mosaicstack/stack
1
0
Fork 1
Code Issues 139 Pull Requests 5 Actions Packages Projects Releases 15 Wiki Activity

docs(remediation): bank D-45/D-46/D-47 — the fix moved the author's control point instead of removing it

Browse Source 
Second NO-GO on the keystone at 32b490a7. The pattern is the finding, not the three blockers.

D-45: round 1 the author set activationCommit as a field, so we derived it; round 2 the derivation
depends on WHEN the author introduces gates/gates.manifest.json. rev-974 committed a gate change before
adding the manifest — deriveHistoryBoundary picked that commit as activation, the prospective list held
only the later introduction, and verifyHistory returned no failures. The three registered seam controls
cannot catch it because they compare candidates against whatever introduction the author selected: they
validate the choice, not the choosing. You cannot fix "the author controls X" by deriving X from
something the author also controls. That is D-19/D-25 verbatim — the anchor must live outside the
audited party's authority — arriving a third time, now inside the keystone, and it is exactly why
Builds 1-2 are forced rather than preferred.

D-46: I reproduced it myself. Emptying criteria, gates, proseClaims and compatibilityScenarios — 17, 7,
8 and 2 entries — and pointing gateRoots at an empty directory yields EXIT 0, reporting "all registered
cases ran from this checkout" and "open behavior deltas: 0". "All registered cases ran" is vacuously
true over an empty set. The registry can be reduced to nothing and still report green.

D-45 and D-46 are the same defect at two levels: vacuity through emptiness. Empty the commit range or
empty the registry population — either way a universally-quantified check over an empty set passes.
seam=HEAD was the first instance and we fixed it AS an instance; the principle was never extracted, so
it came back one level up. Proposed general clause pending Mos: no universally-quantified registry
check may pass over an empty set — non-emptiness and anchoring are preconditions, not properties.

D-47: the new criteria are still instance-scoped. RM02-EVIDENCE-SUBJECT-BINDING covers only provider
evidence identity, not whether every registered gate binds evidence to its subject; RM02-TYPE-STRICT-
SCHEMA covers registry schema fields, not each gate's own discriminators. Do not relabel the
originating instances as the general clauses.

