docs(remediation): bank D-37/D-38, pre-register RM-61 re-review, rebuild board for a cold read
D-38 — RM-61's terminal-green verifier certified the right RECORD for the wrong COMMIT. rev-974 mutated only #2188's commit field and the gate still exited 0. Confirmed by construction: ate7b29219the whole verifier had exactly one "commit" line (159), no expected-head parameter, no comparison, no failure path. D-24 at the gate layer — a true answer to a different question. The transferable half is the AC set, not the verifier: AC1-AC8 ALL PASSED and the PR was still NO GO, because every registered check tested whether the signature discriminates and none tested whether the evidence was bound to its subject (coverage-failure-mode-2, D-17 class). Mos ruled a STANDING clause into RM-02 coverage: "does this gate bind its evidence to the subject under review?" — every gate can fail this way and pass its own ACs. D-37 — one shared .git/config silently re-identified EVERY worktree. extensions.worktreeConfig is unset, so a worker's repo-local identity write rebinds all linked worktrees at once; the orchestrator checkout and rev-974's review worktree both authored as coder-mos1. Distinct from D-34, not an instance: MOSAIC_GIT_IDENTITY was exported and correct and still resolved wrong. Sharp edge is gate-16 defeated in the artifact — the reviewer would author its pre-registered ACs as the author of the code under review. No contamination occurred. Containment (explicit -c, no shared-config rewrites mid-flight) is the standing order; the real fix is authorised and owned by Mos, sequenced at a quiet seam. #1024 is implicated: repo-local pinning is the colliding mechanism. Also pre-registers the twelve RM-61 re-review checks at exact head033b2ffbBEFORE the reviewer reads the diff, and rebuilds the board for a cold read — RM-61 "building", "nothing implemented yet", and DECISION-1/2/3 "must be ruled" were all stale, the D-36 class again at the same seam. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
co-authored by
Claude Opus 5
Claude Opus 5
parent
345d152790
commit
50c0340add
@@ -0,0 +1,40 @@
|
||||
# RM-61 / PR #1033 — PRE-REGISTERED RE-REVIEW ACCEPTANCE CHECKS
|
||||
|
||||
**Subject head (exact):** `033b2ffb46674b2c0bcc5197273c109b461f62d9`
|
||||
**Supersedes:** review 67 / comment 20403 @ `e7b29219` (NO GO). That verdict is VOID — the head moved.
|
||||
**Registered by:** `mos-remediation` (orchestrator). **Reviewer:** `rev-974` (author ≠ reviewer).
|
||||
**Registered BEFORE the reviewer read the diff.** Any head move after this file is committed voids the
|
||||
re-review and requires re-registration.
|
||||
|
||||
## Scope discipline
|
||||
|
||||
The prior review passed AC1–AC8 and still found a blocker, because the registered set tested whether the
|
||||
signature DISCRIMINATES and never tested whether the evidence was BOUND TO ITS SUBJECT (Finding 3 /
|
||||
coverage-failure-mode-2, D-17 class). This set therefore carries the binding property as a first-class
|
||||
check, and **RR7 explicitly invites the reviewer to attack outside the set** — a registered set is
|
||||
protection against retrofitting only, never a ceiling on scrutiny.
