From 2201c30284d5836c8f4284fa5d7171e8a7827c6b Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 17:59:06 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20correct=20D-11(a)=20mechan?= =?UTF-8?q?ism=20=E2=80=94=20token=20identity=20and=20commit=20authorship?= =?UTF-8?q?=20are=20separate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per Mos. MOSAIC_GIT_IDENTITY resolves the TOKEN; commit author comes from git config user.name/user.email, a separate setting that fell back to the generic value. The export could never have fixed authorship — my worker brief instructed only the export, so the seat did what it was told and the commits were still mis-attributed. The error was in the brief before it was in the finding. Requirement is COHERENCE: token and authorship must agree; either half alone is drift. Belongs in seat setup, verified by an exit-asserting test that commits and asserts the author — not in prose a seat can follow correctly and still end up wrong. Capability check mechanized: capability IS token-file existence. Before dispatching seat X to provider Y, test gitea--.token exists. The token-file set is the authoritative capability registry. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 4a6248d8..b1ee3d93 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -97,10 +97,22 @@ is the class confirmed, not anecdote. Two defects, one dispatch (RM-01 → `f10-coder`): -**(a) Identity drift — P-WRAPPER-001, reproduced on our own delivery.** The brief instructed the seat -to `export MOSAIC_GIT_IDENTITY=f10-coder`. Its commits are authored -`mosaic-coder ` — the generic fallback. **You cannot tell from git history -which seat did this work.** Recorded, not rewritten: the drift is the evidence. +**(a) Identity drift — P-WRAPPER-001, reproduced on our own delivery.** The seat's commits are +authored `mosaic-coder ` — the generic fallback. **You cannot tell from +git history which seat did this work.** Recorded, not rewritten: the drift is the evidence. + +> **Mechanism, corrected (Mos).** My original framing here was wrong, and the error was in the brief +> before it was in the finding. `MOSAIC_GIT_IDENTITY` resolves the **token** (which per-slot credential +> the wrappers act with). The **commit author** comes from `git config user.name` / `user.email`, which +> is a **separate setting** — it fell back to the generic value because nothing set it. Exporting the +> identity could never have fixed authorship. **My worker brief instructed only the export, so the +> seat did exactly what it was told and the commits were still mis-attributed.** +> +> **The requirement is coherence: token and authorship must agree.** A seat acting with +> `gitea-mosaicstack-f10-coder` must also commit as `f10-coder `. +> Either half alone is identity drift — one produces the right credential with the wrong author, the +> other the reverse. That coherence _is_ P-WRAPPER-001, and it belongs in seat setup, not in prose +> instructions a seat may follow correctly and still end up wrong. **(b) Capability opacity.** Nothing at dispatch time revealed that `f10-coder` had no credential for the target provider. Per-slot tokens live at `~/.config/mosaic/secrets/gitea-tokens/`; the seat holds @@ -116,10 +128,18 @@ information_ did not exist. should declare what it can actually do — which providers, which repos, which credentials — and that declaration must be **checkable before dispatch**, not discovered by failure after the budget is spent. -**Requirements:** RM-50 (roster ownership) gains per-seat capability declaration and a pre-dispatch -capability check; RM-04 (activation coherence) gains the identity-binding half — a seat's declared -identity must provably reach its commits, verified by an exit-asserting test, not assumed from an -`export` in a brief. +**Requirements.** + +- **RM-04 (activation coherence)** gains the identity-binding half: seat setup must set **both** the + token identity **and** `git config user.name`/`user.email`, coherently. Verified by an + exit-asserting test that makes a commit and asserts its author — never assumed from an instruction + in a brief. +- **RM-50 (roster ownership)** gains per-seat capability declaration plus a **pre-dispatch capability + check**. Mos (who owns provisioning) confirms the check is mechanically trivial: **capability is + token-file existence.** Before dispatching seat `X` to provider `Y`, test that + `~/.config/mosaic/secrets/gitea-tokens/gitea--.token` exists; if absent, provision it or pick a + provisioned seat. **The token-file set is the authoritative capability registry.** A one-second check + would have replaced a mid-task failure that cost ~$9 and 69% of a seat's context. ### D-10 — the queue guard's failure modes are exactly backwards