From 2a9360407be4f66a9a752e0da7e1cd04b46e35c2 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Wed, 5 Aug 2026 14:52:52 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20bank=20D-53=20=E2=80=94=20?= =?UTF-8?q?a=20sender=20label=20that=20was=20wrong=20for=20hours=20while?= =?UTF-8?q?=20looking=20exactly=20right?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit agent-send.sh derived the sender label from the DESTINATION socket flag, so cross-socket messages were stamped with an arbitrary session from the socket the sender was not attached to. One lead's messages arrived for hours stamped as the recipient. Fixed on main; source now comes from the caller's own $TMUX. The label was false and plausible simultaneously, which is the only dangerous kind — a garbled label gets questioned, a label naming a real seat on a real socket does not. Same family as D-33's summary that resembles an enumeration and D-48's boundary statement that reads as rigorous. The transferable part is the fix's design choice: it now reports "?" rather than borrowing a plausible name. That is the same discipline as NOT-MEASURED, adopted the same day on the credential thread — absent must be rendered absent, not as a pass and not as a fail. An unknown rendered as a plausible value is consumed as fact; an unknown rendered as unknown is consumed as a question. Two subsystems, one day, same conclusion, independently. Audited my ledger on receipt: clean, zero mis-attributed sources in TASKS.md or BOARD.md. The reason is practice rather than luck — rulings were recorded from the message BODY, which carried its own [mos-claude -> mos-remediation] header, not from the transport envelope. Where a message self-identifies, the body is the claim and the envelope is metadata, and the envelope was the broken part. Routing defect now doctrine: the USC message was addressed to "orchestrator", a ROLE that exists on each estate, and agent-send resolves a session NAME. Binding rule: address seats, not roles, and estate-qualify any name that exists on both estates. The cost was bounded only because the recipient declined to act on another estate's delivery while still checking whether any line of it constrained its own — declining to act but silently letting a stale cross-estate constraint ride would have been the actual failure. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/BOARD.md | 6 +++--- docs/remediation/TASKS.md | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 3 deletions(-) diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 38348c54..149424d9 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -31,8 +31,8 @@ three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And re-derive any board claim from the provider before load-bearing use (D-43)** — the board is sole-written and has no independent verifier. -2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 53 findings - (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in TASKS.md), every ruling with its rationale, and the +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 54 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-53 + D-38c in TASKS.md), every ruling with its rationale, and the requirements each finding placed on RM-02/RM-34/RM-50/RM-55. 3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here. Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45, @@ -78,6 +78,6 @@ Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is ## Decisions log — full record in [`TASKS.md`](./TASKS.md) -All 53 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in `TASKS.md`) and every ruling with +All 54 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-53 + D-38c in `TASKS.md`) and every ruling with its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate — six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md). diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 9fc5c22c..73293ceb 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -641,6 +641,43 @@ a fourth anchor; ran independent code + security review **on its own fix**; comm (EROFS/EPERM) rather than substituting; named exit-97 as the known **#973/D-16** limitation rather than a finding. +### D-53 — a sender label that was WRONG for hours while looking exactly right + +`agent-send.sh` derived the **sender** label from the `-L ` flag. So a cross-socket +message was stamped with an **arbitrary session from the socket the sender was NOT attached to**. One +lead's messages arrived **for hours stamped as the recipient**. Fixed on `main`: source now comes from +the caller's own `$TMUX`. + +> **★ THE PROVENANCE LABEL WAS FALSE AND PLAUSIBLE AT THE SAME TIME — which is the only dangerous kind.** +> A garbled label gets questioned. A label naming a real seat that really exists on a real socket does +> not. Same family as **D-33** (a summary that resembles an enumeration) and **D-48** (a boundary +> statement that reads as rigorous). **Nothing about it invited scrutiny.** + +**★ THE FIX'S DESIGN CHOICE IS THE TRANSFERABLE PART: it now reports `?` rather than borrowing a +plausible name.** Refusing to guess beats guessing well. + +> **This is the SAME discipline as `NOT-MEASURED`, adopted the SAME DAY on the credential thread:** +> identity absent must be rendered **absent**, not as a pass and not as a fail. **An unknown rendered as +> a plausible value is worse than an unknown rendered as unknown** — the first is consumed as fact, the +> second is consumed as a question. Two subsystems, one day, same conclusion, reached independently. + +**Orchestrator ledger audited on receipt of the notice: CLEAN.** Zero mis-attributed sources reached +`TASKS.md` or `BOARD.md`. The reason is worth keeping as practice rather than luck: **rulings were +recorded from the message BODY (which carried its own `[mos-claude -> mos-remediation]` header), not +from the transport ENVELOPE.** Where a message self-identifies, the body is the claim and the envelope +is metadata — **and the envelope was the part that was broken.** + +**ROUTING DEFECT, now doctrine:** the USC message was addressed to **"orchestrator" — a ROLE, and there +is one on EACH estate**. `agent-send.sh` resolves a session NAME, so a role-addressed message routes to +whichever seat happens to carry that name on the socket in reach. + +> **BINDING: ADDRESS SEATS, NOT ROLES; ESTATE-QUALIFY ANY NAME THAT EXISTS ON BOTH ESTATES.** + +Nothing misfired — **the addressee was ambiguous.** The cost was bounded only because the recipient +declined to act on another estate's delivery **while still checking whether any line of it constrained +its own estate.** Declining to act but silently letting a stale cross-estate constraint ride would have +been the actual failure. + ### D-51 — the fix is merged, the issue is closed, and the RUNNING TOOL IS STILL BROKEN `#1032` merged (`58b971ab`), `#1019` closed, both verified by property. **RM-03 is delivered to `main`.**