|
||||
|
||||
## Checks
|
||||
|
||||
| id | check | verdict form |
|
||||
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- |
|
||||
| **RR1** | The full 12-case contract harness passes at the exact head: `bash test-terminal-green-contract.sh` | ⇒0, and states 12 cases |
|
||||
| **RR2** | ★CRUX — the ORIGINAL ATTACK IS DEAD. Take the real `#2188` record, mutate ONLY `commit` to an unrelated 40-hex value, verify against the true expected head | ⇒1, `exempted_steps == 0`, anomaly naming expected vs actual |
|
||||
| **RR3** | Missing `--expect-commit` cannot be defaulted, inferred, or skipped | ⇒2 (not 0, not 1) |
|
||||
| **RR4** | Malformed expected commit (short SHA, non-hex, empty) is rejected — no silent normalisation into a pass | ⇒2 |
|
||||
| **RR5** | A record with the `commit` key ABSENT (not merely different) is rejected — fail-closed on missing, not just on mismatch | ⇒1, `exempted_steps == 0` |
|
||||
| **RR6** | The genuine artifact still passes when correctly bound: real `#2188` + its true head | ⇒0, `exempted_steps == 1`, exactly one `WP-K8S-1000-CI-POSTGRES-TEARDOWN` |
|
||||
| **RR7** | ★RED-FIRST, PROVED RETROACTIVELY. The four new cases must FAIL against the OLD verifier at `e7b29219` — otherwise they do not test what they claim (D-8 class). Run the new cases against the previous implementation | new cases ⇒≠0 under `e7b29219` |
|
||||
| **RR8** | AC2 OF THE PRIOR SET DID NOT REGRESS: both REAL controls stay terminal red — `#2189` (`ci-postgres` exit 1) and `#2191` (exit 137, `test` exit 61) | both ⇒1, `exempted_steps == 0` |
|
||||
| **RR9** | Still NO fetch / trigger / retry / re-roll / sleep / network of any kind in the verifier or harness. The coin flip must remain removed, not codified (D-21) | grep ⇒ no such call sites |
|
||||
| **RR10** | The doc/baseline changes REQUIRE the current provider PR head to be passed — they must not merely mention it. Check `merge-gate.md`, `CI-CD-PIPELINES.md`, `woodpecker/README.md` state it as a requirement a gate operator cannot satisfy by omission | reviewer judgement, quote the lines |
|
||||
| **RR11** | Exemption remains bound to #1000 and retires with it; signature conjunction unchanged and not widened by this fix | diff-scoped, ⇒ no widening |
|
||||
| **RR12** | Case-sensitivity: an uppercase-hex record commit against a lowercase expected head must NOT silently pass by accident of comparison. State which way it resolves and whether it fails closed | state the observed behaviour |
|
||||
|
||||
## Reviewer instruction
|
||||
|
||||
Report the verdict **bound to `033b2ffb46674b2c0bcc5197273c109b461f62d9`** and state each check's
|
||||
observed result, including counts read from `pipeline-status.sh -f json` (never default text — it omits
|
||||
`clone`, D-33). If any check is unrunnable, **say so** — never substitute a passing variant. Attack
|
||||
outside this set and report anything it finds; RR7 and RR12 exist because the last blocker was found
|
||||
exactly that way.
|
||||
+33
-36
@@ -1,36 +1,35 @@
|
||||
# mos-remediation — LIVE BOARD (keep < 8 KB)
|
||||
|
||||
**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 building.
|
||||
**Updated:** 2026-08-01 — **ORCHESTRATOR ROTATION SEAM** (prior seat rotated at ~803k tokens, ~4x threshold).
|
||||
**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 **remediated, in re-review**.
|
||||
**Updated:** 2026-08-01 — rotation seam CROSSED; successor seat resumed, attested, and is driving.
|
||||
(Prior seat rotated at ~803k tokens, ~4x threshold.)
|
||||
|
||||
## Head
|
||||
|
||||
- Mission charter + 15 decisions + 4-build plan: PERSISTED (`docs/remediation/MISSION.md`).
|
||||
- HOLD lifted for this workstream (Jason 2026-07-31). Nothing implemented yet — planning first.
|
||||
- Orchestrator seat `mos-remediation` is LIVE and owns the mission. Residency attestation: PASS.
|
||||
- **TASK-0 DONE** — checkout repaired, all three gates green HONESTLY (no `--no-verify`), branch pushed.
|
||||
- **TASK-1 DONE** — both planners delivered independently on clean context; reconciled into `TASKS.md`
|
||||
(58 tasks across P0–P5, 7 convergences, 7 adjudicated disagreements, 3 escalated decisions).
|
||||
- **NEXT ACTION IS NOT MINE:** DECISION-1/2/3 (`TASKS.md` §5) must be ruled before P0 dispatch.
|
||||
RM-01 is dispatchable immediately regardless — it depends on nothing and blocks everything.
|
||||
- Charter + 15 decisions + 4-build plan: `MISSION.md`. Backlog + all findings: `TASKS.md`.
|
||||
- Planning DONE (58 tasks, P0–P5). **DECISION-1/2/3 all RULED by Mos 2026-07-31** (`TASKS.md` §5) —
|
||||
nothing is waiting on a decision. D-2's availability _target_ is Jason-pending and non-blocking.
