docs(prd): fold 2026-07-09 debate-pass findings into Mosaic Platform PRD

All 24 panel findings (P0#1-5, P1#6-13, P2/P3#14-24) accepted and folded: - DEBATE-FINDINGS.md: disposition record + open-disagreement judgment calls - north-star: NS-14, J2a/J2b split, J6 wake router, K3 push pipeline, M1 memory subsystem, workstream L (MALS lineage), real DAG edges - J: workspace lease J-R16, resume protocol J-R18, write-side trust, needs-decision lifecycle, atomic card publish - P: CAS approval state machine, gateway-only credentials, default-closed gating, principal resolution + policy snapshot (Codex #2/#7) - W: butt-in exclusive lease, structured control plane, break-glass doctrine, trial metric panels - Q: external_refs table, pending-link, echo-loop guard, crash barriers - X: storage authority (Postgres sole record), machine-generated census, memory retrieval-eval retirement gate, honest rollback scope, 4 artifact-existence machine gates, bounded day-30 review - README: Gate Zero, conflict register, DoD line, silent-roster rule One item OPEN for Jason at ratification: gate superstructure (§3.1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RMoEx7hfdFGjUiCHuN1RRi
2026-07-09 16:29:37 -05:00
parent 6b8c3c5d3a
commit 2708de55b9
8 changed files with 314 additions and 81 deletions
--- a/docs/fleet/proposals/mosaic-platform-prd/north-star-additions.yaml
+++ b/docs/fleet/proposals/mosaic-platform-prd/north-star-additions.yaml
@@ -7,7 +7,7 @@
 standing_objectives:
  - id: NS-10
    text: >-
-      Every Mosaic system runs exactly one always-on HMI main agent (default
+      Every Mosaic workspace runs exactly one always-on HMI main agent (default
      alias "Jarvis", unit mosaic-agent@main) that owns all human conversation
      and user-level personal-assistant work (ideas, schedule, email, tasks,
      knowledge) and delegates engineering/research/ops missions to the
@@ -16,7 +16,8 @@ standing_objectives:
      coding/infra tasks itself, and it runs on model capacity separate from the
      orchestrator so its conversational latency is isolated from fleet load. The
      main agent never executes fleet work itself and never interrupts the
-      orchestrator for status.
+      orchestrator for status. Exactly-one-per-workspace is enforced by a
+      workspace lease (J-R16), not by convention.
  - id: NS-11
    text: >-
      Irreversible or externally-visible agent actions pass a human-in-the-loop
@@ -32,14 +33,23 @@ standing_objectives:
      Hermes is fully decommissioned once Mosaic reaches verified parity on
      transport (Matrix connector), task board (native backlog + webUI),
      permission relay, and multi-platform reach (mautrix bridges).
+  - id: NS-14
+    text: >-
+      Mosaic Stack accepts inbound structured error/log reporting from every
+      agent and install (MALS-lineage logging service); agentic-efficiency
+      telemetry is optional, opt-in, and anonymous by construction — no IP or
+      PII is captured or derivable from the ingestion path.

 success_criteria:
  - id: AC-NS-8
    text: >-
      A user converses with the main agent in its channel while the
      orchestrator is under full load; because the main agent runs on separate
-      model capacity, its response latency is unaffected and the orchestrator
-      receives zero conversational traffic.
+      model capacity (distinct credential/quota pools pinned in the J1
+      profile), its response latency is unaffected and the orchestrator
+      receives zero conversational traffic. Measured, not vibes: scripted
+      suite, >=30 interleaved turns, TTFT p95 <= 1.2x idle baseline with
+      bootstrap CI.
  - id: AC-NS-9
    text: >-
      A mission agreed in the main-agent conversation appears as a backlog card
@@ -69,6 +79,10 @@ workstreams:
    title: Backlog provider sync adapters — Gitea/GitHub/local kanban
  - id: X
    title: Hermes decommission & tenant-1 migration
+  - id: M
+    title: Enhanced memory subsystem — vector DB + memory service + provenance/tombstones (Gate Zero MISSING artifact)
+  - id: L
+    title: Logging & telemetry — MALS-lineage inbound error reporting + optional anonymous efficiency telemetry

 goals:
  # J — HMI main agent
@@ -77,11 +91,18 @@ goals:
    phase: 1
    priority: must-have
    depends_on: [H2]
-  - id: J2
-    title: PA toolchain — email, calendar, tasks, knowledge, tickets executed directly against the product API in the user's workspace
+  # J2 split (debate P0 #2): phase-1 Jarvis must not hold an external-write
+  # credential path before the permission relay (P2) exists — NS-11 by DAG.
+  - id: J2a
+    title: PA toolchain (workspace-internal) — tasks, events, knowledge, ideas executed directly against the product API in the user's workspace; no external credentials provisioned
    phase: 1
    priority: must-have
    depends_on: [J1]
+  - id: J2b
+    title: PA toolchain (external integrations) — email, external calendars, helpdesk via workspace-scoped integrations; credentials gateway-held; requires_approval routes through the relay
+    phase: 2
+    priority: must-have
+    depends_on: [J2a, P2]
  - id: J3
    title: Delegation contract — main agent authors mission cards (goal, acceptance criteria, budget advisory) onto the backlog; orchestrator drains; no chat-level handoff
    phase: 1
@@ -97,6 +118,11 @@ goals:
    phase: 2
    priority: must-have
    depends_on: [J1, K1]
+  - id: J6
+    title: Shared event/wake router — level-triggered reconciler over durable state (heartbeats, cards, approvals) with hysteretic per-condition suppression; templated provenance-tagged wake turns; per-agent polling forbidden (Gate Zero MISSING artifact; J-R13 depends on it)
+    phase: 1
+    priority: must-have
+    depends_on: [J1]

