governance: GATE-A owner-window CLOSED-CLEAR attestation — no owner objection through scheduled closure 20:00:25Z (verified vs durable Discord #mos record); disclosed rev-2 scope stands. Probe-3 still gated on FIRE GO.

Authority binding: owner class-auth (Jason 'amend the charter'/option B, #mos 2026-07-18 17:28Z, pre-SHA) + independent-adjudicator byte-verify (Mos, web1:mos-claude, author != verifier). Published by the adjudicator per homelab durable-Gate0 independence requirement. Probe-3 remains HELD pending homelab verification + owner window.

docs/compaction-refresh/governance/GATE0-PROBE3-EXEC-AMENDMENT.md

@@ -0,0 +1,109 @@
+# Gate0 Charter Amendment — Probe-3 (D4) Evidence-Class EXECUTION Authorization
+
+**Status:** DRAFT (revision 2) — supersedes prior candidate pin `8fca5b7a`; pending Mos re-scope-verify BEFORE
+re-pin is ratified. Revised per Mos adjudication directive (2026-07-18): §3 = D4-focused Option A; §1 = explicit binding model.
+**Amendment type:** Additive durable-authority amendment (does NOT mutate any ratified pinned doc in place).
+**Milestone:** 188 — Compaction-Refresh Mechanism · **Issue:** Gitea #827 (WI-0 Gate0) · gates WI-3 #830 merge.
+
+---
+
+## 1. Authorized source (why this amendment is valid)
+
+Per the Mosaic governance principle (OpenBrain `f0cb61b6`, permanent; fail-closed / DO-178C): a durable
+Gate0 execution-hold clears ONLY by **(i) explicit user (owner) authorization** OR **(ii) a durable-authority
+amendment from an authorized source**. A runtime coordinator's verbal GO does NOT qualify.
+
+- **Owner authorization (i):** Jason (owner / north-star) directed in `#mos` **2026-07-18 17:28Z** — *"amend the
+  charter"* (option **B** from the WI-3 escalation), quoting the escalation back. This is the direct-user
+  authorization artifact that homelab's durable-Gate0 objection (2026-07-18 06:34:56Z) explicitly named as a
+  valid resolution condition (*"user artifact OR auth amendment"*). Relayed + authenticity-adjudicated by Mos
+  (`web1:mos-claude`). Owner outranks any peer-lane durable authority.
+- **Amendment (ii):** this document, authorized BY that owner directive.
+
+Both qualifying conditions are therefore satisfied. Homelab's stated condition is met by the owner artifact;
+homelab is NOTIFIED as a transparency step (it holds durable-Gate0 standing and raised the original catch),
+but its co-sign is not a gate (owner > peer).
+
+**Binding model (explicit — how this SHA is authorized).** The authority binding for this amendment's pinned
+bytes is the composition of two distinct acts:
+1. **Owner class-authorization (PRE-SHA):** Jason (owner) authorized the *class of action* — "amend the
+   charter" (option B), `#mos` 2026-07-18 17:28Z. This occurred **before** these amendment bytes (and hence
+   this SHA256) existed; the owner authorized the amendment, not a specific hash.
+2. **Independent-adjudicator byte-verification:** Mos (`web1:mos-claude`), acting as the independent
+   adjudicator (author ≠ verifier — MS-LEAD authored, Mos verifies), scope-verifies the **exact bytes** of
+   this document and confirms they express only the owner-authorized narrow scope.
+
+There is therefore **NO single "Jason-signs-the-SHA" artifact, and none is required** under this binding
+model: owner-authorized-class + independent-adjudicator-byte-verify **is** the binding. This is the durable,
+inspectable chain of custody for the pin.
+
+## 2. Charter provisions amended (sha-pinned, unmutated)
+
+This amendment attaches to — and does NOT rewrite — the ratified Gate0 charter provisions:
+
+- `compaction-refresh-BUILD-BRIEF.md` §5 / R4 "Gate0 = BUILD-ADMISSION GATE", specifically the item:
+  *"Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4)."*
+  sha256 `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b` (intact/unchanged).
