docs(#751): Publish native Kanban/SOT canon (#752)

docs/scratchpads/751-native-kanban-canon.md

@@ -0,0 +1,152 @@
+# Issue #751 — Native Kanban/SOT canonical publication
+
+## Objective
+
+Publish the owner-ratified P0–P3 requirements, mission manifest, task decomposition, and frozen shared contracts before feature implementation.
+
+## Authority and decisions
+
+- Owner: Jason
+- Plan owner/orchestrator: web1 control plane; takeover by mosaic-100 during Claude quota outage
+- Tracking: Mosaic Stack issue #751
+- Foundation: current Stack main + Drizzle/PostgreSQL
+- Fixed invariants: PostgreSQL sole writable SOT; writes fail closed; exports never import; outage notes become attributable proposals; mechanical Coordinator has no scope/gate/certify/merge authority; Certifier has no merge authority.
+- Recovery posture only is configurable through Lite, Standard, and High-assurance profiles.
+
+## Execution log
+
+- 2026-07-14: Existing planner-sol canon remediation reviewed from staging. KCR-001–016 claimed resolved; static checks passed.
+- 2026-07-14: Independent GPT/Terra re-review dispatched to rev1.
+- 2026-07-14: Re-review returned NO-GO: proposal audit-event IDs were not workspace-bound, leaving attribution forgeable; formatter evidence was not reproducible. Focused remediation round 2 routed to planner-sol.
+- 2026-07-14: Remediation bound proposal audit links to `task_events(workspace_id,id)`, froze same-transaction semantic validation and negative tests, and made formatter/type/static checks reproducible.
+- 2026-07-14: Independent rev1 re-review returned GO with KCR-001–016 closed and no new blocker. Canon copied into the issue #751 publication worktree; feature implementation remains held until merge.
+- 2026-07-14: Independent publication validation returned FAIL on formatting/trailing whitespace, stale staging wording, ignored review evidence, and missing worktree dependencies. Bounded publication remediation routed to planner-sol; no runtime source change authorized.
+- 2026-07-14: Publication remediation installed locked dependencies outside the repository cache, fixed formatting and wording, and preserved docs-only scope. Independent gaterun revalidation returned PASS across staged scope, formatting, lint, typecheck, strict contract compile, links, rollups, review artifacts, and fixed invariants.
+- 2026-07-14: Ultron final gate returned GO with zero BLOCKER/HIGH findings; residual LOW items remain explicit implementation obligations.
+- 2026-07-14: First commit attempt was correctly blocked by the lint-staged hook because docs contract `.ts` files were outside TypeScript project-service scope. Added a strict no-emit workstream `tsconfig.json` with exact Drizzle declaration paths; targeted contract TSC, contract ESLint, format, full lint/typecheck, strictness, and docs-only scope independently passed.
+
+## Verification evidence
+
+- Initial review: `docs/reports/native-kanban-sot/canon-initial-review-no-go.md`
+- Final GO: `docs/reports/native-kanban-sot/canon-final-rereview-go.md`
+- Ultron GO: `docs/reports/native-kanban-sot/ultron-final-go.md`
+- Pending: PR gates, squash merge, terminal-green CI, and issue closure.
+
+## Publication remediation session — planner-sol
+
+**Assignment:** Remediate only issue #751 publication blockers from `/home/hermes/agent-work/reviews/751-kanban-canon-publication-validation.md`; no source, package, lock, provider, CI, build, deploy, commit, or push action.
+
+**Plan:**
+
+1. Install the locked pnpm dependencies without modifying package metadata.
+2. Replace only stale publication/staging wording while retaining the canon-merge and KBN prerequisite implementation hold.
+3. Format all changed candidate Markdown and contract TypeScript; remove trailing whitespace.
+4. Run worktree `format:check`, `lint`, `typecheck`, strict no-emit contract compilation, tracked/untracked whitespace checks, and static invariants.
+5. Verify package/lock/source paths are unchanged and append exact evidence here.
+
+**Budget:** No explicit token cap; bounded docs-only remediation, no exploratory/runtime work.
+**TDD:** Not applicable—documentation/contract-publication formatting and wording only; strict/static validation is the primary gate.
+
+## Publication remediation results
+
+### Changes
+
+- `docs/native-kanban-sot/INDEX.md`: replaced staging/pending-GO wording with current publication and independent-GO wording; retained the merge hold and dependency-ordered KBN prerequisite hold.
