governance: publish Gate0 probe-3 (D4) execution-authorization amendment (pin 9ac9ff87) + referenced charter provisions (89fdbc27 BUILD-BRIEF, bac58319 SPEC-RATIFICATION) to durable inspectable ref.
Authority binding: owner class-auth (Jason 'amend the charter'/option B, #mos 2026-07-18 17:28Z, pre-SHA) + independent-adjudicator byte-verify (Mos, web1:mos-claude, author != verifier). Published by the adjudicator per homelab durable-Gate0 independence requirement. Probe-3 remains HELD pending homelab verification + owner window.
This commit is contained in:
@@ -0,0 +1,109 @@
|
|||||||
|
# Gate0 Charter Amendment — Probe-3 (D4) Evidence-Class EXECUTION Authorization
|
||||||
|
|
||||||
|
**Status:** DRAFT (revision 2) — supersedes prior candidate pin `8fca5b7a`; pending Mos re-scope-verify BEFORE
|
||||||
|
re-pin is ratified. Revised per Mos adjudication directive (2026-07-18): §3 = D4-focused Option A; §1 = explicit binding model.
|
||||||
|
**Amendment type:** Additive durable-authority amendment (does NOT mutate any ratified pinned doc in place).
|
||||||
|
**Milestone:** 188 — Compaction-Refresh Mechanism · **Issue:** Gitea #827 (WI-0 Gate0) · gates WI-3 #830 merge.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 1. Authorized source (why this amendment is valid)
|
||||||
|
|
||||||
|
Per the Mosaic governance principle (OpenBrain `f0cb61b6`, permanent; fail-closed / DO-178C): a durable
|
||||||
|
Gate0 execution-hold clears ONLY by **(i) explicit user (owner) authorization** OR **(ii) a durable-authority
|
||||||
|
amendment from an authorized source**. A runtime coordinator's verbal GO does NOT qualify.
|
||||||
|
|
||||||
|
- **Owner authorization (i):** Jason (owner / north-star) directed in `#mos` **2026-07-18 17:28Z** — *"amend the
|
||||||
|
charter"* (option **B** from the WI-3 escalation), quoting the escalation back. This is the direct-user
|
||||||
|
authorization artifact that homelab's durable-Gate0 objection (2026-07-18 06:34:56Z) explicitly named as a
|
||||||
|
valid resolution condition (*"user artifact OR auth amendment"*). Relayed + authenticity-adjudicated by Mos
|
||||||
|
(`web1:mos-claude`). Owner outranks any peer-lane durable authority.
|
||||||
|
- **Amendment (ii):** this document, authorized BY that owner directive.
|
||||||
|
|
||||||
|
Both qualifying conditions are therefore satisfied. Homelab's stated condition is met by the owner artifact;
|
||||||
|
homelab is NOTIFIED as a transparency step (it holds durable-Gate0 standing and raised the original catch),
|
||||||
|
but its co-sign is not a gate (owner > peer).
|
||||||
|
|
||||||
|
**Binding model (explicit — how this SHA is authorized).** The authority binding for this amendment's pinned
|
||||||
|
bytes is the composition of two distinct acts:
|
||||||
|
1. **Owner class-authorization (PRE-SHA):** Jason (owner) authorized the *class of action* — "amend the
|
||||||
|
charter" (option B), `#mos` 2026-07-18 17:28Z. This occurred **before** these amendment bytes (and hence
|
||||||
|
this SHA256) existed; the owner authorized the amendment, not a specific hash.
|
||||||
|
2. **Independent-adjudicator byte-verification:** Mos (`web1:mos-claude`), acting as the independent
|
||||||
|
adjudicator (author ≠ verifier — MS-LEAD authored, Mos verifies), scope-verifies the **exact bytes** of
|
||||||
|
this document and confirms they express only the owner-authorized narrow scope.
|
||||||
|
|
||||||
|
There is therefore **NO single "Jason-signs-the-SHA" artifact, and none is required** under this binding
|
||||||
|
model: owner-authorized-class + independent-adjudicator-byte-verify **is** the binding. This is the durable,
|
||||||
|
inspectable chain of custody for the pin.
