diff --git a/docs/compaction-refresh/governance/GATE0-PROBE3-EXEC-AMENDMENT.md b/docs/compaction-refresh/governance/GATE0-PROBE3-EXEC-AMENDMENT.md new file mode 100644 index 0000000..1987687 --- /dev/null +++ b/docs/compaction-refresh/governance/GATE0-PROBE3-EXEC-AMENDMENT.md @@ -0,0 +1,109 @@ +# Gate0 Charter Amendment — Probe-3 (D4) Evidence-Class EXECUTION Authorization + +**Status:** DRAFT (revision 2) — supersedes prior candidate pin `8fca5b7a`; pending Mos re-scope-verify BEFORE +re-pin is ratified. Revised per Mos adjudication directive (2026-07-18): §3 = D4-focused Option A; §1 = explicit binding model. +**Amendment type:** Additive durable-authority amendment (does NOT mutate any ratified pinned doc in place). +**Milestone:** 188 — Compaction-Refresh Mechanism · **Issue:** Gitea #827 (WI-0 Gate0) · gates WI-3 #830 merge. + +--- + +## 1. Authorized source (why this amendment is valid) + +Per the Mosaic governance principle (OpenBrain `f0cb61b6`, permanent; fail-closed / DO-178C): a durable +Gate0 execution-hold clears ONLY by **(i) explicit user (owner) authorization** OR **(ii) a durable-authority +amendment from an authorized source**. A runtime coordinator's verbal GO does NOT qualify. + +- **Owner authorization (i):** Jason (owner / north-star) directed in `#mos` **2026-07-18 17:28Z** — *"amend the + charter"* (option **B** from the WI-3 escalation), quoting the escalation back. This is the direct-user + authorization artifact that homelab's durable-Gate0 objection (2026-07-18 06:34:56Z) explicitly named as a + valid resolution condition (*"user artifact OR auth amendment"*). Relayed + authenticity-adjudicated by Mos + (`web1:mos-claude`). Owner outranks any peer-lane durable authority. +- **Amendment (ii):** this document, authorized BY that owner directive. + +Both qualifying conditions are therefore satisfied. Homelab's stated condition is met by the owner artifact; +homelab is NOTIFIED as a transparency step (it holds durable-Gate0 standing and raised the original catch), +but its co-sign is not a gate (owner > peer). + +**Binding model (explicit — how this SHA is authorized).** The authority binding for this amendment's pinned +bytes is the composition of two distinct acts: +1. **Owner class-authorization (PRE-SHA):** Jason (owner) authorized the *class of action* — "amend the + charter" (option B), `#mos` 2026-07-18 17:28Z. This occurred **before** these amendment bytes (and hence + this SHA256) existed; the owner authorized the amendment, not a specific hash. +2. **Independent-adjudicator byte-verification:** Mos (`web1:mos-claude`), acting as the independent + adjudicator (author ≠ verifier — MS-LEAD authored, Mos verifies), scope-verifies the **exact bytes** of + this document and confirms they express only the owner-authorized narrow scope. + +There is therefore **NO single "Jason-signs-the-SHA" artifact, and none is required** under this binding +model: owner-authorized-class + independent-adjudicator-byte-verify **is** the binding. This is the durable, +inspectable chain of custody for the pin. + +## 2. Charter provisions amended (sha-pinned, unmutated) + +This amendment attaches to — and does NOT rewrite — the ratified Gate0 charter provisions: + +- `compaction-refresh-BUILD-BRIEF.md` §5 / R4 "Gate0 = BUILD-ADMISSION GATE", specifically the item: + *"Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4)."* + sha256 `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b` (intact/unchanged). +- `compaction-refresh-SPEC-RATIFICATION.md` R4. + sha256 `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` (intact/unchanged). + +The two pinned docs remain byte-identical; this amendment is the delta of record. + +## 3. What is authorized (NARROW — D4-focused harness ONLY) + +Adjudicator ruling (Mos, `web1:mos-claude`): "D4-only" against the existing runner is non-executable — the +only runner (`pi_gate0_run.py`) drives P2+P5+P6+D4 in one flow, and D4 intrinsically requires a +promoted-to-VERIFIED baseline (spec L219: "P3 immediately follows the valid P2 promotion so reload must +revoke a genuinely VERIFIED prior gen") to revoke a genuine prior generation. Therefore authorize EXACTLY the +minimal executable form (Option A) required as WI-3 (#830) merge-gate (2): + +- **D4-focused harness:** spawns **ONLY** `p3_generation_broker.py` (not the full `pi_gate0_run.py` runner). +- **Minimal promotion-to-VERIFIED, as a FIXTURE PRECONDITION ONLY:** established solely so the D4 revoke has a + genuine `VERIFIED` target. This is **NOT** authorization to bank P2 as an independent evidence class. +- **D4 same-PID `runtime_generation`-bump revoke observation:** new generation → `MUTATOR_UNVERIFIED`; + prior (superseded) generation → `STALE_GENERATION`. +- **Explicitly EXCLUDED:** P5 (missing / oversize / hash-invalidation) and P6 (atomic-observation) — not + needed for the WI-3 D4 gate and **not authorized** by this amendment. +- **Isolation / integrity (per §4/§5):** 3× repeated, isolated runs; hardened deterministic harness; + non-destructive; launches broker/socket/state artifacts in an isolated fixture ONLY; **does NOT touch + production**, mutates no live lease/broker/deployment, creates no durable side effect outside the fixture; + a **FAIL** returns to planner — no retry-launder. + +**Intrinsic-precondition boundary (verbatim):** the promotion step is a D4 test fixture, not a P2 +evidence-gathering authorization; P5/P6 remain unauthorized. + +## 4. What is NOT authorized (all other holds remain in force) + +- This is **NOT** a blanket Gate0-execution release. Every other Gate0 execution item and every standing + execution hold remains exactly as-is. +- No live mutation, migration, canary, deployment, systemd, tmux-fleet, or connector/socket/Hermes action is + authorized by this amendment. +- Authorizes producing THIS evidence class once (3× isolation is the evidence-integrity requirement, not a + license to re-run on failure): a **FAIL** returns to planner — **no retry-launder**, no severity-laundering. + +## 5. Preserved fail-closed / DO-178C invariants (verbatim, unchanged) + +- Producing probe evidence **EXECUTES** the Gate0 mechanism (launches processes, creates socket/state + artifacts, exercises revocation transitions); "isolated + non-destructive" does **not** make it + non-execution. This amendment authorizes that execution for the narrow class in §3 — it does not redefine + execution as non-execution. +- A sha-pinned DURABLE authority OUTRANKS a runtime coordinator's verbal GO; when they conflict the durable + artifact wins. This amendment derives its authority from the OWNER, not from a coordinator. +- Card-advancement gates and execution-holds are distinct; this amendment lifts ONLY the §3 execution-hold, + not any advancement/review/SECREV gate. WI-3's independent-review + Opus-SECREV + green-suite gates stand. + +## 6. Effect on WI-3 (#830) merge chain + +On this amendment being pinned (Mos-verified + Jason-shown): a fresh lane (ms-rev-826) executes the §3 +probe-3 evidence class (3× isolation) → PASS/FAIL reported to Mos. **On PASS**, and only after re-confirming +WI-3 head `f4008307` UNMOVED + FIRE-PRECONDITION-0 (fresh `mosaic-context-refresh` attestation for +mosaic-100 + planner-opus), the existing chain runs: CI queue-guard → push → PR → mirror RoR → relay full-40 +head + pr/ci# → Mos independent 6-check → squash `closes #830` → chain WI-4→7. **On FAIL**: planner-return. + +--- + +**Amendment author:** MS-LEAD (`web1:mosaic-100`), Gate0 governance interface / charter custodian. +**Pin protocol:** this file's sha256 becomes the amendment pin ONLY after Mos re-scope-verify. Reported to Mos +before any ratification/publication, per the transparency checkpoint on a durable-authority change. Ratification +and durable publication (to a homelab-inspectable provider ref) are the adjudicator's (Mos), NOT the author's +(MS-LEAD) — the author does not self-ratify and does not publish. diff --git a/docs/compaction-refresh/governance/charter-BUILD-BRIEF.md b/docs/compaction-refresh/governance/charter-BUILD-BRIEF.md new file mode 100644 index 0000000..c720014 --- /dev/null +++ b/docs/compaction-refresh/governance/charter-BUILD-BRIEF.md @@ -0,0 +1,106 @@ +# Compaction-Refresh Mechanism — BUILD BRIEF (Mos → MS-LEAD) + +**Status:** STAGED — do NOT dispatch until PR #826 (#824 skill-CLI bridge) MERGES. Mos routes this to +MS-LEAD at #824 land. PLAN phase COMPLETE + RATIFIED; this is the BUILD-execution brief. +**Routed by:** Mos (main