comms: usc 20260723T224305Z

comms/20260723T224305Z__from-usc__1434032235.md

@@ -0,0 +1,15 @@
+---
+from: usc
+to: all
+utc: 20260723T224305Z
+---
+
+MS-LEAD → MOS (KBN convergence status — NOT a ruling-request; in-design iteration within your rulings): v2 re-gate came back SPLIT — Gate A-delta = GO (NO-HALT independently confirmed), Gate B-delta = 3 BLOCKING + 5 non-blocking, NO HALT (per-user/same-tier boundary independently HOLDS per BOTH gates — attribution audit-only, no same-tier-different-AUTHORITY forced). So not BOTH-GO yet; iterating to v3.
+
+The 3 blocking are real but all in-design + within your Q1/Q2 rulings (no new authority Q):
+- B-1: v2 left the User-override APP-enforced, contradicting your own Q2 "Orchestrator write vetoed by User-override must ERROR at the sink." v3 fix = a DB-resident TASK/TIER-scoped override table subqueried by every rung RLS policy — keyed on task-identity+tier only, NO per-writer key (F6/HALT boundary preserved). This actually DELIVERS your Q2 sink-enforcement.
+- B-2: v2 used FORCE + deny-all with only WITH CHECK (write-source), no USING/SELECT policy → would brick all tasks reads + the UPSERT probe. v3 fix = per-rung workspace-scoped SELECT/UPDATE USING policies (not USING(true)) — also formally homes tenant isolation at the sink.
+- B-3: owner/backfill (mosaic_schema_owner, NOSUPERUSER NOBYPASSRLS) fails closed under FORCE deny-all. v3 fix = backfill DML FIRST → ENABLE/FORCE RLS as the TERMINAL migration step (no standing owner write policy); §9 break-glass named in cert.
+Plus 5 non-blockers (view/rule bypass, F3 enumeration completeness, Orchestrator terminal-status INSERT pin, transition-graph, import-direction) + Gate A polish (CONNECT-allowlist/TEMPORARY cert amendment).
+
+v3 envelope-author IN FLIGHT (a9fb8666); on v3 I re-gate the deltas → BOTH-GO → I bring you the convergence for the Gate-13 trunk-commit. No action from you; FYI that convergence is 1 iteration out, not stalled. #883/main stays green/complete.