|
||||||
|
|
||||||
|
## 2. Charter provisions amended (sha-pinned, unmutated)
|
||||||
|
|
||||||
|
This amendment attaches to — and does NOT rewrite — the ratified Gate0 charter provisions:
|
||||||
|
|
||||||
|
- `compaction-refresh-BUILD-BRIEF.md` §5 / R4 "Gate0 = BUILD-ADMISSION GATE", specifically the item:
|
||||||
|
*"Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4)."*
|
||||||
|
sha256 `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b` (intact/unchanged).
|
||||||
|
- `compaction-refresh-SPEC-RATIFICATION.md` R4.
|
||||||
|
sha256 `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` (intact/unchanged).
|
||||||
|
|
||||||
|
The two pinned docs remain byte-identical; this amendment is the delta of record.
|
||||||
|
|
||||||
|
## 3. What is authorized (NARROW — D4-focused harness ONLY)
|
||||||
|
|
||||||
|
Adjudicator ruling (Mos, `web1:mos-claude`): "D4-only" against the existing runner is non-executable — the
|
||||||
|
only runner (`pi_gate0_run.py`) drives P2+P5+P6+D4 in one flow, and D4 intrinsically requires a
|
||||||
|
promoted-to-VERIFIED baseline (spec L219: "P3 immediately follows the valid P2 promotion so reload must
|
||||||
|
revoke a genuinely VERIFIED prior gen") to revoke a genuine prior generation. Therefore authorize EXACTLY the
|
||||||
|
minimal executable form (Option A) required as WI-3 (#830) merge-gate (2):
|
||||||
|
|
||||||
|
- **D4-focused harness:** spawns **ONLY** `p3_generation_broker.py` (not the full `pi_gate0_run.py` runner).
|
||||||
|
- **Minimal promotion-to-VERIFIED, as a FIXTURE PRECONDITION ONLY:** established solely so the D4 revoke has a
|
||||||
|
genuine `VERIFIED` target. This is **NOT** authorization to bank P2 as an independent evidence class.
|
||||||
|
- **D4 same-PID `runtime_generation`-bump revoke observation:** new generation → `MUTATOR_UNVERIFIED`;
|
||||||
|
prior (superseded) generation → `STALE_GENERATION`.
|
||||||
|
- **Explicitly EXCLUDED:** P5 (missing / oversize / hash-invalidation) and P6 (atomic-observation) — not
|
||||||
|
needed for the WI-3 D4 gate and **not authorized** by this amendment.
|
||||||
|
- **Isolation / integrity (per §4/§5):** 3× repeated, isolated runs; hardened deterministic harness;
|
||||||
|
non-destructive; launches broker/socket/state artifacts in an isolated fixture ONLY; **does NOT touch
|
||||||
|
production**, mutates no live lease/broker/deployment, creates no durable side effect outside the fixture;
|
||||||
|
a **FAIL** returns to planner — no retry-launder.
|
||||||
|
|
||||||
|
**Intrinsic-precondition boundary (verbatim):** the promotion step is a D4 test fixture, not a P2
|
||||||
|
evidence-gathering authorization; P5/P6 remain unauthorized.
|
||||||
|
|
||||||
|
## 4. What is NOT authorized (all other holds remain in force)
|
||||||
|
|
||||||
|
- This is **NOT** a blanket Gate0-execution release. Every other Gate0 execution item and every standing
|
||||||
|
execution hold remains exactly as-is.
|
||||||
|
- No live mutation, migration, canary, deployment, systemd, tmux-fleet, or connector/socket/Hermes action is
|
||||||
|
authorized by this amendment.
|
||||||
|
- Authorizes producing THIS evidence class once (3× isolation is the evidence-integrity requirement, not a
|
||||||
|
license to re-run on failure): a **FAIL** returns to planner — **no retry-launder**, no severity-laundering.
|
||||||
|
|
||||||
|
## 5. Preserved fail-closed / DO-178C invariants (verbatim, unchanged)
|
||||||
|
|
||||||
|
- Producing probe evidence **EXECUTES** the Gate0 mechanism (launches processes, creates socket/state
|
||||||
|
artifacts, exercises revocation transitions); "isolated + non-destructive" does **not** make it
|
||||||
|
non-execution. This amendment authorizes that execution for the narrow class in §3 — it does not redefine
|
||||||
|
execution as non-execution.
|
||||||
|
- A sha-pinned DURABLE authority OUTRANKS a runtime coordinator's verbal GO; when they conflict the durable
|
||||||
|
artifact wins. This amendment derives its authority from the OWNER, not from a coordinator.