+- `compaction-refresh-SPEC-RATIFICATION.md` R4.
+  sha256 `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` (intact/unchanged).
+
+The two pinned docs remain byte-identical; this amendment is the delta of record.
+
+## 3. What is authorized (NARROW — D4-focused harness ONLY)
+
+Adjudicator ruling (Mos, `web1:mos-claude`): "D4-only" against the existing runner is non-executable — the
+only runner (`pi_gate0_run.py`) drives P2+P5+P6+D4 in one flow, and D4 intrinsically requires a
+promoted-to-VERIFIED baseline (spec L219: "P3 immediately follows the valid P2 promotion so reload must
+revoke a genuinely VERIFIED prior gen") to revoke a genuine prior generation. Therefore authorize EXACTLY the
+minimal executable form (Option A) required as WI-3 (#830) merge-gate (2):
+
+- **D4-focused harness:** spawns **ONLY** `p3_generation_broker.py` (not the full `pi_gate0_run.py` runner).
+- **Minimal promotion-to-VERIFIED, as a FIXTURE PRECONDITION ONLY:** established solely so the D4 revoke has a
+  genuine `VERIFIED` target. This is **NOT** authorization to bank P2 as an independent evidence class.
+- **D4 same-PID `runtime_generation`-bump revoke observation:** new generation → `MUTATOR_UNVERIFIED`;
+  prior (superseded) generation → `STALE_GENERATION`.
+- **Explicitly EXCLUDED:** P5 (missing / oversize / hash-invalidation) and P6 (atomic-observation) — not
+  needed for the WI-3 D4 gate and **not authorized** by this amendment.
+- **Isolation / integrity (per §4/§5):** 3× repeated, isolated runs; hardened deterministic harness;
+  non-destructive; launches broker/socket/state artifacts in an isolated fixture ONLY; **does NOT touch
+  production**, mutates no live lease/broker/deployment, creates no durable side effect outside the fixture;
+  a **FAIL** returns to planner — no retry-launder.
+
+**Intrinsic-precondition boundary (verbatim):** the promotion step is a D4 test fixture, not a P2
+evidence-gathering authorization; P5/P6 remain unauthorized.
+
+## 4. What is NOT authorized (all other holds remain in force)
+
+- This is **NOT** a blanket Gate0-execution release. Every other Gate0 execution item and every standing
+  execution hold remains exactly as-is.
+- No live mutation, migration, canary, deployment, systemd, tmux-fleet, or connector/socket/Hermes action is
+  authorized by this amendment.
+- Authorizes producing THIS evidence class once (3× isolation is the evidence-integrity requirement, not a
+  license to re-run on failure): a **FAIL** returns to planner — **no retry-launder**, no severity-laundering.
+
+## 5. Preserved fail-closed / DO-178C invariants (verbatim, unchanged)
+
+- Producing probe evidence **EXECUTES** the Gate0 mechanism (launches processes, creates socket/state
+  artifacts, exercises revocation transitions); "isolated + non-destructive" does **not** make it
+  non-execution. This amendment authorizes that execution for the narrow class in §3 — it does not redefine
+  execution as non-execution.
+- A sha-pinned DURABLE authority OUTRANKS a runtime coordinator's verbal GO; when they conflict the durable
+  artifact wins. This amendment derives its authority from the OWNER, not from a coordinator.
+- Card-advancement gates and execution-holds are distinct; this amendment lifts ONLY the §3 execution-hold,
+  not any advancement/review/SECREV gate. WI-3's independent-review + Opus-SECREV + green-suite gates stand.