Dispatch PAUSED for the first time this session: the fix needs a non-author-controlled anchor, which
touches the provider/merge-base boundary and is adjacent to RM-60, which Mos and Jason own. Asked Mos
whether that anchoring is in scope for f10-coder here or crosses into RM-60, and whether the empty-set
principle becomes a general clause now.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-01 12:04:13 -05:00
co-authored by Claude Opus 5
parent 24a7915633
commit 08cb73fde3
2 changed files with 78 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/BOARD.md
+11 -11
View File
@@ -16,14 +16,14 @@
## In-flight
| Task | Owner | State |
| ------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** |
| RM-02 registry ★key | rev-974 | **RE-REVIEW @ `32b490a7`** — all four D-44 defeats remediated; 3 attacks re-run dead by orchestrator. CI 2197 terminal, **RM-61 exemption load-bearing for the first time**. ACs @ `72b577eb` |
| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` |
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
| Task | Owner | State |
| ------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** |
| RM-02 registry ★key | **MOS** | **2nd NO-GO @ `32b490a7`.** D-44's four closed as instances; **D-45** (derivation still author-controlled via introduction timing) + **D-46** (empty registry passes green) + **D-47** (clauses instance-scoped). **DISPATCH PAUSED** — fix needs a non-author anchor, may cross RM-60 |
| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` |
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
### For the incoming orchestrator — read this before acting
@@ -31,8 +31,8 @@
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
sole-written and has no independent verifier.
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 45 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-44 + D-38c in TASKS.md), every ruling with its rationale, and the
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 48 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in TASKS.md), every ruling with its rationale, and the
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the
property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an
@@ -87,6 +87,6 @@ went missing from mission setup twice, once inside the correction for it (**D-26
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
All 45 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-44 + D-38c in `TASKS.md`) and every ruling with
All 48 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in `TASKS.md`) and every ruling with
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
docs/remediation/TASKS.md
+67
View File
@@ -558,6 +558,73 @@ claims from the provider**, not merely confirming the file parses or that a succ
> orchestrator does so before dispatch; **the coordinator does so before acting on or relaying a board
> claim that gates a decision** — Mos noted he had relayed board-derived state to Jason all session.
### D-45 — you cannot fix "the author controls X" by deriving X from something the author also controls
Second NO-GO on the keystone, `32b490a7`. **The pattern is the finding, not the three blockers.**
| round | the author's control point | the fix |
| ----- | ------------------------------------------------------------------------------------ | ------------------------- |
| 1 | `activationCommit` is an author-settable **field** | derive it |
| 2 | the derivation depends on **WHEN the author introduces `gates/gates.manifest.json`** | ← still author-controlled |
`rev-974` committed a gate change **before** adding the manifest. `deriveHistoryBoundary` selected that
gate-change commit as activation, the prospective list held only the later introduction, and
`verifyHistory` returned **no failures**. An author can reorder or split a branch so gate-affecting
commits precede the chosen introduction and **fall outside provenance entirely**.
**The three registered seam controls cannot catch it: they compare candidates against whatever
introduction THE AUTHOR SELECTED. They validate the choice, not the choosing.**
> **★ THE PRINCIPLE: you cannot fix "the author controls X" by deriving X from something the author
> also controls.** Each fix **moved** the control point instead of **removing** it. This is **D-19 and
> D-25 verbatim — the anchor must live OUTSIDE the audited party's authority** — and it is the **third
> independent arrival of the same proof, now inside the keystone.** It is also precisely why Builds 1–2
> are _forced_ rather than preferred.
**Fix shape (rev-974):** bind bootstrap introduction to a **non-author-selected anchor** — provider
target merge-base / first branch boundary — plus a registered **delayed-introduction MUST-FAIL** case.
### D-46 — the registry can be emptied to nothing and still report green
A schema-valid manifest with `criteria: []`, `gates: []`, `proseClaims: []`,
`compatibilityScenarios: []` and `gateRoots: ["empty-gate-root"]` **passes**. Reproduced by the
orchestrator: **17 criteria, 7 gates, 8 prose claims and 2 scenarios all emptied ⇒ structure
verification EXIT 0**, reporting _"all registered cases ran from this checkout"_ and _"open behavior
deltas: 0"_. `rev-974` reports the **full** verifier also exits 0.
> **"ALL REGISTERED CASES RAN" IS VACUOUSLY TRUE OVER AN EMPTY SET.** Delete every gate and every
> criterion **together** and no remaining reference complains — because every reference went with them.
> The anti-inert-gate registry can be reduced to nothing and still report green.
**★ D-45 AND D-46 ARE THE SAME DEFECT AT TWO LEVELS: VACUITY THROUGH EMPTINESS.** Empty the **commit
range** (the seam) or empty the **registry population** — either way a universally-quantified check over
an empty set passes. `seam=HEAD` (D-44 blocker 1) was the **first instance**, and it was fixed **as an
instance**. The general principle was never extracted, **so it reappeared one level up.**
> **PROPOSED GENERAL CLAUSE (orchestrator, pending Mos): NO UNIVERSALLY-QUANTIFIED REGISTRY CHECK MAY
> PASS OVER AN EMPTY SET.** Non-emptiness and anchoring are **preconditions, not properties.** Stated as
> a principle or we meet it a third time somewhere else.
**D-47 (C2 re-fail):** the new criteria remain **instance-scoped**, not the general clauses Mos ruled.
`RM02-EVIDENCE-SUBJECT-BINDING` says only that a provider-evidence identity cannot certify two commit
subjects; it does **not** ask **of every registered gate** whether its evidence is bound to its subject.
`RM02-TYPE-STRICT-SCHEMA` covers registry **schema fields**, not whether each gate's own discriminators
are type-strict. **"Do not relabel the originating instances as the general clauses"** (`rev-974`).
**What passed** — H2/H3/H4 (merge + octopus derive correctly; shallow clone fails **closed**;
absent/deleted/symlinked manifest fails the own-tree read rather than deriving through the gap), H5 (the
three seam controls are **genuine** red-first), S1–S4 (a nested object **outside the author's own test
table** — `compatibilityScenarios[0].fixture` — was rejected; wrong-type and empty-pattern rejected),
E1–E3, C1/C3/C4/C5. **C4 independently confirms the RM-61 exemption was load-bearing for the CORRECT
conjunction, not loosened matching.** Tracked non-blocking note: `Number.isInteger` accepts zero,
negative and unsafe integers as pipeline numbers.
**Dispatch PAUSED pending Mos** — the fix requires a non-author-controlled anchor, which touches the
provider/merge-base boundary and is adjacent to **RM-60's external trust boundary** (Jason/infra
territory). Open questions: (1) is anchoring to provider target merge-base in scope for `f10-coder` in
this PR, or does it cross into RM-60? (2) state the empty-set principle as a general clause now, or
instance-patch again?
### D-44 — the anti-inert-gate registry was inert-able FOUR distinct ways, and every green missed all four
`rev-974` @ `83d2ecb2`, **NO GO**. Each finding is a **silent-defeat path of the registry itself**: