- Dressed quoted computed keys (as/satisfies/!) fail closed anywhere: the
static key survives the dressing but breaks every ['name'] matcher, and
matcher tolerance cannot span types containing ']' (as Foo['x']), so the
shape itself is the trigger (with an !(?!=) guard for ordinary
comparisons).
- Escape-built quoted keys (\u/\x/octal) fail closed: statically
resolvable, so outside the non-literal computed-member residual.
- Reflect verb indirection fails closed: any Reflect.* call naming a
write/exec verb in its argument text (Reflect.apply(db.insert, ...),
Reflect.get(db, 'insert')).
- CODE_SHAPE_REGISTER: enumerated disposition path for the fail-closed
code-shape rules (template key, dressed/escaped key, apply/call/bind,
Reflect) — a reviewed legitimate hit is registered, never resolved by
weakening the shape. Empty today; eval/new Function stays unconditional.
- KNOWN RESIDUALS: test-file/out-of-src modules named as import-graph
conduit blind spots; TYPE_ANN/DECL_LIST single-line limit documented.
- Controls E93-E102 (dressed/escaped keys at write target, conduit export,
default export, single-file factory extraction; Reflect.apply/get) plus a
clean control pinning the !== guard.
The text-only template-key rule fires on any computed member — access or
call — not only the call form, so template-keyed write targets, export
expressions, and receivers fail closed at their origin. Declaration
exports and derivations tolerate a type annotation and prior declarators
via shared TYPE_ANN/DECL_LIST shapes at all five declarator sites.
Invoking a write/exec verb through .apply/.call/.bind fails closed
anywhere (both member names statically visible, unlike the
method-extraction residual). The evasion test counts violations across
the whole synthetic chain, since some routes fail closed at the helper.
Controls E82-E92; clean control pinning the interpolated-key
discriminator.
stripExprDressing also strips trailing non-null assertions and satisfies
clauses, so export-default dressing (companies!, createDb satisfies T,
(x as unknown)!) resolves at both ends. The three ns-member right-hand
sides tolerate parenthesization. Every verb matcher admits the optional-
call form (?.() via a shared CALL_OPEN shape. A computed member call
whose key is a text-only template literal fails closed (its text never
reaches lexed code); interpolated keys stay under the non-literal
residual. Document the DB_FACTORY_IMPORTERS ns-destructure enumeration
blind spot as a residual. Controls E69-E81.
Unify member-access matching on shared DOT/BRACKET_OPEN/MEMBER_SEG shapes
(dot, bracket, ?. and ! forms) across both conduit computations, the write
targets, the factory-import clause, and the DI backstop. Treat export-default
as an expression at both ends: strip parens/assertions, classify bare-word vs
namespace-member chain, on the schema AND capability sides. Add the
capability-side export-default ns-member pass (round-5 finding 2). Admit bare
SQL qualifier words (TABLE, ONLY, IF EXISTS) between keyword and table name in
prong (ii). Controls E54-E68.
Default-export slot treated as an export name at both ends (helper-side
export-default passes, consumer-side bare-default-import resolution);
namespace-member write targets match the source's exported names via a
per-file memberSyms union; factory conduits carry a name map computed to
a fixpoint so renames propagate hop by hop (export-from, export-of-local,
export default); tracked dynamic imports of capability conduits confer
capability; factory destructure-rename from a schema namespace; static
module-namespace createRequire destructure; spread-argument writes; DCL
keywords (GRANT/REVOKE ON, LOCK TABLE); bracketed conventional DI
receiver. Permanent controls E40-E53.
Per the second M4-1a detached review (REQUEST_CHANGES, R1-R8):
- R1: prong (i) now tracks namespace destructuring, nested namespace
re-exports (ns.schema.companies), and literal dynamic-import bindings
(destructured and namespace) per contract rev 9.
- R2: capability-conduit fixpoint (computeCapabilityConduits) closes
driver/factory laundering through export-from modules.
- R3: dynamic-import check is per call site with a full-literal tail
match, so concatenated specifiers no longer pass.
- R4: computed-member calls with literal verb names (obj['insert'],
obj['query']) and spaced member access are flagged.
- R5: prong (ii) adjacency tolerates schema qualification, interposed
block comments, COPY, and escaped quotes.
- R6/R8: header documents KNOWN RESIDUALS (DI receiver rename in
capability-free files, computed non-literal member access, scan
perimeter) with the measured counterfactuals.
- createRequire fails outside a 5-module measured register (R1 route).
- 15 new permanent evasion controls (E9-E23) with helper-file conduits
run through the production analyzer.
Calibration: tree-wide prong test green with zero new exclusions;
tsc, eslint, and the full package suite pass.
Review findings F1-F8 (REQUEST_CHANGES) addressed:
- F5: replace regex comment stripping with a string-aware lexer producing
comment-free code plus accurate string/template spans (handles nesting,
regex literals, escapes)
- F3: prong (i) now tracks namespace imports and re-export conduits via a
fixpoint over the scanned import graph
- F1/F2: tagged-template exemption dropped; backlog.ts joins the infra
register; capability-gated prong (iii) — driver import flags any-receiver
execute/query/unsafe, factory import flags any-receiver execute/unsafe,
db-shaped receiver backstop covers DI'd handles; sql.raw tracked through
aliases and namespaces
- F4: closed importer enumeration added for createDb/createPgliteDb;
composition property of remaining register modules documented
- F6: plugins/ added to scan roots
- F7: per-parent slug scoping witnessed at platform_projects and workspaces
- F8: dynamic-import disposition register added; stricter-than-contract
stances documented in the header
The review's 8 evasion samples are embedded as permanent controls run
through the production analyzer, plus clean controls guarding against
false positives.
