governance: publish Gate0 probe-3 (D4) execution-authorization amendment (pin 9ac9ff87) + referenced charter provisions (89fdbc27 BUILD-BRIEF, bac58319 SPEC-RATIFICATION) to durable inspectable ref.
Authority binding: owner class-auth (Jason 'amend the charter'/option B, #mos 2026-07-18 17:28Z, pre-SHA) + independent-adjudicator byte-verify (Mos, web1:mos-claude, author != verifier). Published by the adjudicator per homelab durable-Gate0 independence requirement. Probe-3 remains HELD pending homelab verification + owner window.
This commit is contained in:
@@ -0,0 +1,75 @@
|
||||
# Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD
|
||||
|
||||
**Ratifier:** Mos (main fleet orchestrator, `mos-claude`)
|
||||
**Date:** 2026-07-17 ~22:2xZ
|
||||
**Decision:** ✅ **RATIFIED — GO WITH BINDING CONDITIONS R1–R6.** Architecture converged v1→v5 via
|
||||
oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required.
|
||||
|
||||
## Authenticated authority artifacts (sha256-pinned)
|
||||
|
||||
| Artifact | Path | SHA-256 |
|
||||
|---|---|---|
|
||||
| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
|
||||
| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
|
||||
| (base) SPEC v4 | `~/agent-work/reviews/compaction-refresh-SPEC-v4.md` | `a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80` |
|
||||
| (base) sol v4 red-team | `~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md` | `1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f` |
|
||||
| Ratification-Input (R1-R6 + rulings, provenance-clean) | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md` | `d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266` |
|
||||
|
||||
## Convergence trail
|
||||
v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch
|
||||
locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → **v5 GO-with-conditions**.
|
||||
|
||||
## Locked architecture (do not redesign)
|
||||
Authenticated external **lease broker** bound to kernel `SO_PEERCRED` (pid, starttime,
|
||||
runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the
|
||||
logical session_id at first peercred contact (never caller-asserted). **Revoke-first / promote-last.**
|
||||
Whole **mutator-class gate** (not per-wrapper). Verbatim-hashed normative fragments. Single
|
||||
**constrained recovery command** = the only ungated mutator; the `mosaic-context-refresh` skill is its
|
||||
wrapper. **Threat tiers:** T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C
|
||||
fully-rotted → **server-side branch-protection = the irreducible line** (client gate is
|
||||
window-narrowing, NOT a complete guarantee).
|
||||
|
||||
**Delivery-receipt (echo-lock, sol §8-final):** broker mints a single-use `receipt_challenge` per
|
||||
cycle bound to (session, runtime_generation, epochs, H_source, H_payload); **COMPUTE = broker**
|
||||
(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact),
|
||||
**COPY = model** (copies challenge + H_payload verbatim — model never computes a hash; sol T29
|
||||
copy-not-compute preserved). Receipt is a **one-cycle T-A delivery/liveness proof ONLY — never an
|
||||
obedience, residency, or safety proof.** The mechanical mutator-class gate remains THE safety
|
||||
mechanism; §8 intact for T-B/T-C.
|
||||
|
||||
## Binding ratification conditions (R1–R6) — MANDATORY for build acceptance
|
||||
- **R1 (honesty / T27 amendment):** state honestly that the receipt detects an ABSENT or
|
||||
PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a **T-C
|
||||
contract violation, NOT receipt-detectable** (covered by server-side, not the receipt). No
|
||||
over-claim. Fold as a doc amendment — no v6.
|
||||
- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
|
||||
transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a
|
||||
consumed-with-ambiguous-promotion state; recovery mints a **NEW** challenge, never reuses one.
|
||||
- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
|
||||
quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts.
|
||||
- **R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE):** launcher-ancestry/D1,
|
||||
sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump,
|
||||
nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require
|
||||
**runtime Gate0 evidence BEFORE build admission**, not design assertion. **A failed Gate0 item
|
||||
RETURNS the design to planner review — it is NOT waived by this GO.**
|
||||
- **R5 (TTL — RATIFIER ACCEPTED):** proposed **300s MAX lease TTL + soak-tighten** is **ACCEPTED by
|
||||
Mos (ratifier)**. Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator
|
||||
(Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation
|
||||
trigger — a proposed max that only tightens).
|
||||
- **R6 (receipt semantics — REAFFIRMED):** receipt remains T-A delivery/liveness ONLY, never
|
||||
obedience/safety proof. Reaffirmed as a permanent invariant of the design.
|
||||
|
||||
## Build sequencing (PLAN-ONLY until these clear)
|
||||
1. **HARD DEP:** `mosaic skill` register/unregister/list + generic install/upgrade symlink auto-sync
|
||||
(mosaicstack/stack **#824**, in flight on ms-824) MUST land first — else the durable
|
||||
`mosaic-context-refresh` skill ships unreachable (no `~/.claude/skills/` bridge symlink).
|
||||
2. Then MS-LEAD builds the mechanism in **packages/mosaic** (M1 = Claude + Pi orchestrators) against
|
||||
THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no
|
||||
self-merge; Mos merges.
|
||||
3. The durable `mosaic-context-refresh` skill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to
|
||||
the ratified receipt/hash contract, AFTER the #824 bridge exists.
|
||||
|
||||
**Interim protection (live now, until the mechanism ships):** `mosaic-context-refresh` skill
|
||||
(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After
|
||||
Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads
|
||||
and attests 7/7.
|
||||
Reference in New Issue
Block a user