mosaicstack/stack
1
0
Fork 1
Code Issues 139 Pull Requests 5 Actions Packages Projects Releases 15 Wiki Activity

docs(remediation): bank D-48 (a boundary statement that was wrong) and D-49 (idle is not available)

Browse Source 
D-48 is Mos's error, banked in Mos's words at Mos's request, and renumbered from the D-46 he suggested
because that number is already the empty-registry finding — the ledger is the primary product and a
duplicated number corrupts it.

Three seats shipped and approved "sound against an author who cannot rewrite main; residual =
compromised main; owner Builds 1-2". A1 does not rewrite main; it repoints a local remote-tracking ref
with one unprivileged git update-ref, which I reproduced in seconds. So the documented residual
described an exotic threat while the real one is trivial. Stating a boundary is not the same as stating
it correctly, and an understated residual is worse than none because it reads as rigorous. Everyone
checked a both-directions statement EXISTED; nobody checked it was TRUE. That is D-19's own move 2
performed with wrong content, and the third distinct way the render/verify principles have failed
inside their own enforcers.

And the correct answer was already written down. f10-coder's handoff holds the wrong claim at line 21
and, at line 29, the suspicion that overturns it — that provider-target ref selection may be
influenced by CI checkout/fetch configuration, marked honestly as unverified. rev-974 then found
exactly that. Had anyone run the suspicion down, D-48 would not have shipped. Requirement banked on
RM-02/RM-34: a labelled suspicion that contradicts a shipped claim must BLOCK that claim until
falsified. Suspicions are currently recorded and ignored, which makes honest labelling free of
consequence — where one targets a boundary or integrity claim it is a pre-registered check nobody ran.

D-49 refines the parking rule and supersedes the rationale of the coder-mos1 (c) ruling: the threshold
is not "is the seat idle" but "can it still take the next lane". f10-coder was idle with work pushed
and frozen, which reads as safe, but at 97.4% could not have taken the remediation the pending verdict
was about to require. Rotating on that asymmetry was the only clean boundary available.

