From 1e069946ffdf502931de064d050ed469baa311d5 Mon Sep 17 00:00:00 2001 From: fred Date: Thu, 27 Aug 2026 05:19:30 -0500 Subject: [PATCH] =?UTF-8?q?contract(onboarding-wizard):=20revision=2015=20?= =?UTF-8?q?=E2=80=94=20bootstrap-status=20envelope=20split=20(NEW-20=20res?= =?UTF-8?q?idual),=20active-window=20mutant=20attribution=20(NEW-22)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sol r14 re-review left two findings. NEW-20 residual (BLOCKER): §2.3 closed the bootstrap-status response to epoch/mode with no other field, conflicting with contract 5 §4.3's mandatory correlation echo on mapped operations (§§1.1, 7 item 8). Rev 14's state-derived/envelope split is now applied to bootstrap-status: §2.3 bounds state-derived content only and carries the contract 5 §4 envelope; §6 item 2's closed-field assertion and §7 item 2's description follow. Contract 5 not amended. NEW-22 (MAJOR): the active-window witness claimed its seed-workspace- scoped mutant fails branches (b) and (c); it passes (c). The witness now attributes (b) to that mutant, names the separate all-workspace mutant branch (c) catches, and states branches (a)/(b)/(c) start from isolated copies of the same incomplete pre-state. Preamble: Revision 15 paragraph; Revision 14 superseding note. --- docs/requirements/onboarding-wizard.md | 75 +++++++++++++++++++++----- 1 file changed, 61 insertions(+), 14 deletions(-) diff --git a/docs/requirements/onboarding-wizard.md b/docs/requirements/onboarding-wizard.md index fcb67804..67153aa2 100644 --- a/docs/requirements/onboarding-wizard.md +++ b/docs/requirements/onboarding-wizard.md @@ -371,7 +371,31 @@ canonical-reference resolution, the constant shape scoped to callers that reached the gate — and the child-race control asserts the refusal class, pinning the order mechanically, with the cross-surface shape control asserting one constant conflict -shape across the gate, succession, and query surfaces. +shape across the gate, succession, and query surfaces. (Revision 15 +extends this revision's envelope reconciliation to the +bootstrap-status response and corrects the active-window witness's +mutant attribution.) + +Revision 15 (sol re-review 14: NEW-20 residual, NEW-22): the +envelope reconciliation reaches the last closed response, and the +active-window witness names its mutants correctly. +**Bootstrap-status envelope** (NEW-20 residual): §2.3's closed +two-field response now bounds its STATE-DERIVED content only — +pre-epoch `epoch` plus `mode`, post-epoch `epoch` alone, no other +state-derived field — while the response remains an ordinary +contract 5 §4 result DTO whose fixed envelope frame carries the +request's own correlation ids, echoing the caller's request and +deriving from no stored record; §6 item 2's closed-field assertion +and §7 item 2's disclosure description follow. Contract 5 is not +amended. **Mutant attribution** (NEW-22): the active-window witness +now states that branches (a), (b), and (c) each start from an +isolated copy of the same incomplete pre-state (branch (a) commits +a state change), attributes branch (b)'s detection to the +seed-workspace-scoped incorrect evaluator, and names the separate +all-workspace incorrect evaluator that branch (c) catches — the +seed-workspace-scoped mutant, correctly refusing outside the seed +set, passes branch (c), so the two branches detect distinct +mutants. No other change. Scope: the Gateway-backed product onboarding wizard. Out of scope: the host-local install wizard (`mosaic wizard`, which drives host install and @@ -486,16 +510,23 @@ through the extensibility rule §2.4). unreachable there; the pre-epoch flow instead branches on the mode value reported by the **unauthenticated bootstrap-status response** of the bootstrap surface (identity §3), which evaluates the mode - record server-side. The bootstrap-status response is a **closed - two-field schema**: `epoch` — one field whose value set is exactly + record server-side. The bootstrap-status response's **state-derived + content is a closed two-field schema**: `epoch` — one field whose + value set is exactly the bootstrap epoch states identity §3 defines for `bootstrap_state`, closed to the exact wire-token pair **`open`** and **`completed`** — identity §3 names the two epoch states in prose but defines no wire enumeration, so this contract pins the tokens, as the second clause of the disclosed §7.9 amendment — and `mode` — the recorded mode value, present **only while the epoch - is open** and