|
||||||
|
- Card-advancement gates and execution-holds are distinct; this amendment lifts ONLY the §3 execution-hold,
|
||||||
|
not any advancement/review/SECREV gate. WI-3's independent-review + Opus-SECREV + green-suite gates stand.
|
||||||
|
|
||||||
|
## 6. Effect on WI-3 (#830) merge chain
|
||||||
|
|
||||||
|
On this amendment being pinned (Mos-verified + Jason-shown): a fresh lane (ms-rev-826) executes the §3
|
||||||
|
probe-3 evidence class (3× isolation) → PASS/FAIL reported to Mos. **On PASS**, and only after re-confirming
|
||||||
|
WI-3 head `f4008307` UNMOVED + FIRE-PRECONDITION-0 (fresh `mosaic-context-refresh` attestation for
|
||||||
|
mosaic-100 + planner-opus), the existing chain runs: CI queue-guard → push → PR → mirror RoR → relay full-40
|
||||||
|
head + pr/ci# → Mos independent 6-check → squash `closes #830` → chain WI-4→7. **On FAIL**: planner-return.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Amendment author:** MS-LEAD (`web1:mosaic-100`), Gate0 governance interface / charter custodian.
|
||||||
|
**Pin protocol:** this file's sha256 becomes the amendment pin ONLY after Mos re-scope-verify. Reported to Mos
|
||||||
|
before any ratification/publication, per the transparency checkpoint on a durable-authority change. Ratification
|
||||||
|
and durable publication (to a homelab-inspectable provider ref) are the adjudicator's (Mos), NOT the author's
|
||||||
|
(MS-LEAD) — the author does not self-ratify and does not publish.
|
||||||
106
docs/compaction-refresh/governance/charter-BUILD-BRIEF.md
Normal file
106
docs/compaction-refresh/governance/charter-BUILD-BRIEF.md
Normal file
@@ -0,0 +1,106 @@
|
|||||||
|
# Compaction-Refresh Mechanism — BUILD BRIEF (Mos → MS-LEAD)
|
||||||
|
|
||||||
|
**Status:** STAGED — do NOT dispatch until PR #826 (#824 skill-CLI bridge) MERGES. Mos routes this to
|
||||||
|
MS-LEAD at #824 land. PLAN phase COMPLETE + RATIFIED; this is the BUILD-execution brief.
|
||||||
|
**Routed by:** Mos (main orchestrator). **Owner:** MS-LEAD (mosaic-100). **Runtime scope M1:** Claude + Pi.
|
||||||
|
|
||||||
|
## 1. AUTHORITY (sha256-pinned — build AGAINST these, do not re-derive)
|
||||||
|
| Artifact | Path | SHA-256 |
|
||||||
|
|---|---|---|
|
||||||
|
| **Ratification record (SSOT)** | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md` | `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` |
|
||||||
|
| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
|
||||||
|
| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
|
||||||
|
|
||||||
|
The coder MUST verify these hashes before building. The in-context working spec is DERIVED and
|
||||||
|
compaction-fragile — the sha256'd records above are the recovery SSOT (durable-authority discipline).
|
||||||
|
|
||||||
|
## 2. TARGET & SCOPE
|
||||||
|
- **Framework-native `packages/mosaic/…`** in `mosaicstack/stack`. NOT jarvis-brain. NOT
|
||||||
|
`~/.config/mosaic/` directly (that tree is WIPED on framework upgrade — durable home is SOURCE).
|
||||||
|
- **M1 = Claude + Pi orchestrators only.** Codex/other runtimes = scope-note only.
|
||||||
|
- **Hard dependency (now satisfied at dispatch):** the `mosaic skill` register/list + install/upgrade
|
||||||
|
symlink auto-sync (#824 / PR #826) — so the durable `mosaic-context-refresh` skill ships REACHABLE
|
||||||
|
(auto-symlinked into `~/.claude/skills/`). Do not dispatch before #826 merges.
|
||||||
|
|
||||||
|
## 3. DELIVERABLES (locked architecture — from the ratification record; do NOT redesign)
|
||||||
|
1. **Authenticated external lease broker** bound to kernel `SO_PEERCRED` `(pid, starttime,
|
||||||
|
runtime_generation)` — the only unforgeable identity on a same-uid tmux fleet. Broker **MINTS** the
|
||||||
|
logical `session_id` at first peercred contact (NEVER caller-asserted). Distinct-principal /
|
||||||
|
protected socket.