Implements docs/requirements/hierarchy-schema.md sections 2-4 and the
schema-layer half of section 6:
- Five class tables (companies, estates, platform_projects, workspaces,
hierarchy_grants) with the section 2.7 exhaustive column sets: child
node tables carry no timestamps (renames are audited via events), no
owner_id anywhere (section 4.4 - ownership is computed from grants).
- Grant constraints per section 3: exactly-one-subject and
exactly-one-target num_nonnulls CHECKs, six-column UNIQUE NULLS NOT
DISTINCT, target FKs CASCADE / principal FKs RESTRICT, six btree
indexes.
- Migration 0018 generated by drizzle-kit; SQL verified against the
contract text and applied on PGlite.
- hierarchy-schema.witness.test.ts: dual-leg witness suite (PGlite
always; real PostgreSQL under DATABASE_URL, the section 6.8 binding
leg in CI). Covers parent-FK integrity + catalog assertion, slug
scoping, column allowlist (6.2), all six grant subject/target forms,
CHECK refusals, NULLS NOT DISTINCT duplicates, NOT NULL refusals, and
deletion semantics (6.6): fail-closed parent delete, leaf cascade of
exactly its grants, principal RESTRICT.
- hierarchy-writer-coverage.test.ts: section 6.3(b) three-prong static
assertion (alias-aware symbol writes, class-table names in SQL
literals, raw-execution primitives) with empty writer allowlist,
closed infrastructure register, and closed importer enumerations for
the migration runner and migrate-tier. All prongs proven able to fire
via a planted-violation control.
Command family, audit events, and route inventory land in M4-1b.
Per ops-ci-01's procedure (comments 23386/23394, brain D27): pipeline config
travels with the commit under test, so the controlled rerun requires the pinned
anchor in the PR head itself. This merge absorbs everything next took since the
original merge parent (1bdeed62): the ci-base pin (cb9a0d1, lock-9cb7ffcd8828),
the legacy-credential removal (#1325), and the ci-queue-wait statuses:null fix
(#1129 — the branch from the divergence analysis, now landed).
One conflict, same file as round 1: test:framework-shell union — our 54-entry
chain plus next's new test-ci-queue-wait-no-status.sh entry at its position
(55 entries, every target existence-verified). Enumeration guard green:
population 61, enumerated 46, excluded (signed) 16.
Review stack#1324 id 201 (rev-code-01): the union resolution chained main's #1073
fleet test while keeping next's signed exclusion of it (#1271 burn-down: the test
asserts missing-binary behavior but CI provides pi on PATH — fails by design).
check-test-enumeration CONTRADICTORY EXCLUSION, CI pipeline 2532 terminal failure.
Fix per verified review recommendation: remove the chain entry (55 -> 54 parts),
keeping next's exclusion and #1271 state. Guard now passes:
population 60, enumerated 45, excluded (signed) 16.
The repo format:check glob covers ts/js alongside md; four non-markdown
scripts inside the folded tree were flagged after the md pass. Same pinned
prettier 3.8.1, same markup-only class (verified: node --check still passes
on the js files).
Phase D3 of plan 2026-08-19 (decision S21): skills-local is the local test
bed; promote individually as each proves out. ms-unslop is the only one of
the seven local skills with working enforcement evidence — a checker
(tools/unslop-hook/unslop-check.js), a machine-source list (lists.json), a
19-test suite, a measured corpus, and a regression fixture.
The checker itself stays fleet-local for now (it binds to a specific
harness extension surface); this promotes the skill document only.
Gates verified on the moved file: sanitization denylist clean, prettier
3.8.1 clean (6730 chars was fred's measure at assignment; 7249 as shipped
today — both pass).
Phase D2 of plan 2026-08-19: single package, single install, single command.
The framework installer already treats skills/** as a shipped, manifest-owned
framework subtree, so the folded skills now install into
$MOSAIC_HOME/skills with the rest of the framework — no second repository,
no separate sync step:
- mosaic-sync-skills (bash + powershell): the fetch machinery is gone (clone,
pull, dirty-state migration, rsync from sources/agent-skills). The script
now only links installed skills into runtime homes. --link-only is a compat
no-op; --no-link exits having nothing to do.
- catalog.ts: the sources/agent-skills fallback is dead and removed.
- install.sh, launch.ts, defaults/README.md, README.md, skills/README.md:
references to the second repo rewritten to describe the shipped path.
Verified: clean install into a fresh MOSAIC_HOME produces 102 skills with no
sources/ directory; the linker then links the selected skills into the four
runtime homes with no git involvement.
fred
fred
ops-deploy-01
code-be-02andorch-01
veronicaandorch-01
code-infra-01andorch-01
code-be-01andorch-01
fargoandfred
ops-01
