From e7c9160c7becb5f816ab0b2aab47a7aac921fb5c Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 23:01:07 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20board=20=E2=80=94=20delive?= =?UTF-8?q?ry-gate=20doctrine=20change=20recorded=20with=20render-vs-resta?= =?UTF-8?q?te=20root=20cause?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per Mos's item 4. The gate definition was incomplete from setup because the gates were restated from memory rather than referenced, and the omission propagated into every worker brief since — then recurred inside the correction itself (D-26). Board now carries the referenced sources, the gate order, freeze-after-GO, the coordinator/orchestrator split, and the queue-guard zero-information field form. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/BOARD-LEDGER.md | 10 +++++++ docs/remediation/BOARD.md | 49 +++++++++++++++++++++----------- 2 files changed, 43 insertions(+), 16 deletions(-) diff --git a/docs/remediation/BOARD-LEDGER.md b/docs/remediation/BOARD-LEDGER.md index 7c9e1560..64c9c8b2 100644 --- a/docs/remediation/BOARD-LEDGER.md +++ b/docs/remediation/BOARD-LEDGER.md @@ -23,3 +23,13 @@ Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ th ### **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.** planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request. + + + +### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.** + +~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents. + +### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.** + +Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class. diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 88eb9003..bf3bdffd 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -1,6 +1,6 @@ # mos-remediation — LIVE BOARD (keep < 8 KB) -**Phase:** EXECUTING — P0 open. RM-01 MERGED; RM-02 (keystone gate registry) is next. +**Phase:** EXECUTING — RM-02 (keystone) at review; RM-03 design-first; 27 findings banked. **Updated:** 2026-07-31 (mos-remediation orchestrator; seat active on `mosaic-fleet`). ## Head @@ -16,13 +16,38 @@ ## In-flight -| Task | Owner | State | -| ----------------------------------- | --------------- | ------------------------------------------------------------------------- | -| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (PR #1027) — rev-974 APPROVE + CI #2172 8/8 green | -| RM-02 gate registry ★keystone | unassigned | **READY** — depends only on RM-01; not held by RM-03 | -| RM-03 queue guard (3 defects) | — | HOLD — #1023 SUPERSEDED-PENDING-JASON | -| RM-59 close D-19 residual risk | — | BLOCKED by RM-12/RM-21/RM-25 (spine + executor) — tracked edge, not prose | -| `remediation/state` snapshot → main | mos-remediation | opening at this mission seam | +| Task | Owner | State | +| ------------------------------- | ------------- | ----------------------------------------------------------------------------------- | +| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-02 gate registry ★keystone | f10-coder | PR **#1030** @ `e4c30a33`; rev-974 reviewing; CI #2180 **running** — NOT gate-ready | +| RM-03 queue guard (3 defects) | coder-mos1 | design-first; build to READY then **HOLD for Jason** | +| RM-59 D-19 residual risk | — | blocked on RM-12/21/25 (tracked edge) | +| RM-60 / #1031 CI trust boundary | Jason (infra) | option **B** recommended; A does not fix the ordering defect | +| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES; do **not** merge | + +## Delivery gates — DOCTRINE CHANGE 2026-08-01 + +**The gate definition was incomplete from mission setup: the merge-gate verdict step was missing.** +Root cause (**D-26**): the gates were **restated from memory** into `MISSION.md`/`KICKSTART.md` instead of +**referenced**, and the omission propagated into every worker brief issued since. It then recurred _inside +the correction_ — which dropped five details including a security precondition and cited a file that does +not exist. + +**Fix is render-not-restate, mechanically.** `MISSION.md` and `KICKSTART.md` now **reference** +`~/.config/mosaic/fleet/roles.local/merge-gate.md` and `~/.config/mosaic/fleet/roles/validator.md` and +state only the gate **order**: + +> independent review (author ≠ reviewer) → remediation → **CI terminal-green at the exact head, full step +> scan** → **merge-gate verdict `GO`/`NO-GO`/`HOLD`** (commit-bound; **VOID on head move**; posted durably +> with enumerated evidence under its own minted identity) → **coordinator head-pinned merge** + +- **After a `GO`, pushes freeze** — a doc tweak voids the verdict. Gate-ready is a **freeze point**. +- The coordinator assigns the gate seat; the orchestrator owns getting a PR _gate-ready_. +- **Queue guard is ZERO-INFORMATION until RM-03 lands** (D-23) — record it as + `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. _A mandated field must not become a + manufactured one._ +- Gate seat identity: `gitea-mosaicstack-merge-gate` minted least-privilege, verified `push=False` — + it structurally cannot merge. ## Fleet seats @@ -71,14 +96,6 @@ PR #1025 AC2's fixture `mkdir -p apps/*/venv/lib` creates a literal `apps/*/venv/lib` dir when the glob is unmatched — it did not test what it claimed. rev-974 ran it exactly as written, caught it, re-ran the intended assertion at an explicit path, and **disclosed** rather than silently substituting a working fixture and reporting PASS. **Pre-registration protects a check from being retrofitted to the implementation; it does not make the check correct.** An unverified gate appeared inside the mechanism built to catch unverified gates. Hard requirement on RM-02: the registry must self-verify that every registered case runs AND can fail — presence is not evidence. -### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.** - -~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents. - -### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.** - -Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class. - ## Decisions log