From 09875143c0eb1a78f0d2a2b07624945ece5e22fe Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Sat, 1 Aug 2026 12:05:07 -0500 Subject: [PATCH] docs(remediation): roll D-11 capability/identity bullets to the ledger (D-43: roll out, never reword) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Third application of D-43's rule today. Those two bullets restated D-11/D-11a/D-11b, which live authoritatively in TASKS.md, so they were a second copy waiting to go stale. Rolled verbatim; the board keeps a pointer plus the one operational line that is not a restatement — assert the differential as that seat, because a single endpoint can be true for anyone or 403 for an unrelated scope. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/BOARD-LEDGER.md | 10 ++++++++++ docs/remediation/BOARD.md | 10 ++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/docs/remediation/BOARD-LEDGER.md b/docs/remediation/BOARD-LEDGER.md index 5faeb4e9..ac24c624 100644 --- a/docs/remediation/BOARD-LEDGER.md +++ b/docs/remediation/BOARD-LEDGER.md @@ -60,3 +60,13 @@ because that repetition is what went stale. Builds 1-5, the cross-cutting retirements, and DECISION-1's corrected wire-in target are stated once in the charter and `TASKS.md` §5. **Not repeated here** — the previous copy of DECISION-1's status on this board is one of the six stale restatements below. + + + +- Capability is **per-path** (D-11b → **superseded in part by D-13/D-15**): a token file is **necessary, + not sufficient**. Three layers — token file (raw-API), `tea` login (tea paths), **repository permission** + (writes). Before dispatch, assert `permissions.push == true` **as that seat**, not token existence and + not a 200 on a read. Mos owns provisioning; escalate missing pairs. +- Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and + agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 3a1f4cdf..ea4d9c49 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -66,12 +66,10 @@ went missing from mission setup twice, once inside the correction for it (**D-26 - Freeze: LIFTED for this workstream only. - Git identity: orchestrator runs `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions. -- Capability is **per-path** (D-11b → **superseded in part by D-13/D-15**): a token file is **necessary, - not sufficient**. Three layers — token file (raw-API), `tea` login (tea paths), **repository permission** - (writes). Before dispatch, assert `permissions.push == true` **as that seat**, not token existence and - not a 200 on a read. Mos owns provisioning; escalate missing pairs. -- Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and - agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. +- Capability + seat identity (**D-11b / D-11a**, incl. the false-NEGATIVE twin): authoritative in + `TASKS.md`. Short form — **assert the DIFFERENTIAL as that seat** (authenticated `push:true` vs + unauthenticated `push:false`); a single endpoint can be true for anyone or 403 for an unrelated + scope. Full text rolled to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md). - ⚠ **LIVE HAZARD (D-37) — one shared `.git/config` re-identifies EVERY worktree at once.** Every seat, including `rev-974`'s review worktree, currently authors as **`coder-mos1`**; `MOSAIC_GIT_IDENTITY` does **not** override it. **STANDING ORDER: commit with explicit