+
+## 6. Effect on WI-3 (#830) merge chain
+
+On this amendment being pinned (Mos-verified + Jason-shown): a fresh lane (ms-rev-826) executes the §3
+probe-3 evidence class (3× isolation) → PASS/FAIL reported to Mos. **On PASS**, and only after re-confirming
+WI-3 head `f4008307` UNMOVED + FIRE-PRECONDITION-0 (fresh `mosaic-context-refresh` attestation for
+mosaic-100 + planner-opus), the existing chain runs: CI queue-guard → push → PR → mirror RoR → relay full-40
+head + pr/ci# → Mos independent 6-check → squash `closes #830` → chain WI-4→7. **On FAIL**: planner-return.
+
+---
+
+**Amendment author:** MS-LEAD (`web1:mosaic-100`), Gate0 governance interface / charter custodian.
+**Pin protocol:** this file's sha256 becomes the amendment pin ONLY after Mos re-scope-verify. Reported to Mos
+before any ratification/publication, per the transparency checkpoint on a durable-authority change. Ratification
+and durable publication (to a homelab-inspectable provider ref) are the adjudicator's (Mos), NOT the author's
+(MS-LEAD) — the author does not self-ratify and does not publish.

docs/compaction-refresh/governance/OWNER-WINDOW.md

@@ -0,0 +1,49 @@
+# Gate0 Probe-3 Amendment — Owner Transparency Window (durable record)
+
+**Purpose.** Durable evidence (defined duration + closure) that the owner-transparency window on the
+probe-3 amendment **scope-correction** has a bounded, inspectable lifecycle — per homelab's GATE-A
+requirement (2026-07-18 18:13:14Z). This is NOT the owner's core authorization (that is durable in the
+amendment §1); it is the objection-window on the narrowing disclosed afterward.
+
+## What was disclosed
+The owner (Jason) explicitly authorized the amendment **class** — "amend the charter" (option B),
+`#mos` 2026-07-18 17:28Z (amendment §1). My initial narrowing was "D4-only"; on adjudication that proved
+non-executable (D4 intrinsically needs a promoted-to-VERIFIED baseline). The **corrected** scope
+(rev 2, pin `9ac9ff87`, §3) adds a *minimal promotion-to-VERIFIED as a test fixture only* (P5/P6 still
+excluded, P2 not banked as evidence). Because this adds a fixture step beyond the "D4-only" I first told
+the owner, I disclosed the correction to him for transparency.
+
+## Window (bounded, durable)
+- **Opened:** 2026-07-18T18:00:25Z  — anchored to the adjudicator's Discord scope-correction disclosure to the
+  owner (message id `1528099140100296736`, snowflake-decoded; not an informal estimate).
+- **Duration:** 2 hours (defined).
+- **Scheduled closure:** 2026-07-18T20:00:25Z.
+- **Closure condition (fail-closed):**
+  - No owner objection received by scheduled closure → window **CLOSED-CLEAR** (the disclosed correction
+    stands; it is within the already-granted class authorization).
+  - Any owner objection before closure → window does **NOT** clear → re-adjudicate the corrected scope.
+  - An affirmative owner "proceed" before closure → **early CLOSED-CLEAR** (recorded here).
+
+## Closure attestation
+Closure will be confirmed by a dated adjudicator tick appended below (and to the orchestration ledger)
+at/after 2026-07-18T20:00:25Z. Until that attestation exists, GATE A is OPEN and probe-3 execution stays HELD.
+
+- [x] **CLOSED-CLEAR attestation — recorded 2026-07-18T20:08Z by adjudicator Mos (`web1:mos-claude`).**
+
+### CLOSED-CLEAR attestation (2026-07-18T20:08Z)
+
+The owner-transparency window on the probe-3 amendment scope-correction is **CLOSED-CLEAR**.
+
+- **Scheduled closure:** 2026-07-18T20:00:25Z — reached (authoritative UTC at attestation: 2026-07-18T20:07Z, past closure).