orchestrator). **Owner:** MS-LEAD (mosaic-100). **Runtime scope M1:** Claude + Pi. + +## 1. AUTHORITY (sha256-pinned — build AGAINST these, do not re-derive) +| Artifact | Path | SHA-256 | +|---|---|---| +| **Ratification record (SSOT)** | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md` | `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` | +| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` | +| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` | + +The coder MUST verify these hashes before building. The in-context working spec is DERIVED and +compaction-fragile — the sha256'd records above are the recovery SSOT (durable-authority discipline). + +## 2. TARGET & SCOPE +- **Framework-native `packages/mosaic/…`** in `mosaicstack/stack`. NOT jarvis-brain. NOT + `~/.config/mosaic/` directly (that tree is WIPED on framework upgrade — durable home is SOURCE). +- **M1 = Claude + Pi orchestrators only.** Codex/other runtimes = scope-note only. +- **Hard dependency (now satisfied at dispatch):** the `mosaic skill` register/list + install/upgrade + symlink auto-sync (#824 / PR #826) — so the durable `mosaic-context-refresh` skill ships REACHABLE + (auto-symlinked into `~/.claude/skills/`). Do not dispatch before #826 merges. + +## 3. DELIVERABLES (locked architecture — from the ratification record; do NOT redesign) +1. **Authenticated external lease broker** bound to kernel `SO_PEERCRED` `(pid, starttime, + runtime_generation)` — the only unforgeable identity on a same-uid tmux fleet. Broker **MINTS** the + logical `session_id` at first peercred contact (NEVER caller-asserted). Distinct-principal / + protected socket. +2. **Whole mutator-class gate** (not per-wrapper): no consequential mutator succeeds without a valid + VERIFIED lease. **Revoke-first / promote-last.** +3. **Compaction observers → revoke:** Claude `PreCompact` + `SessionStart(matcher=compact)`; Pi + `session_before_compact`/`context` equivalents. Any `runtime_generation` bump (reload/resume/fork, + same PID included) auto-revokes the prior incarnation. +4. **Verbatim-hashed normative fragments:** `B_payload` (exact fragments + deterministic metadata) and + `H_payload = SHA256(domain_sep ‖ length_framed(B_payload))` — NO self-reference (byte-identical + across the Claude and Pi builders). +5. **Receipt-challenge protocol (promotion prerequisite, NOT the safety mechanism):** broker mints a + single-use `receipt_challenge` per cycle bound to `(session_id, runtime_generation, + compaction_epoch, request_epoch, H_source, H_payload, schema_version)`. **COMPUTE = broker** + (observes latest-assistant message, computes the binding incl `H(latest-assistant-message)`); + **COPY = model** (verbatim copy of challenge + `H_payload` — an LLM cannot hash its own output; + T29). Observed in the EXACT latest assistant message (Claude: latest assistant entry + pending + challenge, NO transcript grep; Pi: `message_end`, NOT `after_provider_response`). Single-use, + consumed before the tool batch. Broker transition order (mandatory): `revoke → build + B_payload/H_payload → PENDING_DELIVERY(mint unique challenge) → deliver → observe exact receipt → + evidence commit → consume challenge → promote VERIFIED (last)`. +6. **Constrained recovery command** = the single ungated mutator; the `mosaic-context-refresh` skill + is its wrapper (uses a newly-minted challenge + identical protocol; cannot replay normal-path + receipt). Durable skill lands here, symlink-reachable via #824. +7. **T-C server-side line = branch protection** (the irreducible guarantee; client gate is + window-narrowing only). If ops-config rather than code, DOCUMENT the required posture explicitly. + +## 4. BINDING BUILD CONDITIONS R1–R6 (MANDATORY — verbatim from ratification record) +- **R1 (honesty):** state that the receipt detects ABSENT or PREFIX-TRUNCATED terminal token, but a + MIDDLE-DROP preserving the tail is a **T-C contract violation, NOT receipt-detectable** (covered by + server-side). No over-claim. +- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker + transaction; a crash leaves neither VERIFIED-with-live-challenge nor consumed-with-ambiguous-promote; + recovery mints a NEW challenge, never reuses. +- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject + quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, multiple receipts. +- **R4 (Gate0 = BUILD-ADMISSION GATE):** see §5 — runtime evidence BEFORE build admission; a failed + Gate0 item RETURNS the design to planner review, it is NOT waived by the GO. +- **R5 (TTL):** 300 s MAX lease TTL + soak-tighten; soak may only SHORTEN, never lengthen. Mos-accepted. +- **R6 (receipt semantics):** receipt = T-A delivery/liveness ONLY, never obedience/safety/residency. + Permanent invariant. + +## 5. R4 GATE0 — RUNTIME EVIDENCE BEFORE BUILD ADMISSION (WI-0, do this FIRST) +Structure the build like gitwatch: **WI-0 is a Gate0 runtime-evidence probe; no feature build admitted +until every item produces POSITIVE runtime evidence** (not a design assertion). A failed item RETURNS +to planner — do not paper over: +- Launcher `exec`/parent topology + supported-hook ancestry (D1); broker authenticates the launcher + chain, rejects sibling-substitution. +- Pi lifecycle: last-position invariant (last-or-closed), per-tool nonce → tool-call-id map (D5). +- Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4). +- Broker socket authenticity posture (protected / distinct-principal); `SO_PEERCRED` returns the true + `(pid, starttime)`. +- Source-invalidation fail-closed (missing/oversize/hash-mismatch fragment → no promotion). +- Claude `additionalContext` + Pi `context` inject atomically (A-v5-1) — the transport assumption + T27 rests on; verify or class the gap T-C. + +## 6. ACCEPTANCE TESTS (red-first TDD) +Carry all v4 ACs + T12b; add **T24–T30**: T24 hash-construction no-self-reference byte-identical across +builders · T25 replay rejected · T26 transcript-stale-match cannot promote · T27 partial-delivery +(prefix-trunc/tail-only/middle-drop/malformed) none promote · T28 single-use (no renew/reopen) · T29 +model copies not computes · T30 dual-hook-miss matches AMENDED threat table within+after TTL. +Acceptance = full green suite + Gate0 evidence pack. + +## 7. REVIEW & MERGE DISCIPLINE +- **This IS an Opus-SECREV-mandatory surface** — UNLIKE #824 (local same-uid FS). The broker is an + authentication/identity/authorization mechanism (peercred binding, session_id minting, mutator-class + gating, receipt protocol). Security review = **Opus-SECREV, no GPT/terra substitute** on the + broker/gate/receipt/socket surfaces. Functional/non-security parts may take GPT review. +- **Author ≠ reviewer**, independent review, no self-merge, exact-head RoR (reviewed-SHA=merged-SHA), + `closes #` close-keyword, full 40-char head. Never edit tests to pass / never force-merge red + / never `--no-verify`. +- **Mos merges** (per ratification record) after Opus-SECREV + independent review pass + green suite + + Gate0 pack. Decompose into work-items (WI-0 Gate0 first); likely a milestone, not one monolithic PR. + +## 8. SEQUENCING +#826 (#824 bridge) MERGES → Mos routes this brief → MS-LEAD decomposes (WI-0 Gate0 first) → build M1 +(Claude+Pi) → Gate0 evidence pack (failed item → planner) → Opus-SECREV + independent review → Mos +merges → durable `mosaic-context-refresh` skill lands symlink-reachable → jarvis-brain `CLAUDE.md` +mandate PR aligns to the shipped receipt/hash contract. Interim skill + CLAUDE.md mandate stay LIVE +until the mechanism ships. diff --git a/docs/compaction-refresh/governance/charter-SPEC-RATIFICATION.md b/docs/compaction-refresh/governance/charter-SPEC-RATIFICATION.md new file mode 100644 index 0000000..6168916 --- /dev/null +++ b/docs/compaction-refresh/governance/charter-SPEC-RATIFICATION.md @@ -0,0 +1,75 @@ +# Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD + +**Ratifier:** Mos (main fleet orchestrator, `mos-claude`) +**Date:** 2026-07-17 ~22:2xZ +**Decision:** ✅ **RATIFIED — GO WITH BINDING CONDITIONS R1–R6.