From 7f686aaf6d4bd5af2e9e06fa64b91b52bb053b64 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 18:11:01 -0500 Subject: [PATCH] docs(remediation): bank D-14 decision-propagation requirement; record D-13 reconciliation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit D-14: DECISION-1 was ruled and applied to TASKS.md while MISSION.md — the charter a cold-starting seat reads first — kept the superseded wire-in target for hours, flagged CONTESTED on the board but never corrected in the source of truth. A resuming seat would have read the rejected target as authoritative. Caught by hand during an unrelated edit; nothing would have caught it otherwise. P-MISSION-001 turned on ourselves: a decision that lives in a ruling and a board note but not in the authoritative record has been AGREED, not MADE. Requirement: rulings must propagate mechanically — decisions as records, documents rendering rather than restating, and a must-fail check where duplication is unavoidable. Interim rule until the DB cutover: the same commit that records a ruling updates every document stating it. D-13 updated with Mos's reconciliation: 5 of 6 mosaicstack-provisioned seats have no tea login — systemic, not a one-off. Supersedes D-11(b): the token-file set is necessary but NOT sufficient; capability is per-path. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 49 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 09517924..91897ad5 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -93,6 +93,34 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI. Three independent live instances in a single session — format gate, agent context reset, queue guard — is the class confirmed, not anecdote. +### D-14 — a ruled decision did not propagate to the authoritative record + +DECISION-1 (the corrected choke-point wire-in target) was ruled by the coordinator and applied to +`TASKS.md`. **`MISSION.md` — the charter, the document a cold-starting seat reads first — kept the +superseded target for hours.** It was flagged `CONTESTED` in a board note, then the ruling landed and +nobody edited the charter. A seat resuming from the charter would have read the _rejected_ target as +authoritative and wired the choke point into a disabled rail — the precise failure the ruling existed +to prevent. + +Caught by hand, during an unrelated edit. Nothing would have caught it otherwise. + +**This is P-MISSION-001 turned on ourselves.** The mission's own thesis is that convention exists and +_enforcement_ is the gap: a decision that lives in a chat ruling and a board note, but not in the +source of truth, has not actually been made — it has been _agreed_. The two are different, and the +difference is exactly what this mission is about. + +**Requirement (not merely a fix).** A ruled decision must propagate **mechanically** to the +authoritative record; it must not depend on someone remembering to edit a second file. Concretely, once +mission state is DB-backed (RM-53 / the P-MISSION cutover): + +- a decision is a **record**, not prose duplicated across documents; +- documents _render_ decisions rather than restating them, so there is one place to be wrong; +- and where duplication is unavoidable, a check asserts the authoritative record and the derived + document agree — with a must-fail control proving divergence is detected. + +Until then, the interim rule: **the same commit that records a ruling updates every document that +states it.** Interim rules are exactly what the DB cutover exists to replace. + ### D-13 — two credential registries that can disagree (why the `--draft` fallback fired at all) Diagnosing D-12's root cause surfaced a distinct defect. There are **two parallel credential @@ -120,6 +148,27 @@ used**, not merely token-file presence. PR/issue creation via API fallback, comment posting, and all reads. Impact is confined to tea-only features — `--draft`, `--labels`, `--milestone`. +**Reconciliation run by Mos (the manual form of RM-04's assert-agreement, done once by hand).** For +`git.mosaicstack.dev`, the token-file registry holds **six** seats; `tea` holds logins for **two**: + +| state | seats | +| ------------------------------------------------ | -------------------------------------------------------- | +| token file present, **no** mosaicstack tea login | `f10-coder`, `jarvis`, `mos-admin`, `mos-dt-0`, `pepper` | +| token file present **and** tea login present | `rev-974` (only) | + +**Five of six provisioned seats are silently degraded on tea-only features.** This is _systemic_, not +a one-off — which is why the fix is registry reconciliation (RM-04) and not a per-seat mint. Minting +one seat would clear a symptom and leave the class live. + +Mos deliberately deferred the mint: it is not on RM-01's critical path, and additively editing shared +`tea` config underneath running work is a change he declined to make without cause. Full remediation — +mint the five missing logins **and** wire the startup must-fail assertion that _detects_ disagreement — +lands as RM-04 at a non-critical seam, or immediately if any seat needs a tea-only feature to progress. + +**Correction of record:** this supersedes D-11(b)'s claim that the token-file set is _the_ authoritative +capability registry. It is **necessary but not sufficient**. Capability is **per-path**: the token file +governs the raw-API path, the tea login governs the tea path, and the two can disagree silently. + ### D-12 — a requested SAFETY flag was silently degraded, and I did not check I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.