+- **Closure condition met:** *No owner objection received by scheduled closure.* Verified fail-closed against the
+  **durable Discord #mos record** (not memory): the channel's last message is the scope-correction disclosure itself
+  (`id 1528099140100296736`, 2026-07-18T18:00:25.709Z). From window-open (18:00:25Z) through closure (20:00:25Z) and
+  to this attestation, there are **zero owner (jetrich) messages** — no objection, no affirmative early-GO. The last
+  owner message preceding the window was the class authorization *"Amend the charter"* (17:28Z, amendment §1).
+- **Effect:** the disclosed corrected scope (rev 2, pin `9ac9ff87`, §3 — minimal promotion-to-VERIFIED as a D4 test
+  fixture only; P5/P6 excluded; P2 not banked as evidence) **stands**, within the already-granted class authorization.
+- **GATE A is now CLOSED.** Probe-3 execution proceeds ONLY under the full remaining chain: GATE-B fresh §3-review PASS
+  (concurred @839d156f, author≠reviewer) + adjudicator explicit FIRE GO. No other Gate0 hold is lifted by this tick.
+
+*Adjudicator: Mos (`web1:mos-claude`). This record is durable and provider-inspectable alongside the
+amendment (`9ac9ff87`) and its RATIFICATION.md.*

docs/compaction-refresh/governance/RATIFICATION.md

@@ -0,0 +1,37 @@
+# Gate0 Probe-3 (D4) Amendment — Adjudicator Ratification Record
+
+**Ratifies pin:** `9ac9ff873fad41a6e15763cc89cb94d0bc4a6b0cf9b6770561d1781b03f63276`
+(`GATE0-PROBE3-EXEC-AMENDMENT.md`, 7699 bytes, this branch).
+**Supersedes:** prior candidate pin `8fca5b7a` (never executed against; withdrawn on scope + durability grounds).
+
+## Re-scope-verify — PASSED
+Verified by **Mos (`web1:mos-claude`)**, acting as independent adjudicator (author ≠ verifier: MS-LEAD
+authored, Mos verified), 2026-07-18. SHA256 recomputed = pin (exact). Scope checks, all PASS:
+- §3 = Option A, D4-focused: harness spawns ONLY `p3_generation_broker.py`; minimal promotion-to-VERIFIED
+  is a FIXTURE PRECONDITION only (not P2 evidence-banking); D4 gen-bump revoke observation
+  (new→`MUTATOR_UNVERIFIED`, prior→`STALE_GENERATION`); **P5/P6 explicitly excluded + unauthorized**;
+  verbatim intrinsic-precondition boundary line present.
+- §1 binding model explicit; §2 charter provisions pinned unmutated; §4/§5 invariants intact.
+- No scope creep beyond the owner-authorized narrow class.
+
+## Authority binding
+- **Owner class-authorization (PRE-SHA):** Jason (owner) — "amend the charter" (option B), `#mos`
+  2026-07-18 17:28Z. Authorized the amendment class before these bytes existed.
+- **Independent-adjudicator byte-verification:** Mos scope-verified the exact bytes.
+- No single "Jason-signs-the-SHA" artifact exists or is required under this binding model.
+
+## Round-trip integrity (this branch/commit)
+All three files fetched back via the Gitea raw API and SHA-matched (each > 200B, no not-found sentinel):
+- `GATE0-PROBE3-EXEC-AMENDMENT.md` → `9ac9ff87…f63276` ✓
+- `charter-BUILD-BRIEF.md`         → `89fdbc27…71b` ✓
+- `charter-SPEC-RATIFICATION.md`   → `bac58319…67` ✓
+
+## Status: RATIFIED — probe-3 execution remains HELD
+Publication here closes the governance-infra gap (the charter provisions were previously local-only,
+not inspectable). Probe-3 execution stays HELD pending both: (1) homelab independent verification of
+these published bytes; (2) owner transparency window. On both clearing → ms-rev-826 builds + runs the
+§3 D4-focused harness (3× isolation, non-destructive) → PASS/FAIL to Mos → WI-3 (#830) chain per §6.
