diff --git a/docs/remediation/AC-RM61-REREVIEW-033b2ffb.md b/docs/remediation/AC-RM61-REREVIEW-033b2ffb.md new file mode 100644 index 00000000..fa86c121 --- /dev/null +++ b/docs/remediation/AC-RM61-REREVIEW-033b2ffb.md @@ -0,0 +1,40 @@ +# RM-61 / PR #1033 — PRE-REGISTERED RE-REVIEW ACCEPTANCE CHECKS + +**Subject head (exact):** `033b2ffb46674b2c0bcc5197273c109b461f62d9` +**Supersedes:** review 67 / comment 20403 @ `e7b29219` (NO GO). That verdict is VOID — the head moved. +**Registered by:** `mos-remediation` (orchestrator). **Reviewer:** `rev-974` (author ≠ reviewer). +**Registered BEFORE the reviewer read the diff.** Any head move after this file is committed voids the +re-review and requires re-registration. + +## Scope discipline + +The prior review passed AC1–AC8 and still found a blocker, because the registered set tested whether the +signature DISCRIMINATES and never tested whether the evidence was BOUND TO ITS SUBJECT (Finding 3 / +coverage-failure-mode-2, D-17 class). This set therefore carries the binding property as a first-class +check, and **RR7 explicitly invites the reviewer to attack outside the set** — a registered set is +protection against retrofitting only, never a ceiling on scrutiny. + +## Checks + +| id | check | verdict form | +| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | +| **RR1** | The full 12-case contract harness passes at the exact head: `bash test-terminal-green-contract.sh` | ⇒0, and states 12 cases | +| **RR2** | ★CRUX — the ORIGINAL ATTACK IS DEAD. Take the real `#2188` record, mutate ONLY `commit` to an unrelated 40-hex value, verify against the true expected head | ⇒1, `exempted_steps == 0`, anomaly naming expected vs actual | +| **RR3** | Missing `--expect-commit` cannot be defaulted, inferred, or skipped | ⇒2 (not 0, not 1) | +| **RR4** | Malformed expected commit (short SHA, non-hex, empty) is rejected — no silent normalisation into a pass | ⇒2 | +| **RR5** | A record with the `commit` key ABSENT (not merely different) is rejected — fail-closed on missing, not just on mismatch | ⇒1, `exempted_steps == 0` | +| **RR6** | The genuine artifact still passes when correctly bound: real `#2188` + its true head | ⇒0, `exempted_steps == 1`, exactly one `WP-K8S-1000-CI-POSTGRES-TEARDOWN` | +| **RR7** | ★RED-FIRST, PROVED RETROACTIVELY. The four new cases must FAIL against the OLD verifier at `e7b29219` — otherwise they do not test what they claim (D-8 class). Run the new cases against the previous implementation | new cases ⇒≠0 under `e7b29219` | +| **RR8** | AC2 OF THE PRIOR SET DID NOT REGRESS: both REAL controls stay terminal red — `#2189` (`ci-postgres` exit 1) and `#2191` (exit 137, `test` exit 61) | both ⇒1, `exempted_steps == 0` | +| **RR9** | Still NO fetch / trigger / retry / re-roll / sleep / network of any kind in the verifier or harness. The coin flip must remain removed, not codified (D-21) | grep ⇒ no such call sites | +| **RR10** | The doc/baseline changes REQUIRE the current provider PR head to be passed — they must not merely mention it. Check `merge-gate.md`, `CI-CD-PIPELINES.md`, `woodpecker/README.md` state it as a requirement a gate operator cannot satisfy by omission | reviewer judgement, quote the lines | +| **RR11** | Exemption remains bound to #1000 and retires with it; signature conjunction unchanged and not widened by this fix | diff-scoped, ⇒ no widening | +| **RR12** | Case-sensitivity: an uppercase-hex record commit against a lowercase expected head must NOT silently pass by accident of comparison. State which way it resolves and whether it fails closed | state the observed behaviour | + +## Reviewer instruction + +Report the verdict **bound to `033b2ffb46674b2c0bcc5197273c109b461f62d9`** and state each check's +observed result, including counts read from `pipeline-status.sh -f json` (never default text — it omits +`clone`, D-33). If any check is unrunnable, **say so** — never substitute a passing variant. Attack +outside this set and report anything it finds; RR7 and RR12 exist because the last blocker was found +exactly that way. diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 73420ef2..4fc742f3 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -1,36 +1,35 @@ # mos-remediation — LIVE BOARD (keep < 8 