diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 66e69143..3a1f4cdf 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -16,14 +16,14 @@ ## In-flight -| Task | Owner | State | -| ------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) | -| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** | -| RM-02 registry ★key | rev-974 | **RE-REVIEW @ `32b490a7`** — all four D-44 defeats remediated; 3 attacks re-run dead by orchestrator. CI 2197 terminal, **RM-61 exemption load-bearing for the first time**. ACs @ `72b577eb` | -| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` | -| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** | -| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge | +| Task | Owner | State | +| ------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** | +| RM-02 registry ★key | **MOS** | **2nd NO-GO @ `32b490a7`.** D-44's four closed as instances; **D-45** (derivation still author-controlled via introduction timing) + **D-46** (empty registry passes green) + **D-47** (clauses instance-scoped). **DISPATCH PAUSED** — fix needs a non-author anchor, may cross RM-60 | +| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` | +| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** | +| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge | ### For the incoming orchestrator — read this before acting @@ -31,8 +31,8 @@ three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And re-derive any board claim from the provider before load-bearing use (D-43)** — the board is sole-written and has no independent verifier. -2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 45 findings - (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-44 + D-38c in TASKS.md), every ruling with its rationale, and the +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 48 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in TASKS.md), every ruling with its rationale, and the requirements each finding placed on RM-02/RM-34/RM-50/RM-55. 3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an @@ -87,6 +87,6 @@ went missing from mission setup twice, once inside the correction for it (**D-26 ## Decisions log — full record in [`TASKS.md`](./TASKS.md) -All 45 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-44 + D-38c in `TASKS.md`) and every ruling with +All 48 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in `TASKS.md`) and every ruling with its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate — six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md). diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 658d7eec..dbe35c14 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -558,6 +558,73 @@ claims from the provider**, not merely confirming the file parses or that a succ > orchestrator does so before dispatch; **the coordinator does so before acting on or relaying a board > claim that gates a decision** — Mos noted he had relayed board-derived state to Jason all session. +### D-45 — you cannot fix "the author controls X" by deriving X from something the author also controls + +Second NO-GO on the keystone, `32b490a7`. **The pattern is the finding, not the three blockers.** + +| round | the author's control point | the fix | +| ----- | ------------------------------------------------------------------------------------ | ------------------------- | +| 1 | `activationCommit` is an author-settable **field** | derive it | +| 2 | the derivation depends on **WHEN the author introduces `gates/gates.manifest.json`** | ← still author-controlled | + +`rev-974` committed a gate change **before** adding the manifest. `deriveHistoryBoundary` selected that +gate-change commit as activation, the prospective list held only the later introduction, and +`verifyHistory` returned **no failures**. An author can reorder or split a branch so gate-affecting +commits precede the chosen introduction and **fall outside provenance entirely**. + +**The three registered seam controls cannot catch it: they compare candidates against whatever +introduction THE AUTHOR SELECTED. They validate the choice, not the choosing.** + +> **★ THE PRINCIPLE: you cannot fix "the author controls X" by deriving X from something the author +> also controls.** Each fix **moved** the control point instead of **removing** it. This is **D-19 and +> D-25 verbatim — the anchor must live OUTSIDE the audited party's authority** — and it is the **third +> independent arrival of the same proof, now inside the keystone.** It is also precisely why Builds 1–2 +> are _forced_ rather than preferred. + +**Fix shape (rev-974):** bind bootstrap introduction to a **non-author-selected anchor** — provider +target merge-base / first branch boundary — plus a registered **delayed-introduction MUST-FAIL** case. + +### D-46 — the registry can be emptied to nothing and still report green + +A schema-valid manifest with `criteria: []`, `gates: []`, `proseClaims: []`, +`compatibilityScenarios: []` and `gateRoots: ["empty-gate-root"]` **passes**. Reproduced by the +orchestrator: **17 criteria, 7 gates, 8 prose claims and 2 scenarios all emptied ⇒ structure +verification EXIT 0**, reporting _"all registered cases ran from this checkout"_ and _"open behavior +deltas: 0"_. `rev-974` reports the **full** verifier also exits 0. + +> **"ALL REGISTERED CASES RAN" IS VACUOUSLY TRUE OVER AN EMPTY SET.** Delete every gate and every +> criterion **together** and no remaining reference complains — because every reference went with them. +> The anti-inert-gate registry can be reduced to nothing and still report green. + +**★ D-45 AND D-46 ARE THE SAME DEFECT AT TWO LEVELS: VACUITY THROUGH EMPTINESS.** Empty the **commit +range** (the seam) or empty the **registry population** — either way a universally-quantified check over +an empty set passes. `seam=HEAD` (D-44 blocker 1) was the **first instance**, and it was fixed **as an +instance**. The general principle was never extracted, **so it reappeared one level up.** + +> **PROPOSED GENERAL CLAUSE (orchestrator, pending Mos): NO UNIVERSALLY-QUANTIFIED REGISTRY CHECK MAY +> PASS OVER AN EMPTY SET.** Non-emptiness and anchoring are **preconditions, not properties.** Stated as +> a principle or we meet it a third time somewhere else. + +**D-47 (C2 re-fail):** the new criteria remain **instance-scoped**, not the general clauses Mos ruled. +`RM02-EVIDENCE-SUBJECT-BINDING` says only that a provider-evidence identity cannot certify two commit +subjects; it does **not** ask **of every registered gate** whether its evidence is bound to its subject. +`RM02-TYPE-STRICT-SCHEMA` covers registry **schema fields**, not whether each gate's own discriminators +are type-strict. **"Do not relabel the originating instances as the general clauses"** (`rev-974`). + +**What passed** — H2/H3/H4 (merge + octopus derive correctly; shallow clone fails **closed**; +absent/deleted/symlinked manifest fails the own-tree read rather than deriving through the gap), H5 (the +three seam controls are **genuine** red-first), S1–S4 (a nested object **outside the author's own test +table** — `compatibilityScenarios[0].fixture` — was rejected; wrong-type and empty-pattern rejected), +E1–E3, C1/C3/C4/C5. **C4 independently confirms the RM-61 exemption was load-bearing for the CORRECT +conjunction, not loosened matching.** Tracked non-blocking note: `Number.isInteger` accepts zero, +negative and unsafe integers as pipeline numbers. + +**Dispatch PAUSED pending Mos** — the fix requires a non-author-controlled anchor, which touches the +provider/merge-base boundary and is adjacent to **RM-60's external trust boundary** (Jason/infra +territory). Open questions: (1) is anchoring to provider target merge-base in scope for `f10-coder` in +this PR, or does it cross into RM-60? (2) state the empty-set principle as a general clause now, or +instance-patch again? + ### D-44 — the anti-inert-gate registry was inert-able FOUR distinct ways, and every green missed all four `rev-974` @ `83d2ecb2`, **NO GO**. Each finding is a **silent-defeat path of the registry itself**: