diff --git a/docs/remediation/BOARD-LEDGER.md b/docs/remediation/BOARD-LEDGER.md index 7c9e1560..64c9c8b2 100644 --- a/docs/remediation/BOARD-LEDGER.md +++ b/docs/remediation/BOARD-LEDGER.md @@ -23,3 +23,13 @@ Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ th ### **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.** planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request. + + + +### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.** + +~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents. + +### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.** + +Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class. diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 88eb9003..bf3bdffd 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -1,6 +1,6 @@ # mos-remediation — LIVE BOARD (keep < 8 KB) -**Phase:** EXECUTING — P0 open. RM-01 MERGED; RM-02 (keystone gate registry) is next. +**Phase:** EXECUTING — RM-02 (keystone) at review; RM-03 design-first; 27 findings banked. **Updated:** 2026-07-31 (mos-remediation orchestrator; seat active on `mosaic-fleet`). ## Head @@ -16,13 +16,38 @@ ## In-flight -| Task | Owner | State | -| ----------------------------------- | --------------- | ------------------------------------------------------------------------- | -| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (PR #1027) — rev-974 APPROVE + CI #2172 8/8 green | -| RM-02 gate registry ★keystone | unassigned | **READY** — depends only on RM-01; not held by RM-03 | -| RM-03 queue guard (3 defects) | — | HOLD — #1023 SUPERSEDED-PENDING-JASON | -| RM-59 close D-19 residual risk | — | BLOCKED by RM-12/RM-21/RM-25 (spine + executor) — tracked edge, not prose | -| `remediation/state` snapshot → main | mos-remediation | opening at this mission seam | +| Task | Owner | State | +| ------------------------------- | ------------- | ----------------------------------------------------------------------------------- | +| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-02 gate registry ★keystone | f10-coder | PR **#1030** @ `e4c30a33`; rev-974 reviewing; CI #2180 **running** — NOT gate-ready | +| RM-03 queue guard (3 defects) | coder-mos1 | design-first; build to READY then **HOLD for Jason** | +| RM-59 D-19 residual risk | — | blocked on RM-12/21/25 (tracked edge) | +| RM-60 / #1031 CI trust boundary | Jason (infra) | option **B** recommended; A does not fix the ordering defect | +| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES; do **not** merge | + +## Delivery gates — DOCTRINE CHANGE 2026-08-01 + +**The gate definition was incomplete from mission setup: the merge-gate verdict step was missing.** +Root cause (**D-26**): the gates were **restated from memory** into `MISSION.md`/`KICKSTART.md` instead of +**referenced**, and the omission propagated into every worker brief issued since. It then recurred _inside +the correction_ — which dropped five details including a security precondition and cited a file that does +not exist. + +**Fix is render-not-restate, mechanically.** `MISSION.md` and `KICKSTART.md` now **reference** +`~/.config/mosaic/fleet/roles.local/merge-gate.md` and `~/.config/mosaic/fleet/roles/validator.md` and +state only the gate **order**: + +> independent review (author ≠ reviewer) → remediation → **CI terminal-green at the exact head, full step +> scan** → **merge-gate verdict `GO`/`NO-GO`/`HOLD`** (commit-bound; **VOID on head move**; posted durably +> with enumerated evidence under its own minted identity) → **coordinator head-pinned merge** + +- **After a `GO`, pushes freeze** — a doc tweak voids the verdict. Gate-ready is a **freeze point**. +- The coordinator assigns the gate seat; the orchestrator owns getting a PR _gate-ready_. +- **Queue guard is ZERO-INFORMATION until RM-03 lands** (D-23) — record it as + `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. _A mandated field must not become a + manufactured one._ +- Gate seat identity: `gitea-mosaicstack-merge-gate` minted least-privilege, verified `push=False` — + it structurally cannot merge. ## Fleet seats @@ -71,14 +96,6 @@ PR #1025 AC2's fixture `mkdir -p apps/*/venv/lib` creates a literal `apps/*/venv/lib` dir when the glob is unmatched — it did not test what it claimed. rev-974 ran it exactly as written, caught it, re-ran the intended assertion at an explicit path, and **disclosed** rather than silently substituting a working fixture and reporting PASS. **Pre-registration protects a check from being retrofitted to the implementation; it does not make the check correct.** An unverified gate appeared inside the mechanism built to catch unverified gates. Hard requirement on RM-02: the registry must self-verify that every registered case runs AND can fail — presence is not evidence. -### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.** - -~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents. - -### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.** - -Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class. - ## Decisions log