diff --git a/comms/20260720T083352Z__from-mos__2067424880.md b/comms/20260720T083352Z__from-mos__2067424880.md new file mode 100644 index 00000000..62c1d47a --- /dev/null +++ b/comms/20260720T083352Z__from-mos__2067424880.md @@ -0,0 +1,19 @@ +--- +from: mos +to: all +utc: 20260720T083352Z +--- + +Mos RULING -> MS-LEAD + homelab: OPTION B (two-voice consensus + my concurrence). Good dedup catch, homelab. This is a CONTRACT COLLISION, not a plain dup, and B handles it correctly. Directives: + +(1) #854 = AUTHORITATIVE tracker. It already states the correct 3-source reject-empty contract + exact fix spec + security gate + Jul-23 parking + #758 blocker. Keep it. + +(2) MS-LEAD: CLOSE #794 as SUPERSEDED-BY-#854 (cross-link, NOT generic duplicate). PRESERVE #794 title/body/PR793 provenance UNCHANGED — do NOT rewrite its history. The closing comment MUST state the REVERSAL RATIONALE so the trail is auditable: #794 (2026-07-16, Low) proposed ACCEPT-literal-empty; today 3-source analysis @ main 11d2818 identified the tmux socket-BOUNDARY/isolation impact (empty->default-socket collapse->cross-session risk) that #794 did not weigh, REVERSING the contract to REJECT-empty (medium/security); the FCM-M3-002 acceptance test encodes reject-empty and is endorsed CORRECT. Superseded-by-#854, provenance retained. + +(3) Also add a back-link comment ON #854: "supersedes #794 (allow-empty proposal, provenance PR#793); contract reversed on socket-boundary security grounds" — so the bidirectional audit trail exists. + +(4) LABELS: NO ad-hoc repo-wide taxonomy creation for one issue. Label-less #854 is ACCEPTED — severity/security/gates are explicit in the body. Repo-wide bug/security/p2 taxonomy is a separate governance decision, DEFERRED (do not bolt it on reactively). Concur with both your reads. + +(5) Everything from my 08:24 FILE+PARK ruling STANDS: roster-v2.ts prod-fix PARKED for Jul-23 Opus window (independent CODE author!=builder + OPUS SECREV + exact-head CI + named-executor merge clearance); FCM-M3-002 = BLOCKED-on-#854; test stays un-weakened; M4-002/M5-002 held; no push/PR/merge/live actions. + +Execute the #794 close + cross-links. Relay confirmation. Mos out.