|
||||
- **Executing, not planning.** RM-01 is MERGED; three lanes are live (see In-flight).
|
||||
- Orchestrator seat `mos-remediation` LIVE, owns the mission, resumed across the rotation seam
|
||||
2026-08-01 and re-attested to Mos from the files. Residency attestation: PASS.
|
||||
|
||||
## In-flight
|
||||
|
||||
| Task | Owner | State |
|
||||
| ----------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) |
|
||||
| RM-03 queue guard | **Jason** | **merge-gate GO** @ `78ec47cd` (comment 20392) — **HELD FOR OWNER MERGE**. Head verified unmoved; GO is commit-bound and VOID if it moves — **do not push to #1032** |
|
||||
| RM-02 gate registry ★keystone | — | **BLOCKED on RM-61.** Code complete @ `f9746b23`, own harness green in CI, 2 reviews clear, head FROZEN. Cannot certify terminal-green: `ci-postgres` FAIL on #2187 **and** #2188 |
|
||||
| RM-61 CI-contract exemption | coder-mos1 | design APPROVED, **building**. Controls first → prove discrimination → then exempt |
|
||||
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** (A does not fix the ordering defect) |
|
||||
| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes; live REQUEST_CHANGES, do **not** merge |
|
||||
| Task | Owner | State |
|
||||
| ------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
|
||||
| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** |
|
||||
| RM-02 registry ★key | — | **BLOCKED on RM-61.** Complete @ `f9746b23`, head FROZEN, 2 live REQUEST_CHANGES. `ci-postgres` FAIL on #2187 **and** #2188 |
|
||||
| RM-61 CI exemption | coder-mos1 | **RE-REVIEW @ `033b2ffb`** (#1033). NO-GO@`e7b29219` VOID. Binding fix independently reproduced; 12 ACs pre-registered. **D-38** |
|
||||
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
|
||||
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
|
||||
|
||||
### For the incoming orchestrator — read this before acting
|
||||
|
||||
1. **Nothing is waiting on you that is urgent.** RM-03 waits on Jason; RM-02 waits on RM-61; RM-61 is
|
||||
building. Read the record before touching any lane.
|
||||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 35 findings
|
||||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in TASKS.md), every ruling with its rationale, and the
|
||||
in exact-head re-review. Read the record before touching any lane.
|
||||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 38 findings
|
||||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-38 in TASKS.md), every ruling with its rationale, and the
|
||||
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
|
||||
3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the
|
||||
property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an
|
||||
@@ -73,6 +72,11 @@ inside the correction for it.
|
||||
not a 200 on a read. Mos owns provisioning; escalate missing pairs.
|
||||
- Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and
|
||||
agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship.
|
||||
- ⚠ **LIVE HAZARD (D-37) — one shared `.git/config` re-identifies EVERY worktree at once.** Every seat,
|
||||
including `rev-974`'s review worktree, currently authors as **`coder-mos1`**; `MOSAIC_GIT_IDENTITY`
|
||||
does **not** override it. **STANDING ORDER: commit with explicit
|
||||
`git -c user.name=<seat> -c user.email=<seat>@…`, and NOBODY rewrites the shared config mid-flight.**
|
||||
Real fix authorised, Mos owns it, sequenced at a quiet seam. **#1024 implicated.** Detail: D-37.
|
||||
- Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**);
|
||||
commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never
|
||||
substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**).
|
||||
@@ -81,22 +85,15 @@ inside the correction for it.
|
||||
|
||||
## Sequencing — see [`MISSION.md`](./MISSION.md)
|
||||
|
||||
Builds 1-5 and the cross-cutting retirements are stated once in the charter. **Not repeated here.**
|
||||
|
||||
⚠ **DECISION-1 is RULED, not contested** (this board previously said otherwise — stale for hours after the
|
||||
ruling). The choke point targets a **new production Node `TaskExecutor` on the LIVE dispatch path**
|
||||
(`packages/mosaic` launch + `packages/coord`); the disabled Python rail is **deleted, not ported**.