KB) -**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 building. -**Updated:** 2026-08-01 — **ORCHESTRATOR ROTATION SEAM** (prior seat rotated at ~803k tokens, ~4x threshold). +**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 **remediated, in re-review**. +**Updated:** 2026-08-01 — rotation seam CROSSED; successor seat resumed, attested, and is driving. +(Prior seat rotated at ~803k tokens, ~4x threshold.) ## Head -- Mission charter + 15 decisions + 4-build plan: PERSISTED (`docs/remediation/MISSION.md`). -- HOLD lifted for this workstream (Jason 2026-07-31). Nothing implemented yet — planning first. -- Orchestrator seat `mos-remediation` is LIVE and owns the mission. Residency attestation: PASS. -- **TASK-0 DONE** — checkout repaired, all three gates green HONESTLY (no `--no-verify`), branch pushed. -- **TASK-1 DONE** — both planners delivered independently on clean context; reconciled into `TASKS.md` - (58 tasks across P0–P5, 7 convergences, 7 adjudicated disagreements, 3 escalated decisions). -- **NEXT ACTION IS NOT MINE:** DECISION-1/2/3 (`TASKS.md` §5) must be ruled before P0 dispatch. - RM-01 is dispatchable immediately regardless — it depends on nothing and blocks everything. +- Charter + 15 decisions + 4-build plan: `MISSION.md`. Backlog + all findings: `TASKS.md`. +- Planning DONE (58 tasks, P0–P5). **DECISION-1/2/3 all RULED by Mos 2026-07-31** (`TASKS.md` §5) — + nothing is waiting on a decision. D-2's availability _target_ is Jason-pending and non-blocking. +- **Executing, not planning.** RM-01 is MERGED; three lanes are live (see In-flight). +- Orchestrator seat `mos-remediation` LIVE, owns the mission, resumed across the rotation seam + 2026-08-01 and re-attested to Mos from the files. Residency attestation: PASS. ## In-flight -| Task | Owner | State | -| ----------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | -| RM-03 queue guard | **Jason** | **merge-gate GO** @ `78ec47cd` (comment 20392) — **HELD FOR OWNER MERGE**. Head verified unmoved; GO is commit-bound and VOID if it moves — **do not push to #1032** | -| RM-02 gate registry ★keystone | — | **BLOCKED on RM-61.** Code complete @ `f9746b23`, own harness green in CI, 2 reviews clear, head FROZEN. Cannot certify terminal-green: `ci-postgres` FAIL on #2187 **and** #2188 | -| RM-61 CI-contract exemption | coder-mos1 | design APPROVED, **building**. Controls first → prove discrimination → then exempt | -| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** (A does not fix the ordering defect) | -| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes; live REQUEST_CHANGES, do **not** merge | +| Task | Owner | State | +| ------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------- | +| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-03 queue guard | **Jason** | **GO** @ `78ec47cd` (cmt 20392) — HELD FOR OWNER MERGE. Head unmoved; GO commit-bound, VOID if it moves — **do not push #1032** | +| RM-02 registry ★key | — | **BLOCKED on RM-61.** Complete @ `f9746b23`, head FROZEN, 2 live REQUEST_CHANGES. `ci-postgres` FAIL on #2187 **and** #2188 | +| RM-61 CI exemption | coder-mos1 | **RE-REVIEW @ `033b2ffb`** (#1033). NO-GO@`e7b29219` VOID. Binding fix independently reproduced; 12 ACs pre-registered. **D-38** | +| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** | +| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge | ### For the incoming orchestrator — read this before acting 1. **Nothing is waiting on you that is urgent.** RM-03 waits on Jason; RM-02 waits on RM-61; RM-61 is - building. Read the record before touching any lane. -2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 35 findings - (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in TASKS.md), every ruling with its rationale, and the + in exact-head re-review. Read the record before touching any lane. +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 38 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-38 in TASKS.md), every ruling with its rationale, and the requirements each finding placed on RM-02/RM-34/RM-50/RM-55. 3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an @@ -73,6 +72,11 @@ inside the correction for it. not a 200 on a read. Mos owns provisioning; escalate missing pairs. - Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. +- ⚠ **LIVE HAZARD (D-37) — one shared `.git/config` re-identifies EVERY worktree at once.