|
||||||
|
2. **Whole mutator-class gate** (not per-wrapper): no consequential mutator succeeds without a valid
|
||||||
|
VERIFIED lease. **Revoke-first / promote-last.**
|
||||||
|
3. **Compaction observers → revoke:** Claude `PreCompact` + `SessionStart(matcher=compact)`; Pi
|
||||||
|
`session_before_compact`/`context` equivalents. Any `runtime_generation` bump (reload/resume/fork,
|
||||||
|
same PID included) auto-revokes the prior incarnation.
|
||||||
|
4. **Verbatim-hashed normative fragments:** `B_payload` (exact fragments + deterministic metadata) and
|
||||||
|
`H_payload = SHA256(domain_sep ‖ length_framed(B_payload))` — NO self-reference (byte-identical
|
||||||
|
across the Claude and Pi builders).
|
||||||
|
5. **Receipt-challenge protocol (promotion prerequisite, NOT the safety mechanism):** broker mints a
|
||||||
|
single-use `receipt_challenge` per cycle bound to `(session_id, runtime_generation,
|
||||||
|
compaction_epoch, request_epoch, H_source, H_payload, schema_version)`. **COMPUTE = broker**
|
||||||
|
(observes latest-assistant message, computes the binding incl `H(latest-assistant-message)`);
|
||||||
|
**COPY = model** (verbatim copy of challenge + `H_payload` — an LLM cannot hash its own output;
|
||||||
|
T29). Observed in the EXACT latest assistant message (Claude: latest assistant entry + pending
|
||||||
|
challenge, NO transcript grep; Pi: `message_end`, NOT `after_provider_response`). Single-use,
|
||||||
|
consumed before the tool batch. Broker transition order (mandatory): `revoke → build
|
||||||
|
B_payload/H_payload → PENDING_DELIVERY(mint unique challenge) → deliver → observe exact receipt →
|
||||||
|
evidence commit → consume challenge → promote VERIFIED (last)`.
|
||||||
|
6. **Constrained recovery command** = the single ungated mutator; the `mosaic-context-refresh` skill
|
||||||
|
is its wrapper (uses a newly-minted challenge + identical protocol; cannot replay normal-path
|
||||||
|
receipt). Durable skill lands here, symlink-reachable via #824.
|
||||||
|
7. **T-C server-side line = branch protection** (the irreducible guarantee; client gate is
|
||||||
|
window-narrowing only). If ops-config rather than code, DOCUMENT the required posture explicitly.
|
||||||
|
|
||||||
|
## 4. BINDING BUILD CONDITIONS R1–R6 (MANDATORY — verbatim from ratification record)
|
||||||
|
- **R1 (honesty):** state that the receipt detects ABSENT or PREFIX-TRUNCATED terminal token, but a
|
||||||
|
MIDDLE-DROP preserving the tail is a **T-C contract violation, NOT receipt-detectable** (covered by
|
||||||
|
server-side). No over-claim.
|
||||||
|
- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
|
||||||
|
transaction; a crash leaves neither VERIFIED-with-live-challenge nor consumed-with-ambiguous-promote;
|
||||||
|
recovery mints a NEW challenge, never reuses.
|
||||||
|
- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
|
||||||
|
quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, multiple receipts.
|
||||||
|
- **R4 (Gate0 = BUILD-ADMISSION GATE):** see §5 — runtime evidence BEFORE build admission; a failed
|
||||||
|
Gate0 item RETURNS the design to planner review, it is NOT waived by the GO.
|
||||||
|
- **R5 (TTL):** 300 s MAX lease TTL + soak-tighten; soak may only SHORTEN, never lengthen. Mos-accepted.
|
||||||
|
- **R6 (receipt semantics):** receipt = T-A delivery/liveness ONLY, never obedience/safety/residency.
|
||||||
|
Permanent invariant.
|
||||||
|
|
||||||
|
## 5. R4 GATE0 — RUNTIME EVIDENCE BEFORE BUILD ADMISSION (WI-0, do this FIRST)
|
||||||
|
Structure the build like gitwatch: **WI-0 is a Gate0 runtime-evidence probe; no feature build admitted
|
||||||
|
until every item produces POSITIVE runtime evidence** (not a design assertion). A failed item RETURNS
|
||||||
|
to planner — do not paper over:
|
||||||
|
- Launcher `exec`/parent topology + supported-hook ancestry (D1); broker authenticates the launcher
|
||||||
|
chain, rejects sibling-substitution.