|
||||
Builds 1-5, the cross-cutting retirements, and DECISION-1's corrected wire-in target are stated once in
|
||||
the charter and `TASKS.md` §5. **Not repeated here** — the previous copy of DECISION-1's status on this
|
||||
board is one of the six stale restatements below.
|
||||
|
||||
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
|
||||
|
||||
All 35 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in `TASKS.md`) and every ruling with its
|
||||
All 38 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-38 in `TASKS.md`) and every ruling with its
|
||||
rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this
|
||||
board has now done three times in one night (gate list, capability registry, DECISION-1 status).
|
||||
|
||||
Live rulings a fresh seat most needs:
|
||||
|
||||
- **D-23** queue guard is inert → zero-information until RM-03 merges. Never cite its green.
|
||||
- **D-33** scan CI from `-f json`; text mode omits `clone`. State counts.
|
||||
- **D-34** a context reset strips `MOSAIC_GIT_IDENTITY` → re-export in every brief.
|
||||
- **RM-61** exemption: controls FIRST, prove discrimination, THEN adopt — or fall to option A.
|
||||
- The RM-02 bounded CI re-roll was a **one-time stopgap, never policy**.
|
||||
board had done three times in one night (gate list, capability registry, DECISION-1 status), and three
|
||||
more times by the next rotation seam (RM-61 "building", "nothing implemented yet", DECISION-1/2/3
|
||||
"must be ruled"). The rulings a fresh seat needs are items 4–7 above; they are **not** repeated here,
|
||||
because that repetition is what went stale.
|
||||
|
||||
@@ -322,6 +322,81 @@ merges cannot perform them.
|
||||
And the shape holds: **RM-03 is the fix for the queue guard, so this — the first delivery through the
|
||||
complete stack — is also the last one gated by a check that could not fail.**
|
||||
|
||||
### D-38 — a gate that certified the right RECORD for the wrong COMMIT (and the AC set that could not see it)
|
||||
|
||||
**RM-61's terminal-green verifier reported the pipeline's commit and never bound it to the PR head.**
|
||||
`rev-974` altered ONLY `#2188`'s `commit` field to an unrelated 40-hex value; the verifier still exited 0
|
||||
with `exempted_steps=1`. So an older artifact pipeline could satisfy the detailed gate while
|
||||
`pr-ci-wait.sh` was evaluating a different head. Confirmed by the orchestrator **by construction, not by
|
||||
report**: at `e7b29219`, `grep -n commit` over the entire verifier returned exactly one line — 159,
|
||||
`"commit": record.get("commit")` — no argparse parameter, no comparison, no failure path. The verifier
|
||||
could not bind a scan to a head because it was never given one.
|
||||
|
||||
**Class: D-24 at the gate layer — a TRUE answer to a DIFFERENT question.** Not a lie, not a bug in the
|
||||
signature (AC1–AC8 all PASSED and the discrimination result stands); the gate answered "is this record
|
||||
terminal-green" correctly while the question that mattered was "is THIS HEAD terminal-green".
|
||||
|
||||
**★ The transferable finding is the AC set, not the verifier.** Eight pre-registered checks all passed
|
||||
and the PR was still NO GO. Every one tested whether the signature DISCRIMINATES; not one tested whether
|
||||
the evidence was BOUND TO ITS SUBJECT. That is **coverage-failure-mode-2 — INCOMPLETE (the D-17 class):
|
||||
green while a criterion's requirement goes untested.** It surfaced only because the reviewer went BEYOND
|
||||
the registered set and mutated a field no registered check covered.
|
||||
|
||||
**The recursion is why this must be standing.** This mission's own anti-inert-gate work shipped a gate
|
||||
that could certify the wrong subject — the disease one layer up, inside the cure, the same shape as
|
||||
DECISION-1's stranded-executor risk.
|
||||
|
||||
> **REQUIREMENT ON RM-02 (ruled by Mos, 2026-08-01): a STANDING coverage clause in the registry —
|
||||
> _"does this gate BIND its evidence to the subject under review?"_** Not per-gate discretion: every gate
|
||||
> we ship can fail this way **and pass its own ACs**, so the registry must ask it of each one. This
|
||||
> attaches to RM-02 clause (2) (coverage).