  # K — connectors & reach (extends f4-matrix-connector.md)
  - id: K1
@@ -104,11 +130,19 @@ goals:
    phase: 2
    priority: must-have
    depends_on: []
+  # K2 scope (debate §3.7): a pre-ratification Hermes traffic audit narrows the
+  # must-have bridge subset to platforms with live traffic; only that subset
+  # gates X3 — remaining bridges are genuinely optional post-X3.
  - id: K2
-    title: mautrix bridge deployment (telegram/signal/whatsapp/slack/discord) as GitOps-managed infra; agents speak only Matrix
+    title: mautrix bridge deployment (telegram/signal/whatsapp/slack/discord) as GitOps-managed infra; agents speak only Matrix; must-have subset = platforms carrying live Hermes traffic per Gate Zero audit
    phase: 3
    priority: should-have
    depends_on: [K1]
+  - id: K3
+    title: Push pipeline (Sygnal or equivalent) + homeserver ops — monitored delivery checks, health-floor registration, rehearsed backup/restore (Gate Zero MISSING artifact; P2 phone-approval AC depends on it)
+    phase: 2
+    priority: must-have
+    depends_on: [K1]

  # W — webUI fleet control (realizes F6)
  - id: W1
@@ -168,18 +202,47 @@ goals:
    priority: must-have
    depends_on: [K1, P2, Q1]
    # jarvis-brain is the P0 (prototype) Mosaic Stack; migration targets the proper
-    # stack storage layer (vector DB + enhanced memory + flat-file backends).
+    # stack storage layer. Storage authority (debate P0 #1): Postgres is
+    # authoritative for ALL product entities; the flat-file backend is a derived,
+    # regenerated, READ-ONLY projection — never a second writable store.
  - id: X2
-    title: 'Tenant-1 migration — P0 (jarvis-brain) into the proper Mosaic Stack: (a) PA data (projects/tasks/events/tickets/knowledge) into the Jason workspace, (b) agent memory/runbooks into the enhanced memory subsystem (kept live, not frozen); jarvis-brain retires read-only only after both are verified'
+    title: 'Tenant-1 migration — P0 (jarvis-brain) into the proper Mosaic Stack: (a) PA data (projects/tasks/events/knowledge) into the Jason workspace, (b) agent memory/runbooks into the enhanced memory subsystem M1 (kept live, not frozen); jarvis-brain retires read-only only after both are verified'
    phase: 3
    priority: must-have
-    depends_on: [J2]
+    depends_on: [J2a, P2, M1]
  - id: X3
-    title: Hermes decommission — stop and remove Hermes services after AC-NS-11 verified
+    title: Hermes decommission — stop and remove Hermes services after AC-NS-11 verified; pre-stop evidence snapshot (logs/config/callback inventory + checksum) is a machine gate
    phase: 4
    priority: must-have
    depends_on: [X1, X2, K2]

+  # M — enhanced memory subsystem (Gate Zero: cited by X2(b) but not built by
+  # any prior workstream — this card closes that gap)
+  - id: M1
+    title: Enhanced memory subsystem — vector DB + memory service with mandatory provenance (human/agent/external), source-grounded retrieval preference, tombstones + re-embedding on source update, normative/parametric corpus split
+    phase: 2
+    priority: must-have
+    depends_on: []
+
+  # L — logging & telemetry (Jason 2026-07-09; NS-14). MALS (~/src/mals) is the
+  # P0 of this capability; restoring it is infra work tracked as
+  # infrastructure#135 (k3s migration landed without an Ingress).
+  - id: L1
+    title: MALS restored & exposed — k3s Ingress for mals.mosaicstack.dev, health verified, authenticated write smoke-tested (infrastructure#135); trial day-1 metric emission targets MALS until W3 panels exist
+    phase: 1
+    priority: must-have
+    depends_on: []
+  - id: L2
+    title: Mosaic-native log ingestion — gateway/API endpoint for structured inbound error reporting from agents and installs (MALS-compatible schema; levels, categories, trace ids), workspace-scoped keys
+    phase: 2
+    priority: must-have
+    depends_on: [L1]
+  - id: L3
+    title: Anonymous agentic-efficiency telemetry — opt-in, aggregate-only, no IP/PII captured or derivable at ingestion (NS-14); feeds W3 trend panels
+    phase: 3
+    priority: should-have
+    depends_on: [L2, W3]
+
 assumptions:
  - id: ASM-5
    vetoable: true