docs(remediation): bank D-50 (a GO has a shelf life) and file RM-63 (systemd-managed fleet)
D-50: #1032 carried review 66 APPROVED and a merge-gate GO both bound to78ec47cd, and by the time Jason approved the merge it reported mergeable=false. Verified from the provider: its head does not contain current mainf4fd5967. Two rules we already hold, neither wrong alone, combine badly — a verdict is commit-bound and voids when the head moves, and main drifts while a PR is held, so resolving the drift moves the head and voids the verdict that was waiting to be used. Holding it across the whole #1033 saga is what did it. The asymmetry worth noting: usually a head moves because the AUTHOR pushed, so the void follows from their action. Here nobody touched the PR — unrelated progress invalidated it — which is why it is easy to miss and needs a checklist line rather than vigilance. Mos's line: a GO has a shelf life, re-gate on main-drift. RM-63 files Jason's architecture as the mechanization of D-41/RM-50/RM-58/P-LIFECYCLE rather than a new island: durably-named systemd agent services with lanes, where restart triggers a continuation and the agent resumes its lane, combined with DB-centric task assignment on the PG spine for autonomous pickup. That is the enforcement surface D-41 proved missing — a managed service can be watched (token budget, which is D-49's mechanical ceiling monitor), restarted (rotation, retiring our manual respawns) and continued (rehydrate from the DB). It closes the f10-coder ceiling gap directly: Jason confirmed that ceiling was not mechanically flagged and must be. #1032 freshening dispatched to coder-mos1 — it authored the queue guard, so that context is an asset, and by D-49 it can still take a lane at 67%. Told to stop and flag on any SUBSTANCE conflict, because a queue-guard semantic resolved quietly re-breaks the very thing RM-03 fixes. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
co-authored by
Claude Opus 5
Claude Opus 5
parent
eae62a598a
commit
08f706b675
@@ -31,8 +31,8 @@
|
||||
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
|
||||
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
|
||||
sole-written and has no independent verifier.
|
||||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 50 findings
|
||||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-49 + D-38c in TASKS.md), every ruling with its rationale, and the
|
||||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 51 findings
|
||||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-50 + D-38c in TASKS.md), every ruling with its rationale, and the
|
||||
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
|
||||
3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
|
||||
Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
|
||||
@@ -78,6 +78,6 @@ Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is
|
||||
|
||||
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
|
||||
|
||||
All 50 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-49 + D-38c in `TASKS.md`) and every ruling with
|
||||
All 51 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-50 + D-38c in `TASKS.md`) and every ruling with
|
||||
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
|
||||
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
|
||||
|
||||
+43
-15
@@ -586,6 +586,33 @@ is that discipline without a mechanism eventually fails."_
|
||||
> a failed round **or by a lucky manual sweep.** Interim: both coordinator and orchestrator sweep — and
|
||||
> **the mechanism retires the sweep.**
|
||||
|
||||
### D-50 — a GO has a SHELF LIFE: a gate-ready PR held too long goes stale under main drift
|
||||
|
||||
`#1032` (RM-03, the queue-guard fix) carried **review 66 APPROVED and a merge-gate GO, both bound to
|
||||
`78ec47cd`** — and by the time Jason approved the merge it reported **`mergeable = false`**. Verified
|
||||
from the provider: the head does not contain current `main` (`f4fd5967`).
|
||||
|
||||
**The mechanism is the interaction of two rules we already hold, neither wrong alone:**
|
||||
|
||||
| rule | consequence |
|
||||
| --------------------------------------------------------- | --------------------------------------------------------------------------------------- |
|
||||
| a verdict is **commit-bound** and voids if the head moves | correct — it is what makes a GO mean anything |
|
||||
| `main` **drifts** while a PR is held | normal — other work lands |
|
||||
| **together** | **resolving the drift moves the head, voiding the verdict that was waiting to be used** |
|
||||
|
||||
Holding `#1032` across the entire `#1033`/RM-61 saga is what did it: RM-61 landed `f4fd5967` underneath
|
||||
it. So the PR must now rebase → re-CI → **re-review** (the APPROVE is void at the new head) → **re-gate**
|
||||
before the standing approval can be executed. **It will land; it costs one full cycle first.**
|
||||
|
||||
> **CHECKLIST LINE (Mos): A GO HAS A SHELF LIFE. RE-GATE ON MAIN-DRIFT.** A gate-ready PR is not a
|
||||
> durable state — it is a claim about a commit that `main` can invalidate without anyone touching the
|
||||
> PR. Where a hold is expected to be long, either merge inside the window or expect to pay the cycle.
