mosaicstack/stack
1
0
Fork 1
Code Issues 143 Pull Requests 5 Actions Packages Projects Releases 15 Wiki Activity

fix(quality): prove criterion binding semantics
ci/woodpecker/pr/ci Pipeline was successful
Details

Browse Source
This commit is contained in:
coder-mos1
2026-08-01 00:17:50 -05:00
parent 9b4d4beb0e
commit 38f1b249cc
9 changed files with 414 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ADMIN-GUIDE/quality-gate-registry.md
+3 -3
View File
@@ -14,8 +14,8 @@ Investigate any of these immediately:
## Updating a gate
1. Add or change the criterion and exact case.
2. Observe the case fail for its own stated reason.
1. Add or change the criterion, its exact criterion-side `caseRefs`, and matching case-side `criterionIds`.
2. Observe the must-fail case fail for its own stated reason; moving the binding to any undeclared case must fail verification.
3. Declare an exact inerting mutation and observe the verifier detect it.
4. If required and actual behavior differ, add a tracked remediation owner and justification.
5. If meaning changed, append provenance; never replace the original silently.
@@ -32,4 +32,4 @@ Provider evidence input is an optional JSON array of normalized pipeline records
PR CI executes current-tree verification only, unprivileged and fail-closed. It does not execute isolated own-tree replay: RM-60 must provide a protected launcher or runner-level rootless sandbox before any PR-controlled executable/configuration is evaluated. Repo-only code cannot safely grant itself the capability intended to contain itself.
The deferred replay implementation remains hard-fail when its sandbox cannot be established; it is not silently skipped as a successful replay. When RM-60 activates it under protected authority, it uses frozen own-tree dependencies, namespace/environment isolation, and archived-file identity checks. A post-merge failure triggers quarantine and revert. This is detection, not pre-merge prevention.
The deferred replay implementation remains hard-fail when its sandbox cannot be established; it is not silently skipped as a successful replay. Tests recognize unavailability only from parent-generated Bubblewrap-launch provenance combined with proof that the sandbox entry command did not run. A denial-looking string from child-controlled output is not evidence. When RM-60 activates replay under protected authority, it uses frozen own-tree dependencies, namespace/environment isolation, and archived-file identity checks. A post-merge failure triggers quarantine and revert. This is detection, not pre-merge prevention.