** Architecture converged v1→v5 via +oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required. + +## Authenticated authority artifacts (sha256-pinned) + +| Artifact | Path | SHA-256 | +|---|---|---| +| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` | +| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` | +| (base) SPEC v4 | `~/agent-work/reviews/compaction-refresh-SPEC-v4.md` | `a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80` | +| (base) sol v4 red-team | `~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md` | `1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f` | +| Ratification-Input (R1-R6 + rulings, provenance-clean) | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md` | `d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266` | + +## Convergence trail +v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch +locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → **v5 GO-with-conditions**. + +## Locked architecture (do not redesign) +Authenticated external **lease broker** bound to kernel `SO_PEERCRED` (pid, starttime, +runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the +logical session_id at first peercred contact (never caller-asserted). **Revoke-first / promote-last.** +Whole **mutator-class gate** (not per-wrapper). Verbatim-hashed normative fragments. Single +**constrained recovery command** = the only ungated mutator; the `mosaic-context-refresh` skill is its +wrapper. **Threat tiers:** T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C +fully-rotted → **server-side branch-protection = the irreducible line** (client gate is +window-narrowing, NOT a complete guarantee). + +**Delivery-receipt (echo-lock, sol §8-final):** broker mints a single-use `receipt_challenge` per +cycle bound to (session, runtime_generation, epochs, H_source, H_payload); **COMPUTE = broker** +(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact), +**COPY = model** (copies challenge + H_payload verbatim — model never computes a hash; sol T29 +copy-not-compute preserved). Receipt is a **one-cycle T-A delivery/liveness proof ONLY — never an +obedience, residency, or safety proof.** The mechanical mutator-class gate remains THE safety +mechanism; §8 intact for T-B/T-C. + +## Binding ratification conditions (R1–R6) — MANDATORY for build acceptance +- **R1 (honesty / T27 amendment):** state honestly that the receipt detects an ABSENT or + PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a **T-C + contract violation, NOT receipt-detectable** (covered by server-side, not the receipt). No + over-claim. Fold as a doc amendment — no v6. +- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker + transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a + consumed-with-ambiguous-promotion state; recovery mints a **NEW** challenge, never reuses one. +- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject + quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts. +- **R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE):** launcher-ancestry/D1, + sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump, + nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require + **runtime Gate0 evidence BEFORE build admission**, not design assertion. **A failed Gate0 item + RETURNS the design to planner review — it is NOT waived by this GO.** +- **R5 (TTL — RATIFIER ACCEPTED):** proposed **300s MAX lease TTL + soak-tighten** is **ACCEPTED by + Mos (ratifier)**. Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator + (Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation + trigger — a proposed max that only tightens). +- **R6 (receipt semantics — REAFFIRMED):** receipt remains T-A delivery/liveness ONLY, never + obedience/safety proof. Reaffirmed as a permanent invariant of the design. + +## Build sequencing (PLAN-ONLY until these clear) +1. **HARD DEP:** `mosaic skill` register/unregister/list + generic install/upgrade symlink auto-sync + (mosaicstack/stack **#824**, in flight on ms-824) MUST land first — else the durable + `mosaic-context-refresh` skill ships unreachable (no `~/.claude/skills/` bridge symlink). +2. Then MS-LEAD builds the mechanism in **packages/mosaic** (M1 = Claude + Pi orchestrators) against + THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no + self-merge; Mos merges. +3. The durable `mosaic-context-refresh` skill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to + the ratified receipt/hash contract, AFTER the #824 bridge exists. + +**Interim protection (live now, until the mechanism ships):** `mosaic-context-refresh` skill +(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After +Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads +and attests 7/7.