|
||||
|
||||
**Note the asymmetry with a normal void:** usually the head moves because the AUTHOR pushed, and the
|
||||
void is a consequence of their action. Here **nobody touched the PR** — it was invalidated by unrelated
|
||||
progress elsewhere, which is why it is easy to miss and why it needs a checklist line rather than
|
||||
vigilance.
|
||||
|
||||
### D-48 — a both-directions boundary statement that was WRONG, verified by three seats, and the suspicion that contradicted it was sitting in the handoff
|
||||
|
||||
**Banked as Mos's error, in Mos's words, at Mos's request.** (Mos said "bank as D-46"; that number is the
|
||||
@@ -2214,21 +2241,22 @@ spread is itself information, and X1 says we calibrate on real merged PRs.
|
||||
|
||||
### P5 — Retirements, hygiene, conformance
|
||||
|
||||
| id | task | src | depends_on | est (S/O) | tier |
|
||||
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ------------------------------------------ | ---------------- | ------ |
|
||||
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7). **Acceptance MUST be proved against the UNMANAGED execution fleet, not the roster-managed canaries (D-41)** | O+S+live | RM-04, **RM-62** | 14K / 150K | sonnet |
|
||||
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
|
||||
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
|
||||
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
|
||||
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
|
||||
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
|
||||
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
|
||||
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
|
||||
| RM-61 | **CI-contract exemption for the #1000 teardown artifact** — signature-scoped, negative-control-proven, bounded, retiring with #1000 (ruled B, Mos 2026-08-01) | mos-remediation | — (unassigned; no free write-capable seat) | 15K | sonnet |
|
||||
| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus |
|
||||
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
|
||||
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50, **RM-62** | 8K | sonnet |
|
||||
| RM-62 | **★ PREREQUISITE — bring the EXECUTION fleet under roster/systemd management.** Every working seat (`coder-mos1`, `rev-974`, `f10-coder`, `merge-gate`, `pm-scout-*`, `rev-3107b`, `ultron-3107`, **and `mos-remediation`**) is `inactive/disabled` + UNMANAGED — there is no lifecycle surface to enforce anything against. **BLOCKS RM-50, RM-58, P-LIFECYCLE-001**; each is unsatisfiable against its real population until this lands. One infrastructure cluster with D-37's shared-config fix; Mos owns both, sequenced at a seam, never mid-lane | mos-remediation (D-41) | infra authority (Mos) | TBD | opus |
|
||||
| id | task | src | depends_on | est (S/O) | tier |
|
||||
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ------------------------------------------ | ---------------- | ------ |
|
||||
| RM-50 | One roster-owned socket/host; quarantine unmanaged; **deterministic reaper for stale sessions AND dead-session disk scratch** (D-7). **Acceptance MUST be proved against the UNMANAGED execution fleet, not the roster-managed canaries (D-41)** | O+S+live | RM-04, **RM-62** | 14K / 150K | sonnet |
|
||||
| RM-51 | Auto-sync **allowlist** (never auto-stage unknown paths) + worktree/lease isolation | O+S | RM-02 | 8K / 110K | sonnet |
|
||||
| RM-52 | Retire the Python controller + duplicate MACP islands (3 → 1) | O+S | RM-26, RM-27, RM-25, RM-28 | 14K / 110K | codex |
|
||||
