Sol r14 re-review left two findings. NEW-20 residual (BLOCKER): §2.3
closed the bootstrap-status response to epoch/mode with no other field,
conflicting with contract 5 §4.3's mandatory correlation echo on mapped
operations (§§1.1, 7 item 8). Rev 14's state-derived/envelope split is
now applied to bootstrap-status: §2.3 bounds state-derived content only
and carries the contract 5 §4 envelope; §6 item 2's closed-field
assertion and §7 item 2's description follow. Contract 5 not amended.
NEW-22 (MAJOR): the active-window witness claimed its seed-workspace-
scoped mutant fails branches (b) and (c); it passes (c). The witness now
attributes (b) to that mutant, names the separate all-workspace mutant
branch (c) catches, and states branches (a)/(b)/(c) start from isolated
copies of the same incomplete pre-state.
Preamble: Revision 15 paragraph; Revision 14 superseding note.
Addresses sol re-review 13 (NEW-18/NEW-19 residuals, NEW-20, NEW-21):
- NEW-18: seed-progress query response is a closed discriminated union
(next index | typed complete variant); normative query/originate loop
— stop on complete, re-query on canonical refusal, continue only on a
strictly-later result, surface a fault on an unchanged index. New
witnesses: same-designation race (with unchanged-index fault variant)
and completed-world stop run of the actual fresh client; cross-surface
refusal-shape control added to the two-world query witness.
- NEW-19: RBAC §1 expressly named among amended surfaces — narrow
ratified exception making the designation a fourth authority source
inside the mechanical origination scope only (§1.2, §4.3, §7 item
12). New active-window boundary witness: canonical tuple succeeds
while non-canonical and non-seed-workspace commands refuse in the
SAME incomplete state; predecessor- and successor-created content
reads refused post-origination.
- NEW-20: state-derived disclosure split from mandatory envelope
metadata everywhere — origination and query responses remain ordinary
contract 5 §4 result DTOs carrying the correlation envelope; contract
5 not amended. §6.1 closed-schema assertion covers both halves.
- NEW-21: result-disclosure paragraph restates the operative order —
fresh-mutation authorization first (owning family's refusal), then
seed-boundary gate before fence presence and canonical-reference
resolution, constant shape scoped to callers that reached the gate;
child-race control asserts the refusal class, pinning the order.
Addresses sol r12 verdict (NEW-18, NEW-19):
- NEW-18: new mapped, designation-only seed-progress query returning
exactly the next unrecorded canonical position index (or completion
marker); screening evaluated before any fence state, non-designated
submitters refused byte-shape-identically across recorded and
unrecorded worlds; closed read set (position-committed existence
flags + designation, §6.1); origin fresh-client resume and successor
completion both query first and originate from the returned index.
- NEW-19: designation-derived authority generalized to the
actor-authorization component of every canonical position's owning
family, each surface named expressly (contract 2 §4; RBAC §§2-3
workspace-content authorization; native-kanban SOT REQ-TEN-001 /
A1 §8.1.3) as coupled severable-together amendments under one
mechanically decidable scope, with a defined result-disclosure
boundary (canonical outcome fields only).
- §6.7: seed-progress two-world refusal, entitlement witness with the
actual fresh client run against both worlds, content-position
completion in both recovery variants, non-canonical content
refusal, result-disclosure witness.
- §7 item 12 now three coupled amendments; §1.1/§1.2/§5.3-5.4/§6.1
disclosures updated; preamble Revision 13 paragraph.
Answers sol re-review 10 (NEW-12/NEW-13/NEW-14 residuals, NEW-16, NEW-17):
- Canonical seed tuples fully epoch-derived and account-free: no
generated id or account identifier in any canonical payload or
scope; child positions reference parents by epoch-scoped canonical
seed role, resolved server-side at execution (canonical-reference
resolution); position 1 carries no initial-owner field — the
contract 2 §4.3 default binds owner to the acting designation as a
recorded outcome. Byte-stability absolute; post-succession replay
compares equal by construction (NEW-13).
- Succession reduced to a pure designation transfer: condition (a) =
identity §7.1 unavailability alone (unable disjunct removed), no
grant conferred, reads identity/platform/epoch state only, closed
write set = designation update + one audit event. World-independent
unconditionally, self-revocation pair included (NEW-12); post-
completion succession confers nothing (NEW-16).
- Designation-derived origination authority: scoped contract 2 §4
amendment (§7 item 12) — the current designation satisfies the
hierarchy-authority component for fresh origination of unoriginated
canonical positions only; no read/replay/standing authority.
- §6.1 succession-write inventory closed in both directions; no-seed-
input static assertion (NEW-17).
- Revision-10 preamble vocabulary corrected to the banned state
identity defines (NEW-14).
- §6.7 reworked: strengthened two-world control (event content, grant-
table delta, full-command timing), new self-revocation two-world
refusal, designation-derived completion, post-completion
harmlessness, post-succession replay digest-equality, empty-prefix
digest-equality witnesses; out-of-order origination witness.
- docs/PRD.md: Part I product north star authored from ratified decisions
D1-D14; Part II preserves all active workstream contracts verbatim
(KBN-101, FCM #758, FCOM #766, TESS, #756, MOS-PORT, #1150, #1174, #1194,
RI #1275, M1). Referenced anchors unchanged.
- docs/archive/PRD-v0.1.md: v0.1.0 beta PRD body archived verbatim with
supersession header.
- docs/ROADMAP.md: all phases P0-P5 present from day one per D11
(P2-P5 as explicit placeholders).
- docs/requirements/native-kanban-sot.md: Amendment A1 (D13) - hierarchy
parentage + RBAC chain above workspaces; sections 1-7 untouched.
Pipeline 2534 (018d96a), two test-step failures plus the format failure
root-caused by rev-code-01 (id 202):
1. pipefail-early-exit.test.mjs: main's window wrote the test but never
wired scripts/*.test.mjs into its own CI, so its tools/install.sh pipes
were never executed against it; next's test wiring runs them and flags
two load-bearing pipes. Both rewritten pipefail-safe via process
substitution (newest_matching_file ls|head, check_fleet_transport
sed|head|tr|awk). Test now 7/7 locally.
2. verify-release.test.mjs: merge kept main's 9-command ci.yml sanitization
but next's 4-command canonical stage. Canonical updated to mirror ci.yml
exactly (9=9, order verified). upgrade-guard checked equal (4=4).
3. format: docs/reports/quality/1099-pipefail-sweep.md (from main f158be8)
prettier-formatted under pinned 3.8.1.
Enumeration guard re-verified: population 60, enumerated 45, excluded 16.
Squash-merged by topher (jarvis principal) via break-glass: pr-merge.sh hard-codes main-only merge targets and cannot express this repo's next trunk. Gates: CI 2475 green at head 758659dd, review 176 APPROVED (fred) at pinned head.
First-pass structural reference for the Vite SPA migration (apps/web): dual-app
tree during migration, shared lib/ networking layer, origin-relative/same-origin
serving model, build scripts, the P1-P6 increment map, and the #1145 P5 blocker.
Living doc — details to be fleshed out by follow-up.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01ESFAnh2t9HmLwng8oW95St
Docs-only plan PR. FRED_APPROVED_REF=0629361ca39a4dd7fb3e575d11c64bea9e545dae (review 147). Merged by fred (orchestrator) via API: pr-merge.sh policy predates the next lane (main-only hardcode) — wrapper fix tracked separately.
Co-authored-by: Velma <[email protected]>
fred
veronicaandfred
ops-01
fargo
jarvisandfargo
velmaandmos-dt-0