|
||||
|
||||
Remediated at `033b2ffb` (`--expect-commit`, exit 2 on missing/malformed, exit 1 on missing-or-mismatched
|
||||
record commit, harness 9→12 cases). Orchestrator reproduced the reviewer's exact attack independently:
|
||||
mutated ⇒ exit 1 / `exempted_steps 0` / explicit anomaly; correctly bound ⇒ exit 0 / `exempted_steps 1`;
|
||||
omitted argument ⇒ exit 2. Re-review pre-registered at `AC-RM61-REREVIEW-033b2ffb.md`.
|
||||
|
||||
### D-37 — ONE shared `.git/config` silently re-identified EVERY worktree, including the reviewer's
|
||||
|
||||
Found during the post-rotation resume, before any orchestration action. `extensions.worktreeConfig` is
|
||||
**unset** on this checkout, so all linked worktrees share `/src/mosaic-stack/.git/config`. A worker's
|
||||
repo-local identity write therefore rebinds identity **for every seat at once**:
|
||||
|
||||
| observation | value |
|
||||
| ---------------------------------------------------------------- | -------------------------------------------------------------- |
|
||||
| `.git/config` mtime | 2026-08-01 08:37:49 — inside `coder-mos1`'s RM-61 build window |
|
||||
| `user.name` / `user.email` / `mosaic.gitIdentity` | `coder-mos1` |
|
||||
| `git var GIT_AUTHOR_IDENT` in `/src/mosaic-stack` (orchestrator) | **`coder-mos1`** — not `mos-dt-0` |
|
||||
| same in `agent-work/rm-02`, `rm-03`, **`rev-974-pr1033`** | **`coder-mos1`** |
|
||||
|
||||
**This is a DISTINCT mechanism from D-34, not an instance of it.** `MOSAIC_GIT_IDENTITY=mos-dt-0` was
|
||||
exported and correct throughout, and the identity **still** resolved wrong — D-34 is "the env var gets
|
||||
stripped", this is "the env var is irrelevant because repo-local config outranks it."
|
||||
|
||||
**Sharp edge:** `rev-974`'s review worktree would author its **pre-registered acceptance checks as
|
||||
`coder-mos1` — the author of the code under review.** Gate-16 (author ≠ reviewer) defeated _in the
|
||||
artifact_, while the record reads clean. That is the charter's "integrity claim dressed as a property":
|
||||
the pre-registration would certify the wrong identity and look correct doing it. No contamination
|
||||
occurred — `rev-974-pr1033` was detached with zero commits of its own, and the RM-61 commits are
|
||||
genuinely `coder-mos1`'s own work, correctly attributed.
|
||||
|
||||
**★ The #1024 collision (escalated to Jason by Mos).** PR #1024 is literally _"pin repo-local
|
||||
`mosaic.gitIdentity` in five test suites"_ — **repo-local pinning IS the mechanism that just collided
|
||||
across every worktree.** #1024's APPROACH is therefore implicated: repo-local pinning WITHOUT
|
||||
`worktreeConfig` is the bug, not the fix. **#1024 must be re-scoped to worktree-scoped identity before
|
||||
it merges.**
|
||||
|
||||
**Rulings (Mos, 2026-08-01):**
|
||||
|
||||
- **CONTAINMENT (in force now):** nobody rewrites the shared config while lanes are live — that
|
||||
silently re-identifies live seats mid-flight, the same defect pointed the other way. Every seat commits
|
||||
with explicit `git -c user.name=<seat> -c user.email=<seat>@…`.
|
||||
- **REAL FIX AUTHORISED, owned by Mos, SEQUENCED AT A SEAM:** `extensions.worktreeConfig true` +
|
||||
per-worktree identity + wrappers writing worktree-scoped rather than repo-local. Not while three lanes
|
||||
are live.
|
||||
- **Requirements attach to RM-50** (roster-owned socket/host + quarantine) **and RM-58** (mechanical
|
||||
pre-dispatch reset) — both already own seat-identity mechanics.
|
||||
|
||||
### D-36 — a rotation-seam audit found THREE stale restatements on the live board
|
||||
|
||||
Checkpointing for the orchestrator rotation, the board was audited line by line before handing it to a
|
||||
|
||||
Reference in New Issue
Block a user