+- `docs/native-kanban-sot/TASKS.md`: replaced “Mos using this staging set” with “Mos / publication control plane”; made the post-merge KBN prerequisite hold explicit.
+- Formatted all changed candidate Markdown and four contract TypeScript files with current-worktree Prettier 3.8.1.
+- Removed trailing whitespace from candidate Markdown, including both linked review reports.
+- Preserved both review reports and their links; they remain ignored by `.gitignore:11` for coordinator force-tracking.
+
+### Dependency installation
+
+The first target-worktree install attempt used the environment's default root-owned pnpm store and failed without changing package metadata:
+
+```text
+cd /home/hermes/agent-work/stack-kanban-canon && pnpm install --frozen-lockfile
+EACCES: permission denied, open '/root/.local/share/pnpm/store/v10/server/server.json'
+```
+
+Successful locked install using an authorized cache outside the repository:
+
+```bash
+cd /home/hermes/agent-work/stack-kanban-canon
+pnpm install --frozen-lockfile --store-dir /home/hermes/agent-work/pnpm-store
+```
+
+Result: PASS, 1,240 packages installed; lockfile resolution skipped as up to date. `node_modules` remains ignored. Tool versions: pnpm 10.6.2, Prettier 3.8.1, TypeScript 5.9.3, Drizzle ORM 0.45.1, Turbo 2.8.16.
+
+### Exact quality-gate results
+
+```text
+pnpm format:check
+PASS — All matched files use Prettier code style.
+
+pnpm lint
+PASS — 23 successful lint tasks.
+
+pnpm typecheck
+PASS — 42 successful tasks. Turbo invoked configured dependency build prerequisites as part of the repository's exact typecheck graph; no standalone build command was run.
+```
+
+Candidate formatting commands:
+
+```bash
+pnpm exec prettier --write <3 tracked rollups + 9 native-kanban artifacts + requirements + scratchpad>
+pnpm exec prettier --check <same files>
+pnpm exec prettier --ignore-path /dev/null --write \
+  docs/reports/native-kanban-sot/canon-initial-review-no-go.md \
+  docs/reports/native-kanban-sot/canon-final-rereview-go.md
+pnpm exec prettier --ignore-path /dev/null --check \
+  docs/reports/native-kanban-sot/canon-initial-review-no-go.md \
+  docs/reports/native-kanban-sot/canon-final-rereview-go.md
+```
+
+Result: PASS. The explicit `/dev/null` ignore path is required because `docs/reports/` is intentionally ignored pending coordinator force-tracking.
+
+Tracked and untracked whitespace checks:
+
+```text
+git diff --check
+PASS
+
+git diff --no-index --check /dev/null <each untracked/ignored candidate>
+PASS for all candidates
+```
+
+Strict contract compilation initially could not resolve pnpm-isolated `drizzle-orm` from the external docs directory. A temporary, removed dependency-context symlink made current-worktree resolution explicit:
+
+```bash
+LINK=docs/native-kanban-sot/node_modules
+ln -s ../../packages/db/node_modules "$LINK"
+trap 'unlink "$LINK"' EXIT
+pnpm exec tsc \
+  --noEmit \
+  --strict \
+  --skipLibCheck \
+  --target ES2022 \
+  --module NodeNext \
+  --moduleResolution NodeNext \
+  docs/native-kanban-sot/contracts/*.ts
+```
+
+Result: `strict-contract-noemit=PASS`; temporary link removed.
+
+Static result:
+
+```text
+proposal-audit-links=PASS
+kcr-invariant-regression=PASS
+publication-wording=PASS
+vocabulary-alignment=PASS
+```
+
+### Scope-integrity evidence
+
+Baseline and final hashes are identical:
+
+```text
+package.json   93a50eaefc7a0446a56234e427df03f6a2256f8da17c0bede17c22206928c8c0
+pnpm-lock.yaml 8b6448d51ac7797c8f782af52a080c0e38ab8bf364f32624f94e636bf5743229
+```
+
+`tracked-package-lock-source-unchanged=PASS`: every tracked/untracked nonignored change remains under `docs/`; no package, lock, application source, plugin source, configuration, CI trigger, standalone build/deploy, container, provider, commit, or push action occurred.