| RM-53 | Flat-file orchestration → DB hard cutover, with rehearsed rollback artifact | O+S | RM-27, RM-30, RM-34, RM-29 | (in S-10) / 200K | opus |
|
||||
| RM-54 | Fleet-wide inert-gate audit against the RM-02 registry | O | RM-02 | — / 120K | sonnet |
|
||||
| RM-55 | **Conformance harness:** fault-inject the live failure classes on real artifacts | O+S | RM-35, RM-41, RM-53 | 18K / 260K | opus |
|
||||
| RM-56 | Retirement proof: CI asserts all three retirements are complete **and stay complete** | O | RM-52, RM-45, RM-53 | — / 90K | codex |
|
||||
| RM-57 | Operator cutover docs + activation proof; map all 15 decisions to evidence | S | RM-04, RM-36, RM-45, RM-55 | 6K / — | codex |
|
||||
| RM-61 | **CI-contract exemption for the #1000 teardown artifact** — signature-scoped, negative-control-proven, bounded, retiring with #1000 (ruled B, Mos 2026-08-01) | mos-remediation | — (unassigned; no free write-capable seat) | 15K | sonnet |
|
||||
| RM-60 | **External pre-execution trust boundary for CI (option B — the correct primitive, not the cautious one)** — protected default-branch pipeline config or an immutable trusted launcher that enters the sandbox **before** any PR-controlled executable/config is evaluated; unblocks isolated per-commit replay (RM02-REQ-10) | mos-remediation (D-25) | infra/provider authority (Mos + Jason) | 25K | opus |
|
||||
| RM-59 | **Close the D-19 residual risk** — generated-state verification anchored **outside** the worktree's authority (executor/spine-side attestation), retiring the same-UID self-authentication gap | mos-remediation (D-19) | RM-12, RM-21, RM-25 | 20K | opus |
|
||||
| RM-58 | **Mechanical pre-dispatch context reset** — the orchestrator resets a seat out-of-band and verifies it, rather than asking the agent to reset itself | mos-remediation (D-4) | RM-31, RM-50, **RM-62** | 8K | sonnet |
|
||||
| RM-62 | **★ PREREQUISITE — bring the EXECUTION fleet under roster/systemd management.** Every working seat (`coder-mos1`, `rev-974`, `f10-coder`, `merge-gate`, `pm-scout-*`, `rev-3107b`, `ultron-3107`, **and `mos-remediation`**) is `inactive/disabled` + UNMANAGED — there is no lifecycle surface to enforce anything against. **BLOCKS RM-50, RM-58, P-LIFECYCLE-001**; each is unsatisfiable against its real population until this lands. One infrastructure cluster with D-37's shared-config fix; Mos owns both, sequenced at a seam, never mid-lane | mos-remediation (D-41) | infra authority (Mos) | TBD | opus |
|
||||
| RM-63 | **★ ARCHITECTURE (Jason, 2026-08-01) — SYSTEMD-MANAGED AGENT SERVICES with DURABLE NAMES + LANES.** This is **the mechanization of D-41 / RM-50 / RM-58 / P-LIFECYCLE-001**, not a new island. A standing set of durably-named services (coders, FE, BE, planners, code-review, sec-review, Ultron/merge-gate); `fleet restart` / `systemctl restart` triggers a **CONTINUATION** — the agent resumes its LANE. Combined with **DB-centric task assignment on the PG spine**, durable names + lanes give **autonomous task pickup on continue**. Provides the enforcement surface D-41 proved missing: a managed service can be **watched** (token budget → D-49's mechanical ceiling monitor), **restarted** (rotation, retiring the manual respawns), **continued** (rehydrate from the DB). Rotation, reaping and quarantine become MECHANICAL. Sits with the coordinator-daemon + DB-spine deliverables | Jason (architecture) | RM-62, RM-12/RM-13 (spine) | TBD | opus |
|
||||
|
||||
**Critical path:** `RM-01 → RM-02 → RM-10 → RM-11 → RM-12 → RM-21 → RM-23 → RM-31 → RM-33 → RM-34 → RM-53 → RM-55`.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user