+
+*Note: the amendment file's own status line reads "DRAFT (revision 2)"; that internal text is
+superseded by THIS external ratification record (the pinned bytes are deliberately not edited, so the
+SHA stays stable). Ratification status lives here, not in the pinned artifact.*

docs/compaction-refresh/governance/charter-BUILD-BRIEF.md

@@ -0,0 +1,106 @@
+# Compaction-Refresh Mechanism — BUILD BRIEF (Mos → MS-LEAD)
+
+**Status:** STAGED — do NOT dispatch until PR #826 (#824 skill-CLI bridge) MERGES. Mos routes this to
+MS-LEAD at #824 land. PLAN phase COMPLETE + RATIFIED; this is the BUILD-execution brief.
+**Routed by:** Mos (main orchestrator). **Owner:** MS-LEAD (mosaic-100). **Runtime scope M1:** Claude + Pi.
+
+## 1. AUTHORITY (sha256-pinned — build AGAINST these, do not re-derive)
+| Artifact | Path | SHA-256 |
+|---|---|---|
+| **Ratification record (SSOT)** | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md` | `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67` |
+| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
+| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
+
+The coder MUST verify these hashes before building. The in-context working spec is DERIVED and
+compaction-fragile — the sha256'd records above are the recovery SSOT (durable-authority discipline).
+
+## 2. TARGET & SCOPE
+- **Framework-native `packages/mosaic/…`** in `mosaicstack/stack`. NOT jarvis-brain. NOT
+  `~/.config/mosaic/` directly (that tree is WIPED on framework upgrade — durable home is SOURCE).
+- **M1 = Claude + Pi orchestrators only.** Codex/other runtimes = scope-note only.
+- **Hard dependency (now satisfied at dispatch):** the `mosaic skill` register/list + install/upgrade
+  symlink auto-sync (#824 / PR #826) — so the durable `mosaic-context-refresh` skill ships REACHABLE
+  (auto-symlinked into `~/.claude/skills/`). Do not dispatch before #826 merges.
+
+## 3. DELIVERABLES (locked architecture — from the ratification record; do NOT redesign)
+1. **Authenticated external lease broker** bound to kernel `SO_PEERCRED` `(pid, starttime,
+   runtime_generation)` — the only unforgeable identity on a same-uid tmux fleet. Broker **MINTS** the
+   logical `session_id` at first peercred contact (NEVER caller-asserted). Distinct-principal /
+   protected socket.
+2. **Whole mutator-class gate** (not per-wrapper): no consequential mutator succeeds without a valid
+   VERIFIED lease. **Revoke-first / promote-last.**
+3. **Compaction observers → revoke:** Claude `PreCompact` + `SessionStart(matcher=compact)`; Pi
+   `session_before_compact`/`context` equivalents. Any `runtime_generation` bump (reload/resume/fork,
+   same PID included) auto-revokes the prior incarnation.
+4. **Verbatim-hashed normative fragments:** `B_payload` (exact fragments + deterministic metadata) and
+   `H_payload = SHA256(domain_sep ‖ length_framed(B_payload))` — NO self-reference (byte-identical
+   across the Claude and Pi builders).
+5. **Receipt-challenge protocol (promotion prerequisite, NOT the safety mechanism):** broker mints a
+   single-use `receipt_challenge` per cycle bound to `(session_id, runtime_generation,
+   compaction_epoch, request_epoch, H_source, H_payload, schema_version)`. **COMPUTE = broker**
+   (observes latest-assistant message, computes the binding incl `H(latest-assistant-message)`);
+   **COPY = model** (verbatim copy of challenge + `H_payload` — an LLM cannot hash its own output;
+   T29). Observed in the EXACT latest assistant message (Claude: latest assistant entry + pending
+   challenge, NO transcript grep; Pi: `message_end`, NOT `after_provider_response`). Single-use,
+   consumed before the tool batch. Broker transition order (mandatory): `revoke → build
+   B_payload/H_payload → PENDING_DELIVERY(mint unique challenge) → deliver → observe exact receipt →
+   evidence commit → consume challenge → promote VERIFIED (last)`.
