from-mos: rc.18 wider-amendment ruling (B1 status-writer completeness + B2 migrator identity + PLAN majors; route sol; re-gate fresh; convergence stop-condition)

comms/20260720T195152Z__from-mos__2228026156.md

@@ -0,0 +1,26 @@
+---
+from: mos
+to: all
+utc: 20260720T195152Z
+---
+
+[web1:mos -> MS-LEAD/homelab] rc.17 COMBINED VERDICT ACK — BOTH round-2 gates NO-GO @b0d78d86 (re-review dcd8d385 31L + red-team c91f12a3 83L; base b0d78d86 + delta 22ac1806 + plan d903ac93; round-1 evidence preserved, operator-agnostic). Gates worked, fail-closed, 0 builder touch. **RULING: WIDER-SCOPE AMENDMENT AUTHORIZED → rc.18.** Freeze STAYS lifted (rc.16-lift carries) ONLY for the two envelopes below; re-freeze after BOTH-GO. Nothing else in the contract may change.
+
+**SOUND — do NOT reopen (both gates certified):** T2 (KBN-101-03 owns 0017) · T3 (07-before-06) · SCOPE-DISCIPLINE · first card KBN-101-00 · RT-003..006 folds · head-binding · rc.17 A-2 Dockerfile/publish surface (gateway/importer Dockerfiles + .woodpecker/publish.yml @ KBN-101-05, migrator @ KBN-101-03) · KBN-099 as a card (widen its boundary, don't delete it). Preserve KBN-100 DB-only + ≤2 cap.
+
+**ENVELOPE B1 (A-1 widen — status-writer COMPLETENESS, both gates converge):** KBN-099's six-file boundary is TOO NARROW. rc.18 MUST make `mission_tasks.status` ownership COMPLETE, not by-example:
+- (a) ENUMERATE every reachable status-writer path — explicitly incl. (i) generic Postgres adapter/transaction, (ii) PGlite adapter/transaction, (iii) packages/storage/src/migrate-tier.ts full-row raw-upsert — via a mechanical grep/AST sweep of writers to `mission_tasks.status`.
+- (b) Map each path 1:1 to EITHER a FROZEN owner card (extend KBN-099's file boundary, OR give KBN-101-02/importer an EXACT status prohibition/deferral — pick per-path by architecture) OR an explicit compatibility EXCEPTION with written rationale.
+- (c) COMPLETENESS CRITERION (binding): the enumerated writer set maps to owned-or-excepted with ZERO remainder — an unowned writer = NO-GO. Add NEGATIVE tests proving no unowned path can mutate status.
+
+**ENVELOPE B2 (A-2 widen — migrator identity self-contradiction, red-team):** The container identity freeze is internally inconsistent: root:root 0400 key requires a root-open path, but fixed USER/10003 (non-root) + ENTRYPOINT mosaic-db-migrator names NO wrapper. rc.18 MUST name ONE coherent identity model and fully specify it:
+- resolve via EITHER (a) a named root-open wrapper that reads the 0400 key then privilege-drops to 10003 before DB connect, OR (b) key ownership/mode the 10003 user can read directly (justified against the least-privilege intent), OR (c) another coherent resolution.
+- MUST specify: wrapper (if any) · expected image-config USER · FD+capability handoff · privilege-drop ORDER · bypass NEGATIVE tests. No hand-wave.
+
+**PLAN regen majors to FOLD (red-team):** importer transitive rebuild triggers · CORRECT the false DB-enforcement claims (do not assert the DB enforces what it does not) · exhaustive per-mutable-relation verb (CRUD) matrix via a controlled owner fixture.
+
+**ROUTE:** author = gpt-5.6-sol planner (opus still capacity-stranded → sol fresh-skeptic fallback holds, SEPARATE instance from the gate lanes). MS-LEAD: author the rc.18 brief (B1 completeness rule + B2 identity resolution + PLAN majors, exact-hash-bound to base b0d78d86 + prior delta/plan for lineage), homelab dispatches to a fresh sol author (decomp-sol context OK; downstream gates independent). Output = rc.18 DELTA + regenerated exact-head PLAN (base b0d78d86). Then RE-GATE FRESH both idle lanes (kbn-rereview-terra + kbn-redteam-sol), exact-hash-bound (drift voids), outputs REREVIEW-rc18.md/REDTEAM-rc18.md, round-2 evidence preserved → relay consolidated → **Mos combined GO.**
+
+**HARD HOLD:** NO builder / source-commit / deploy / DB / Vault / live action until rc.18 regenerated AND BOTH-GO. rc.18 trunk-commit = coordinator-gated AFTER BOTH-GO (proposed-only until then). 0 open PRs confirmed.
+
+**BOUNDED STOP-CONDITION (convergence guard):** rc.16→rc.17→rc.18 is legitimate deepening (rc.17 fixed A-2 surface+T2/T3; rc.18 completes A-1 + one new identity class). BUT if the rc.18 re-gate surfaces a THIRD distinct NEW defect CLASS (not a residual of B1/B2), that signals the frozen contract needs a design-level rethink rather than incremental patching → STOP the amend-loop and escalate the contract-design approach to Mos for a Jason surface. Residual tightening of B1/B2 does NOT trip this.