|
||||||
|
- Pi lifecycle: last-position invariant (last-or-closed), per-tool nonce → tool-call-id map (D5).
|
||||||
|
- Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4).
|
||||||
|
- Broker socket authenticity posture (protected / distinct-principal); `SO_PEERCRED` returns the true
|
||||||
|
`(pid, starttime)`.
|
||||||
|
- Source-invalidation fail-closed (missing/oversize/hash-mismatch fragment → no promotion).
|
||||||
|
- Claude `additionalContext` + Pi `context` inject atomically (A-v5-1) — the transport assumption
|
||||||
|
T27 rests on; verify or class the gap T-C.
|
||||||
|
|
||||||
|
## 6. ACCEPTANCE TESTS (red-first TDD)
|
||||||
|
Carry all v4 ACs + T12b; add **T24–T30**: T24 hash-construction no-self-reference byte-identical across
|
||||||
|
builders · T25 replay rejected · T26 transcript-stale-match cannot promote · T27 partial-delivery
|
||||||
|
(prefix-trunc/tail-only/middle-drop/malformed) none promote · T28 single-use (no renew/reopen) · T29
|
||||||
|
model copies not computes · T30 dual-hook-miss matches AMENDED threat table within+after TTL.
|
||||||
|
Acceptance = full green suite + Gate0 evidence pack.
|
||||||
|
|
||||||
|
## 7. REVIEW & MERGE DISCIPLINE
|
||||||
|
- **This IS an Opus-SECREV-mandatory surface** — UNLIKE #824 (local same-uid FS). The broker is an
|
||||||
|
authentication/identity/authorization mechanism (peercred binding, session_id minting, mutator-class
|
||||||
|
gating, receipt protocol). Security review = **Opus-SECREV, no GPT/terra substitute** on the
|
||||||
|
broker/gate/receipt/socket surfaces. Functional/non-security parts may take GPT review.
|
||||||
|
- **Author ≠ reviewer**, independent review, no self-merge, exact-head RoR (reviewed-SHA=merged-SHA),
|
||||||
|
`closes #<issue>` close-keyword, full 40-char head. Never edit tests to pass / never force-merge red
|
||||||
|
/ never `--no-verify`.
|
||||||
|
- **Mos merges** (per ratification record) after Opus-SECREV + independent review pass + green suite +
|
||||||
|
Gate0 pack. Decompose into work-items (WI-0 Gate0 first); likely a milestone, not one monolithic PR.
|
||||||
|
|
||||||
|
## 8. SEQUENCING
|
||||||
|
#826 (#824 bridge) MERGES → Mos routes this brief → MS-LEAD decomposes (WI-0 Gate0 first) → build M1
|
||||||
|
(Claude+Pi) → Gate0 evidence pack (failed item → planner) → Opus-SECREV + independent review → Mos
|
||||||
|
merges → durable `mosaic-context-refresh` skill lands symlink-reachable → jarvis-brain `CLAUDE.md`
|
||||||
|
mandate PR aligns to the shipped receipt/hash contract. Interim skill + CLAUDE.md mandate stay LIVE
|
||||||
|
until the mechanism ships.
|
||||||
@@ -0,0 +1,75 @@
|
|||||||
|
# Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD
|
||||||
|
|
||||||
|
**Ratifier:** Mos (main fleet orchestrator, `mos-claude`)
|
||||||
|
**Date:** 2026-07-17 ~22:2xZ
|
||||||
|
**Decision:** ✅ **RATIFIED — GO WITH BINDING CONDITIONS R1–R6.** Architecture converged v1→v5 via
|
||||||
|
oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required.
|
||||||
|
|
||||||
|
## Authenticated authority artifacts (sha256-pinned)
|
||||||
|
|
||||||
|
| Artifact | Path | SHA-256 |
|
||||||
|
|---|---|---|
|
||||||
|
| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
|
||||||
|
| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
|
||||||
|
| (base) SPEC v4 | `~/agent-work/reviews/compaction-refresh-SPEC-v4.md` | `a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80` |
|
||||||
|
| (base) sol v4 red-team | `~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md` | `1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f` |
|
||||||
|
| Ratification-Input (R1-R6 + rulings, provenance-clean) | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md` | `d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266` |
|
||||||
|
|
||||||
|
## Convergence trail
|
||||||
|
v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch
|
||||||
|
locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → **v5 GO-with-conditions**.