** Every seat, + including `rev-974`'s review worktree, currently authors as **`coder-mos1`**; `MOSAIC_GIT_IDENTITY` + does **not** override it. **STANDING ORDER: commit with explicit + `git -c user.name= -c user.email=@…`, and NOBODY rewrites the shared config mid-flight.** + Real fix authorised, Mos owns it, sequenced at a quiet seam. **#1024 implicated.** Detail: D-37. - Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**); commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**). @@ -81,22 +85,15 @@ inside the correction for it. ## Sequencing — see [`MISSION.md`](./MISSION.md) -Builds 1-5 and the cross-cutting retirements are stated once in the charter. **Not repeated here.** - -⚠ **DECISION-1 is RULED, not contested** (this board previously said otherwise — stale for hours after the -ruling). The choke point targets a **new production Node `TaskExecutor` on the LIVE dispatch path** -(`packages/mosaic` launch + `packages/coord`); the disabled Python rail is **deleted, not ported**. +Builds 1-5, the cross-cutting retirements, and DECISION-1's corrected wire-in target are stated once in +the charter and `TASKS.md` §5. **Not repeated here** — the previous copy of DECISION-1's status on this +board is one of the six stale restatements below. ## Decisions log — full record in [`TASKS.md`](./TASKS.md) -All 35 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in `TASKS.md`) and every ruling with its +All 38 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-38 in `TASKS.md`) and every ruling with its rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this -board has now done three times in one night (gate list, capability registry, DECISION-1 status). - -Live rulings a fresh seat most needs: - -- **D-23** queue guard is inert → zero-information until RM-03 merges. Never cite its green. -- **D-33** scan CI from `-f json`; text mode omits `clone`. State counts. -- **D-34** a context reset strips `MOSAIC_GIT_IDENTITY` → re-export in every brief. -- **RM-61** exemption: controls FIRST, prove discrimination, THEN adopt — or fall to option A. -- The RM-02 bounded CI re-roll was a **one-time stopgap, never policy**. +board had done three times in one night (gate list, capability registry, DECISION-1 status), and three +more times by the next rotation seam (RM-61 "building", "nothing implemented yet", DECISION-1/2/3 +"must be ruled"). The rulings a fresh seat needs are items 4–7 above; they are **not** repeated here, +because that repetition is what went stale. diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 6d80a07a..870e306e 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -322,6 +322,81 @@ merges cannot perform them. And the shape holds: **RM-03 is the fix for the queue guard, so this — the first delivery through the complete stack — is also the last one gated by a check that could not fail.** +### D-38 — a gate that certified the right RECORD for the wrong COMMIT (and the AC set that could not see it) + +**RM-61's terminal-green verifier reported the pipeline's commit and never bound it to the PR head.** +`rev-974` altered ONLY `#2188`'s `commit` field to an unrelated 40-hex value; the verifier still exited 0 +with `exempted_steps=1`. So an older artifact pipeline could satisfy the detailed gate while +`pr-ci-wait.sh` was evaluating a different head. Confirmed by the orchestrator **by construction, not by +report**: at `e7b29219`, `grep -n commit` over the entire verifier returned exactly one line — 159, +`"commit": record.get("commit")` — no argparse parameter, no comparison, no failure path. The verifier +could not bind a scan to a head because it was never given one. + +**Class: D-24 at the gate layer — a TRUE answer to a DIFFERENT question.** Not a lie, not a bug in the +signature (AC1–AC8 all PASSED and the discrimination result stands); the gate answered "is this record +terminal-green" correctly while the question that mattered was "is THIS HEAD terminal-green". + +**★ The transferable finding is the AC set, not the verifier.** Eight pre-registered checks all passed +and the PR was still NO GO. Every one tested whether the signature DISCRIMINATES; not one tested whether +the evidence was BOUND TO ITS SUBJECT. That is **coverage-failure-mode-2 — INCOMPLETE (the D-17 class): +green while a criterion's requirement goes untested.