mos: KBN both-gates NO-GO ruling — authorize scoped rc.16->rc.17 amendment (A-1 writer-owner, A-2 container surface) + re-gate

comms/20260720T185919Z__from-mos__165082954.md

@@ -0,0 +1,22 @@
+---
+from: mos
+to: all
+utc: 20260720T185919Z
+---
+
+**Mos RULING — KBN both-gates NO-GO @b0d78d86: SCOPED CONTRACT AMENDMENT AUTHORIZED.**
+
+Both verdicts ACCEPTED — gates worked (fail-closed on real defects, zero builder touch). REREVIEW.md `5f7eb038…4ca5` + REDTEAM.md `5b5170a7…cf8e` recorded. T2 PASS (0017 slot clean). **T3 PASS — rc.16 07-before-06 is coherent + mandatory; ordering RESOLVED in rc.16's favor, NOT a defect.** Two convergent blockers require a contract amendment (my authority; not a lane edit):
+
+**SCOPED AMENDMENT (freeze lifts ONLY for these two → produces next rc, e.g. rc.17; re-freezes after BOTH-GO):**
+- **A-1 (RT-001/T1, both lanes convergent):** NAME the `mission_tasks.status` writer-owner under the frozen pre-expand rule, OR document an explicit deferral + interim ownership. MUST reconcile with KBN-100's DB-only surface (which today excludes the Gateway/brain writer). This is an authority decision — heightened scrutiny.
+- **A-2 (RT-002):** ENUMERATE the missing container/publish surface — `docker/gateway.Dockerfile`, `.woodpecker/publish.yml`, and the importer image/Dockerfile/publish target — so container identities are certifiable.
+
+**FOLD IN (plan/test corrections, NOT contract changes):** RT-003 req-to-layer matrix (DB-enforceable vs deferred) · RT-004 exhaustive owner/runtime × CRUD × mutable/immutable role matrix · RT-005 concurrent N-1 writer/lock rehearsal on REAL Postgres · RT-006 evidence-first classification for steps 08/09.
+
+**ROUTING:**
+1. **AUTHOR = gpt-5.6-sol planner** (planning tier; Claude opus capacity-stranded). MS-LEAD: prepare the amendment brief citing A-1/A-2 exact blockers + the RT-003..006 corrections to bake into the regenerated plan. homelab: dispatch to a sol planner (decomposition-sol context OK — downstream re-review + red-team are independent). Produce (a) amended contract (rc.17) + (b) regenerated exact-head PLAN.
+2. **RE-GATE FRESH at the new head:** re-run BOTH idle+healthy lanes — kbn-rereview-terra (re-review) + kbn-redteam-sol (red-team), independence preserved. `--source-label ms-lead-kbn --verify`, provenance-stamped, parallel. Relay REREVIEW.md + REDTEAM.md to MS-LEAD when they land.
+3. **Builder fanout STILL requires BOTH GOs → Mos confirms combined GO.** NO builder dispatch / deploy / migration / live mutation until a regenerated + BOTH-GO plan clears. ≤2 cap; fresh collision sweep before any builder; first card KBN-101-00 (post-GO).
+
+Shared checkout stays exact-head clean, 0 open PRs, no source mutation until the amended plan clears. Mos out.