diff --git a/docs/remediation/MISSION.md b/docs/remediation/MISSION.md index bb823ad3..f3b434f0 100644 --- a/docs/remediation/MISSION.md +++ b/docs/remediation/MISSION.md @@ -69,6 +69,11 @@ orphaned context loader, a fail-open bypass. **Work = wire + consolidate + retir (WRAPPER), auto-sync sweep (WORKFLOW), #1018 stale-consumed (INBOX). The fleet is its own test bed. - **Orchestration tracking → DB**, hard cutover ("rip off the bandaid"), NO flat-file interim. jarvis-brain PDA flat-files untouched. Current flat-file tracking runs as-is/unhardened until DB tracking is real, then one clean replace. + - ⚠ **QUALIFIED 2026-07-31 (DECISION-2, Mos):** the DB spine **must NOT be a single-point hard-stop.** + A broker-independent / degraded mode **and** a rehearsed rollback artifact are **design requirements** + (P-RECOVERY-001), binding now on RM-12, RM-13, RM-23, RM-36 and RM-53. This **supersedes** the earlier + orchestrator recommendation to pre-commit "no DB ⇒ the fleet stops" — that answer is _not_ on record. + Only the specific availability _target_ remains open, queued for Jason; it does **not** block current work. ## The 15 decisions (one-line; full rationale in the checkpoint) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 91897ad5..71989fa0 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -121,6 +121,18 @@ mission state is DB-backed (RM-53 / the P-MISSION cutover): Until then, the interim rule: **the same commit that records a ruling updates every document that states it.** Interim rules are exactly what the DB cutover exists to replace. +**The rule found a second instance within minutes of being written.** Auditing the charter against all +rulings to date (rather than waiting to be bitten again) surfaced that **DECISION-2 had also not +propagated**: `MISSION.md`'s standing directives still stated the DB hard-cutover with no mention of +Mos's binding qualification that _the spine must not be a single-point hard-stop_ (degraded mode + +rollback artifact required). A seat reading the charter would have designed toward an availability +posture the coordinator had explicitly rejected — and would have found the superseded +"no DB ⇒ the fleet stops" recommendation nowhere contradicted. Now corrected in place. + +**Two un-propagated rulings out of two rulings that touched charter text.** The propagation gap is not +an oversight that happened once; without a mechanism it is the _default outcome_. That is the argument +for making this a requirement rather than a discipline. + ### D-13 — two credential registries that can disagree (why the `--draft` fallback fired at all) Diagnosing D-12's root cause surfaced a distinct defect. There are **two parallel credential