The detection was discipline, not a mechanism — I was not watching seat context in real time and Mos
caught it on a manual sweep. Requirement on RM-58/P-LIFECYCLE/the coordinator daemon: the coordinator
watches token budget across seats and pre-empts at threshold, so a keystone seat's ceiling is never
found by a failed round or a lucky sweep. Interim we both sweep; the mechanism retires the sweep.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
mos-dt-0
2026-08-01 13:20:23 -05:00
co-authored by Claude Opus 5
parent 267b58deb3
commit eae62a598a
2 changed files with 75 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/remediation/BOARD.md
+3 -3
View File
@@ -31,8 +31,8 @@
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
sole-written and has no independent verifier.
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 48 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in TASKS.md), every ruling with its rationale, and the
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 50 findings
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-49 + D-38c in TASKS.md), every ruling with its rationale, and the
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
@@ -78,6 +78,6 @@ Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
All 48 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in `TASKS.md`) and every ruling with
All 50 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-49 + D-38c in `TASKS.md`) and every ruling with
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
docs/remediation/TASKS.md
+72
View File
@@ -558,6 +558,78 @@ claims from the provider**, not merely confirming the file parses or that a succ
> orchestrator does so before dispatch; **the coordinator does so before acting on or relaying a board
> claim that gates a decision** — Mos noted he had relayed board-derived state to Jason all session.
### D-49 — "idle" is not "available", and no one can manually watch every seat's context
**Banked at Mos's direction, correcting Mos's own earlier ruling.**
**The parking rule, refined — this SUPERSEDES the coder-mos1 (c) ruling's rationale.** That ruling
rested on _"a parked seat costs nothing until it is needed."_ True at 67% — `coder-mos1` could still
take a lane. **False at 97.4%**: when needed, `f10-coder` **cannot serve**.
> **THE THRESHOLD IS NOT "IS THE SEAT IDLE" BUT "CAN IT STILL TAKE THE NEXT LANE."**
> Idle does not equal available.
Applied live: `f10-coder` was idle with round 3 pushed and frozen, which reads as safe. The orchestrator
rotated anyway on an **asymmetry** — if the pending verdict approved, rotating cost nothing; if it
requested changes, remediation would dispatch to a seat that could not take it, forcing a **mid-lane
rotation on the keystone under time pressure (F2)**. The verdict duly requested changes. **Idle-now was
the only clean boundary available.**
**★ AND THE DETECTION WAS DISCIPLINE, NOT A MECHANISM.** The orchestrator was **not** watching seat
context in real time; **Mos caught 97.4% on a manual liveness sweep.** Mos's framing, kept verbatim
because it is the finding rather than an apology: _"a human/agent cannot manually watch every seat's
context %; my sweep caught it this time, which is discipline, not a mechanism, and this mission's thesis
is that discipline without a mechanism eventually fails."_
> **REQUIREMENT ON RM-58 / P-LIFECYCLE-001 / the coordinator daemon: the coordinator WATCHES TOKEN
> BUDGET ACROSS SEATS AND PRE-EMPTS AT THRESHOLD**, so a keystone seat's ceiling is never discovered by
> a failed round **or by a lucky manual sweep.** Interim: both coordinator and orchestrator sweep — and
> **the mechanism retires the sweep.**
### D-48 — a both-directions boundary statement that was WRONG, verified by three seats, and the suspicion that contradicted it was sitting in the handoff
**Banked as Mos's error, in Mos's words, at Mos's request.** (Mos said "bank as D-46"; that number is the
empty-registry finding — renumbered to D-48 rather than silently reuse it. **The ledger is the mission's
primary product; a duplicated number corrupts it.**)
`gate-history.mjs` shipped, and three seats approved, this boundary statement:
> DOES anchor to the provider target merge-base, sound against an author who cannot rewrite main;
> DOES NOT establish integrity when main itself is compromised; residual owner **Builds 1-2**.
**A1's attack does not rewrite main.** It repoints a local remote-tracking ref with one unprivileged
`git update-ref` (reproduced by the orchestrator in seconds). **So the documented residual understates
the real attack by orders of magnitude** — it describes an exotic threat (compromise `main`) while the
actual one is trivial (one command, no privilege).
> **★ STATING A BOUNDARY IS NOT THE SAME AS STATING IT CORRECTLY. AN UNDERSTATED RESIDUAL IS WORSE THAN
> NONE, BECAUSE IT READS AS RIGOROUS.** This is D-19's move 2 ("state the boundary in BOTH directions")
> performed with **wrong content** — and D-19 is the principle we had just promoted. The
> verify-the-property-not-the-proxy failure at the meta level: **everyone checked that a
> both-directions statement EXISTED; nobody checked it was TRUE.**
Owned by Mos (who verified and praised it), by the orchestrator (who verified and praised it), and by
`f10-coder` (who wrote it). **Third distinct way the render/verify principles have failed inside their
own enforcers** — with D-26 and D-30.
**★ AND THE CORRECT ANSWER WAS ALREADY WRITTEN DOWN.** `f10-coder`'s rotation handoff
(`~/agent-work/handoffs/f10-coder-20260801.md`) contains **both**:
| line | content |
| ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 21 | the **wrong claim** — "does not solve compromised/rewritten main; that residual belongs to Builds 1-2" |
| 29 | **"Suspicion (not verified): further review may probe whether provider-target ref selection itself can be influenced by CI checkout/fetch configuration; treat any such claim as a trust-boundary question."** |
**The seat held the shipped claim and the suspicion that overturns it, simultaneously, and labelled the
suspicion honestly.** `rev-974` then found exactly that. **Had anyone run the suspicion down, D-48 would
not have shipped.**
> **REQUIREMENT (RM-02 / RM-34): a labelled suspicion that CONTRADICTS a shipped claim must block that
> claim until falsified — it is not a note.** Suspicions are currently recorded and then ignored, which
> makes honest labelling free of consequence. The value of marking uncertainty is lost if nothing
> consumes the mark. **Where a suspicion targets a boundary statement or an integrity claim, it is a
> pre-registered check that has not been run yet.**
### D-45 — you cannot fix "the author controls X" by deriving X from something the author also controls
Second NO-GO on the keystone, `32b490a7`. **The pattern is the finding, not the three blockers.**