diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 99aa2ad8..84017b28 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -28,8 +28,8 @@ 1. **Nothing is waiting on you that is urgent.** RM-03 waits on Jason; RM-02 waits on RM-61; RM-61 is rebuilding on the D-40 ruling. Read the record before touching any lane. -2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 40 findings - (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-40 in TASKS.md), every ruling with its rationale, and the +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 41 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-41 in TASKS.md), every ruling with its rationale, and the requirements each finding placed on RM-02/RM-34/RM-50/RM-55. 3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an @@ -90,7 +90,7 @@ board is one of the six stale restatements below. ## Decisions log — full record in [`TASKS.md`](./TASKS.md) -All 40 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-40 in `TASKS.md`) and every ruling with its +All 41 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-41 in `TASKS.md`) and every ruling with its rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this board had done three times in one night (gate list, capability registry, DECISION-1 status), and three more times by the next rotation seam (RM-61 "building", "nothing implemented yet", DECISION-1/2/3 diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index a336d0c0..240ddb14 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -322,6 +322,49 @@ merges cannot perform them. And the shape holds: **RM-03 is the fix for the queue guard, so this — the first delivery through the complete stack — is also the last one gated by a check that could not fail.** +### D-41 — the entire execution fleet is UNMANAGED, so neither RM-50 nor RM-58 can be exercised against it + +Going to rotate `coder-mos1` mechanically, the orchestrator found `mosaic fleet restart` cannot reach it. +`mosaic fleet ps` reports **every seat executing this mission** as `systemd inactive/disabled`, pane +alive, flagged **UNMANAGED**: `coder-mos1`, `rev-974`, `f10-coder`, `merge-gate`, `pm-scout-a/b/c`, +`pm-scout-coord`, `rev-3107b`, `ultron-3107` — **and `mos-remediation` itself.** The roster-managed +population (`canary-pi`, `uc-*`, `auth-plan-*`) is a **different set of seats from the ones doing the +work**. + +**Consequences, and they are structural rather than inconvenient:** + +- **RM-50** ("one roster-owned socket/host; **quarantine unmanaged**; deterministic reaper") applied + today would **quarantine the entire remediation fleet, including the seat implementing RM-50.** +- **RM-58** ("**mechanical** pre-dispatch context reset — the orchestrator resets a seat out-of-band and + verifies it, rather than **asking** the agent to reset itself", D-4) **cannot be performed at all.** + There is no mechanical reset path for an unmanaged seat, so the only rotation available is precisely + what D-4 says does not count: asking the agent, or killing a pane by hand. +- **P-LIFECYCLE-001** presumes rotation enforced by a deterministic coordinator. **That enforcement + surface does not exist for the seats that need it.** + +> **★ REQUIREMENT ON RM-50 AND RM-58: acceptance must be demonstrated against the UNMANAGED execution +> population, not against roster-managed canary seats.** A criterion satisfied only on the managed +> canaries is **tested on the wrong population** — the D-17 coverage class, one layer up. This is the +> same shape as D-38: the check passes while the thing it claims to cover goes untested. + +**Honest labelling of today's rotation:** it is a **manual pane restart with a hand-verified handoff +artifact, dressed as a lifecycle operation.** Acceptable as a stopgap; it must **not** be recorded as +"rotation worked", because the mechanism that would make it repeatable is absent. Same distinction as +D-23's inert queue guard — **the step ran; the property was not observed.** + +The orchestrator did **not** run `mosaic fleet restart` against the disabled unit of a live seat holding +RM-61 and RM-03 state. Disposition (manual restart / Mos executes / leave parked) escalated to Mos. + +**Handoff quality note, worth keeping as the positive control:** `coder-mos1`'s artifact +(`~/agent-work/handoffs/coder-mos1-20260801.md`, verified readable by the orchestrator **before** any +reset) is typed state rather than transcript, and surfaced things not otherwise recoverable — including +**D-12 recurring live** (PR #1033 was created through a wrapper API fallback and the requested `draft` +property was silently not applied), an **unrunnable check declared as unrunnable rather than substituted** +(`test:framework-shell` exits 97 on this host: Bash 5.2.15 reports `BASH_LINENO [3 5]` where the suite +requires `[3 4]`; CI's Alpine environment is canonical), and **suspicions explicitly labelled as +suspicions** ("11 observations are insufficient to establish causality — do not encode node, time, head, +or retry correlates into policy"), which is RM-61's own doctrine applied by the seat to its own hunch. + ### D-40 — a type confusion INSIDE the structural discriminator the whole design rests on `step.get("exit_code") == 0` is **True for JSON `false`**, because Python `False == 0`. Reproduced twice