|
||||||
|
|
||||||
|
## Locked architecture (do not redesign)
|
||||||
|
Authenticated external **lease broker** bound to kernel `SO_PEERCRED` (pid, starttime,
|
||||||
|
runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the
|
||||||
|
logical session_id at first peercred contact (never caller-asserted). **Revoke-first / promote-last.**
|
||||||
|
Whole **mutator-class gate** (not per-wrapper). Verbatim-hashed normative fragments. Single
|
||||||
|
**constrained recovery command** = the only ungated mutator; the `mosaic-context-refresh` skill is its
|
||||||
|
wrapper. **Threat tiers:** T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C
|
||||||
|
fully-rotted → **server-side branch-protection = the irreducible line** (client gate is
|
||||||
|
window-narrowing, NOT a complete guarantee).
|
||||||
|
|
||||||
|
**Delivery-receipt (echo-lock, sol §8-final):** broker mints a single-use `receipt_challenge` per
|
||||||
|
cycle bound to (session, runtime_generation, epochs, H_source, H_payload); **COMPUTE = broker**
|
||||||
|
(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact),
|
||||||
|
**COPY = model** (copies challenge + H_payload verbatim — model never computes a hash; sol T29
|
||||||
|
copy-not-compute preserved). Receipt is a **one-cycle T-A delivery/liveness proof ONLY — never an
|
||||||
|
obedience, residency, or safety proof.** The mechanical mutator-class gate remains THE safety
|
||||||
|
mechanism; §8 intact for T-B/T-C.
|
||||||
|
|
||||||
|
## Binding ratification conditions (R1–R6) — MANDATORY for build acceptance
|
||||||
|
- **R1 (honesty / T27 amendment):** state honestly that the receipt detects an ABSENT or
|
||||||
|
PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a **T-C
|
||||||
|
contract violation, NOT receipt-detectable** (covered by server-side, not the receipt). No
|
||||||
|
over-claim. Fold as a doc amendment — no v6.
|
||||||
|
- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
|
||||||
|
transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a
|
||||||
|
consumed-with-ambiguous-promotion state; recovery mints a **NEW** challenge, never reuses one.
|
||||||
|
- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
|
||||||
|
quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts.
|
||||||
|
- **R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE):** launcher-ancestry/D1,
|
||||||
|
sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump,
|
||||||
|
nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require
|
||||||
|
**runtime Gate0 evidence BEFORE build admission**, not design assertion. **A failed Gate0 item
|
||||||
|
RETURNS the design to planner review — it is NOT waived by this GO.**
|
||||||
|
- **R5 (TTL — RATIFIER ACCEPTED):** proposed **300s MAX lease TTL + soak-tighten** is **ACCEPTED by
|
||||||
|
Mos (ratifier)**. Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator
|
||||||
|
(Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation
|
||||||
|
trigger — a proposed max that only tightens).
|
||||||
|
- **R6 (receipt semantics — REAFFIRMED):** receipt remains T-A delivery/liveness ONLY, never
|
||||||
|
obedience/safety proof. Reaffirmed as a permanent invariant of the design.
|
||||||
|
|
||||||
|
## Build sequencing (PLAN-ONLY until these clear)
|
||||||
|
1. **HARD DEP:** `mosaic skill` register/unregister/list + generic install/upgrade symlink auto-sync
|
||||||
|
(mosaicstack/stack **#824**, in flight on ms-824) MUST land first — else the durable
|
||||||
|
`mosaic-context-refresh` skill ships unreachable (no `~/.claude/skills/` bridge symlink).
|
||||||
|
2. Then MS-LEAD builds the mechanism in **packages/mosaic** (M1 = Claude + Pi orchestrators) against
|
||||||
|
THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no
|
||||||
|
self-merge; Mos merges.
|
||||||
|
3. The durable `mosaic-context-refresh` skill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to
|
||||||
|
the ratified receipt/hash contract, AFTER the #824 bridge exists.
|
||||||
|
|
||||||
|
**Interim protection (live now, until the mechanism ships):** `mosaic-context-refresh` skill
|
||||||
|
(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After
|
||||||
|
Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads
|
||||||
|
and attests 7/7.
|
||||||
Reference in New Issue
Block a user