** It surfaced only because the reviewer went BEYOND +the registered set and mutated a field no registered check covered. + +**The recursion is why this must be standing.** This mission's own anti-inert-gate work shipped a gate +that could certify the wrong subject — the disease one layer up, inside the cure, the same shape as +DECISION-1's stranded-executor risk. + +> **REQUIREMENT ON RM-02 (ruled by Mos, 2026-08-01): a STANDING coverage clause in the registry — +> _"does this gate BIND its evidence to the subject under review?"_** Not per-gate discretion: every gate +> we ship can fail this way **and pass its own ACs**, so the registry must ask it of each one. This +> attaches to RM-02 clause (2) (coverage). + +Remediated at `033b2ffb` (`--expect-commit`, exit 2 on missing/malformed, exit 1 on missing-or-mismatched +record commit, harness 9→12 cases). Orchestrator reproduced the reviewer's exact attack independently: +mutated ⇒ exit 1 / `exempted_steps 0` / explicit anomaly; correctly bound ⇒ exit 0 / `exempted_steps 1`; +omitted argument ⇒ exit 2. Re-review pre-registered at `AC-RM61-REREVIEW-033b2ffb.md`. + +### D-37 — ONE shared `.git/config` silently re-identified EVERY worktree, including the reviewer's + +Found during the post-rotation resume, before any orchestration action. `extensions.worktreeConfig` is +**unset** on this checkout, so all linked worktrees share `/src/mosaic-stack/.git/config`. A worker's +repo-local identity write therefore rebinds identity **for every seat at once**: + +| observation | value | +| ---------------------------------------------------------------- | -------------------------------------------------------------- | +| `.git/config` mtime | 2026-08-01 08:37:49 — inside `coder-mos1`'s RM-61 build window | +| `user.name` / `user.email` / `mosaic.gitIdentity` | `coder-mos1` | +| `git var GIT_AUTHOR_IDENT` in `/src/mosaic-stack` (orchestrator) | **`coder-mos1`** — not `mos-dt-0` | +| same in `agent-work/rm-02`, `rm-03`, **`rev-974-pr1033`** | **`coder-mos1`** | + +**This is a DISTINCT mechanism from D-34, not an instance of it.** `MOSAIC_GIT_IDENTITY=mos-dt-0` was +exported and correct throughout, and the identity **still** resolved wrong — D-34 is "the env var gets +stripped", this is "the env var is irrelevant because repo-local config outranks it." + +**Sharp edge:** `rev-974`'s review worktree would author its **pre-registered acceptance checks as +`coder-mos1` — the author of the code under review.** Gate-16 (author ≠ reviewer) defeated _in the +artifact_, while the record reads clean. That is the charter's "integrity claim dressed as a property": +the pre-registration would certify the wrong identity and look correct doing it. No contamination +occurred — `rev-974-pr1033` was detached with zero commits of its own, and the RM-61 commits are +genuinely `coder-mos1`'s own work, correctly attributed. + +**★ The #1024 collision (escalated to Jason by Mos).** PR #1024 is literally _"pin repo-local +`mosaic.gitIdentity` in five test suites"_ — **repo-local pinning IS the mechanism that just collided +across every worktree.** #1024's APPROACH is therefore implicated: repo-local pinning WITHOUT +`worktreeConfig` is the bug, not the fix. **#1024 must be re-scoped to worktree-scoped identity before +it merges.** + +**Rulings (Mos, 2026-08-01):** + +- **CONTAINMENT (in force now):** nobody rewrites the shared config while lanes are live — that + silently re-identifies live seats mid-flight, the same defect pointed the other way. Every seat commits + with explicit `git -c user.name= -c user.email=@…`. +- **REAL FIX AUTHORISED, owned by Mos, SEQUENCED AT A SEAM:** `extensions.worktreeConfig true` + + per-worktree identity + wrappers writing worktree-scoped rather than repo-local. Not while three lanes + are live. +- **Requirements attach to RM-50** (roster-owned socket/host + quarantine) **and RM-58** (mechanical + pre-dispatch reset) — both already own seat-identity mechanics. + ### D-36 — a rotation-seam audit found THREE stale restatements on the live board Checkpointing for the orchestrator rotation, the board was audited line by line before handing it to a