AND the coordinator, in the same turn, on a principle they had both just written
`coder-mos2` implemented blocker 2's fix — a `gates/required-gates.baseline.json` "protected/base
artifact" — then ran independent code **and security** review **on its own fix**, and returned
**HIGH CWE-353 against its own work**: the baseline is not protected, because **verifier, manifest,
baseline, tests and lifecycle code are ALL PR-controlled.** Rewrite them consistently and the registry
**self-certifies**. It **stopped rather than invent a fourth local anchor.**
**Both the orchestrator and the coordinator authored this error, in the same turn:**
| who | what they said |
| ------------------ | -------------------------------------------------------------------------------------- |
| orchestrator | dispatched blocker 2 as _"must come from a PROTECTED/BASE artifact"_ |
| coordinator | ruled blockers 2+3 _"fixable in-PR"_ |
| **the same brief** | told the seat blocker 1 had **no local fix**, because PR code executes before the gate |
**And the orchestrator's own pre-registered check P2 had already named it** — _"the seven required gate
IDs are an ANCHOR LIST. If the author can edit it, that is D-45 one level in."_ Registered by the
orchestrator, **confirmed as a blocker by `rev-974`**, and then a remediation reproducing it one level
down was dispatched anyway.
> **★ THIS IS THE STRONGEST EVIDENCE THE PRINCIPLE IS REAL: it defeats the people who wrote it, every
> time, until the anchor is external.** Knowing the rule does not protect you from it — only moving the
> anchor outside the audited party's authority does.
**RULING — (b) HONEST NARROWING, and the sibling distinction is what makes it correct rather than a
climbdown (Mos, 2026-08-01):**
| blocker | local check can… | therefore |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ |
| **1** history provenance | be **vacuously passed** (`seam=HEAD` empties the range) — certifies over NOTHING | **REMOVE** the claim (d-strict) |
| **2** inventory anchoring | **detect ACCIDENTAL drift** — inconsistent changes ARE caught; fails only against an adversary rewriting baseline + manifest + verifier consistently | **NARROW** the claim, keep the check |
Accidental and incompetent drift is **most real-world drift**, so the mechanism retains genuine value.
Both track **RM-60** for the adversarial guarantee; both state the boundary in **both directions**.
> **★ THE WORDING IS THE WHOLE RULING — D-48 territory, and neither seat may make that mistake twice.**
> The artifact must **NOT** say "protected" or "independently anchored" over a same-checkout baseline.
> It must state the positive claim and the adversarial gap **IN THE SAME BREATH**: _"detects accidental
> and incompetent inventory drift within a checkout; does NOT survive an adversary who rewrites
> baseline, manifest and verifier consistently — that guarantee requires RM-60's external boundary."_
> **Plus a NEGATIVE CONTROL: a registered case that goes RED if the check ever claims protection it
> does not have.** A narrowed claim with no negative control is a gate with no proven failure path.
**★ INCREMENT TRAJECTORY — surfaced to Jason.** **TWO** RM-02 anchors now require RM-60, and **each one
thins the (d)-strict increment.** The increment choice stands and (b) lands real value now, but the
trade-off should be decided **with the trend visible**: _if a third anchor needs the same boundary, the
increment may thin past worth._
**Seat conduct banked as the standard (`coder-mos2`):** stopped at the boundary rather than improvising
a fourth anchor; ran independent code + security review **on its own fix**; committed the delta as
**WIP** so a pending decision could not cost it (D-31); recorded sandbox attempts as **UNRUNNABLE**
(EROFS/EPERM) rather than substituting; named exit-97 as the known **#973/D-16** limitation rather than
a finding.
### D-51 — the fix is merged, the issue is closed, and the RUNNING TOOL IS STILL BROKEN
`#1032` merged (`58b971ab`), `#1019` closed, both verified by property. **RM-03 is delivered to `main`.**