absent from the response schema once the epoch has - completed. No other field exists in the response. The unauthenticated pre-epoch + is open** and absent from the state-derived content once the epoch + has completed. No other state-derived field exists in the + response, and the response remains an ordinary contract 5 §4 + result DTO: its fixed envelope frame carries the request's own + correlation ids — echoing the caller's request, deriving from no + stored record, and disclosing no state — so the closed schema + bounds disclosure of state and amends nothing in + contract 5. The unauthenticated pre-epoch mode disclosure is a disclosed amendment to contract 6 §2.2's authenticated-read rule (§7.9); post-epoch, §2.2's authenticated-only rule holds unchanged and the bootstrap-status @@ -1223,12 +1254,17 @@ Binding on the implementing PRs: 2. **Mode witnesses:** the branch point exists — a pre-epoch flow resolves its step set from the bootstrap-status mode field (§2.3), a post-epoch run from contract 6 §2.2's authenticated read; the - bootstrap-status response matches §2.3's closed two-field schema + bootstrap-status response's state-derived content matches §2.3's + closed two-field schema exactly while the epoch is open — the epoch field carrying one of §2.3's two exact wire tokens — and after the epoch completes - contains the epoch field only — the mode field absent from the - response (closed-field assertion on the response schema in both - phases); post-epoch, an unauthenticated mode read through any + contains the epoch field only — the mode field absent + (closed-field assertion on the state-derived content in both + phases, with the response's contract 5 §4 envelope asserted to + carry the request's own correlation ids — present, equal to the + request's, derived from no stored record — and no further + state-derived field in either + phase); post-epoch, an unauthenticated mode read through any surface is refused (contract 6 §2.2, as amended by §7.9, holds); v1 with mode `standalone` yields the §3 step set; a simulated unsupported or unreadable mode record yields one bounded precondition refusal (§2.3) and no partial flow; wizard sources @@ -1566,13 +1602,22 @@ Binding on the implementing PRs: second kanban item — which is refused by the owning content contract's authorization with nothing written; and (c) a content command against a workspace outside the seed set, - refused likewise; this witness is discriminating where the + refused likewise; branches (a), (b), and (c) each start from + an isolated copy of the same incomplete pre-state — branch (a) + commits a state change, so no branch runs in another's + post-state; this witness is discriminating where the post-completion refusal below is not — an incorrect evaluator scoped by completion state rather than by canonical key (one granting the designation all seed-workspace writes while seeding is incomplete) passes the post-completion test but - fails branches (b) and (c) here, because they refuse while - seeding is still incomplete; after branch (a) commits, read + fails branch (b), which refuses while seeding is still + incomplete, and a second, broader incorrect evaluator (one + granting the designation writes in EVERY workspace while + seeding is incomplete) passes the post-completion test but + fails branch (c) — the control against that all-workspace + bypass, which the seed-workspace-scoped evaluator, correctly + refusing outside the seed set, would pass; after branch (a) + commits, read attempts by the acting designation and by a later successor against BOTH predecessor-created and successor-created seed content are refused — the bounded origination response is the @@ -1689,8 +1734,10 @@ contracts and are not additions: 1. Enrollment-step skippability (§3.5) — the PRD step list does not mark the step optional. 2. The unauthenticated bootstrap-status mode disclosure — the closed - two-field response schema (epoch state plus the recorded mode - value, the latter present during the bootstrap epoch only) (§2.3). + two-field state-derived response content (epoch state plus the + recorded mode value, the latter present during the bootstrap + epoch only), carried in an ordinary contract 5 §4 result DTO + whose envelope echoes the request's correlation ids (§2.3). 3. The **bootstrap finalize command** (§3.3) — an extension of identity §3's bootstrap surface: one transaction carrying the first-admin fields, the collected settings, registration-mode, and