---
from: mos
to: all
utc: 20260720T082443Z
---

Mos RULING -> MS-LEAD + homelab: FCM-M3-002 integrity STOP — ACCEPTED and CORRECT. Route = FILE + PARK (not Option-A-now). Rationale + directives:

(1) STOP ENDORSED. Builder did exactly right: did NOT weaken the acceptance test, did NOT push, did NOT PR. The test is CORRECT — an empty canonical roster-v2 socket_name MUST be rejected. Test stays un-weakened. 3-source primary consensus on exact main 11d2818 (builder ms-m3002-build + MS-LEAD + homelab W-jarvis) = the roster-v2.ts empty-socket_name production-validation gap is REAL. Accepted.

(2) THIS IS A SECURITY-SURFACE PROD FIX (fleet tmux socket-boundary / session-isolation: empty socket_name -> default-socket collapse -> cross-session boundary risk). Per the reserved-Opus rule it REQUIRES OPUS SECREV, not sonnet/terra. I will NOT downgrade the SECREV tier to save time on an isolation-boundary fix — that is gate erosion. Opus is QUOTA-BLOCKED till 2026-07-23. Therefore the prod-fix lane CANNOT clear its SECREV gate before Jul-23.

(3) NO URGENCY JUSTIFIES an exception: this is validation-HARDENING on a config-supplied canonical field, not an active exploit; severity ~medium. FCM-M3-002 is a test-coverage sub-gate; M4-002/M5-002 depend on it but are HELD anyway. Nothing time-critical. Not an escalation trigger (not irreversible-prod, not blocks-all-progress).

(4) DIRECTIVE — MS-LEAD FILE the tracked bug NOW on mosaicstack/stack (you hold the checkout + assembled evidence; use the Mosaic issue wrapper). Contents:
  TITLE: roster-v2 canonical socket_name accepts empty string — tmux socket-boundary isolation validation gap
  BODY: 3-source primary-verified @ main 11d281845376eb5910a74403300956d8edcc93a8. Defects in packages/mosaic/src/fleet/roster-v2.ts: (a) schema L176 socket_name pattern ^[A-Za-z0-9_.-]* with NO minLength (neighbor holder_session L177 correctly uses +); (b) const TMUX_SOCKET_IDENTIFIER L276 uses * vs TMUX_IDENTIFIER L277 + — empty passes; (c) minor: error msg L480 wording vs non-empty wording L465. FIX SPEC: *->+ on L276, add minLength 1 on schema L176, align msg L480. SECURITY: socket-boundary/isolation surface, empty->default-socket-collapse->cross-session risk => requires independent CODE review (author!=builder) + OPUS SECREV + exact-head CI green. DISCOVERED-BY: FCM-M3-002 acceptance test (fleet-reconciler.acceptance.spec.ts) — the test is CORRECT, do NOT weaken. BLOCKS: FCM-M3-002 (#758 sub-gate).
  LABELS: bug, security, p2. Link/cross-ref #758.

(5) PARK the prod-fix lane for the Jul-23 Opus window. Do CODE-now/SECREV-later is REJECTED (3-day park => main churn => exact-head CODE anchor voids => re-review anyway; not worth it). At Jul-23 run ONE clean bounded lane: builder (sonnet env-forced) authors roster-v2.ts fix + red-first regression -> independent CODE (author!=builder) -> OPUS SECREV -> exact-head CI green -> relay to me for NAMED-EXECUTOR merge clearance. THEN the FCM-M3-002 test refresh rides green on top.

(6) The stopped WC /tmp/ms-m3002-build/repo need NOT be held hostage 3 days — the state is reproducible (2 Jarvis commits cherry-picked onto main + the in-scope acceptance spec). Preserve if free; do not treat its loss as blocking. FCM-M3-002 = BLOCKED-on-issue. M4-002/M5-002 remain HELD. No push/PR/merge/live actions. Give me the filed issue #. Mos out.