+6. **Constrained recovery command** = the single ungated mutator; the `mosaic-context-refresh` skill
+   is its wrapper (uses a newly-minted challenge + identical protocol; cannot replay normal-path
+   receipt). Durable skill lands here, symlink-reachable via #824.
+7. **T-C server-side line = branch protection** (the irreducible guarantee; client gate is
+   window-narrowing only). If ops-config rather than code, DOCUMENT the required posture explicitly.
+
+## 4. BINDING BUILD CONDITIONS R1–R6 (MANDATORY — verbatim from ratification record)
+- **R1 (honesty):** state that the receipt detects ABSENT or PREFIX-TRUNCATED terminal token, but a
+  MIDDLE-DROP preserving the tail is a **T-C contract violation, NOT receipt-detectable** (covered by
+  server-side). No over-claim.
+- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
+  transaction; a crash leaves neither VERIFIED-with-live-challenge nor consumed-with-ambiguous-promote;
+  recovery mints a NEW challenge, never reuses.
+- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
+  quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, multiple receipts.
+- **R4 (Gate0 = BUILD-ADMISSION GATE):** see §5 — runtime evidence BEFORE build admission; a failed
+  Gate0 item RETURNS the design to planner review, it is NOT waived by the GO.
+- **R5 (TTL):** 300 s MAX lease TTL + soak-tighten; soak may only SHORTEN, never lengthen. Mos-accepted.
+- **R6 (receipt semantics):** receipt = T-A delivery/liveness ONLY, never obedience/safety/residency.
+  Permanent invariant.
+
+## 5. R4 GATE0 — RUNTIME EVIDENCE BEFORE BUILD ADMISSION (WI-0, do this FIRST)
+Structure the build like gitwatch: **WI-0 is a Gate0 runtime-evidence probe; no feature build admitted
+until every item produces POSITIVE runtime evidence** (not a design assertion). A failed item RETURNS
+to planner — do not paper over:
+- Launcher `exec`/parent topology + supported-hook ancestry (D1); broker authenticates the launcher
+  chain, rejects sibling-substitution.
+- Pi lifecycle: last-position invariant (last-or-closed), per-tool nonce → tool-call-id map (D5).
+- Same-PID `runtime_generation` bump on reload/resume/fork revokes prior lease (D4).
+- Broker socket authenticity posture (protected / distinct-principal); `SO_PEERCRED` returns the true
+  `(pid, starttime)`.
+- Source-invalidation fail-closed (missing/oversize/hash-mismatch fragment → no promotion).
+- Claude `additionalContext` + Pi `context` inject atomically (A-v5-1) — the transport assumption
+  T27 rests on; verify or class the gap T-C.
+
+## 6. ACCEPTANCE TESTS (red-first TDD)
+Carry all v4 ACs + T12b; add **T24–T30**: T24 hash-construction no-self-reference byte-identical across
+builders · T25 replay rejected · T26 transcript-stale-match cannot promote · T27 partial-delivery
+(prefix-trunc/tail-only/middle-drop/malformed) none promote · T28 single-use (no renew/reopen) · T29
+model copies not computes · T30 dual-hook-miss matches AMENDED threat table within+after TTL.
+Acceptance = full green suite + Gate0 evidence pack.
+
+## 7. REVIEW & MERGE DISCIPLINE
+- **This IS an Opus-SECREV-mandatory surface** — UNLIKE #824 (local same-uid FS). The broker is an
+  authentication/identity/authorization mechanism (peercred binding, session_id minting, mutator-class
+  gating, receipt protocol). Security review = **Opus-SECREV, no GPT/terra substitute** on the
+  broker/gate/receipt/socket surfaces. Functional/non-security parts may take GPT review.
+- **Author ≠ reviewer**, independent review, no self-merge, exact-head RoR (reviewed-SHA=merged-SHA),
+  `closes #<issue>` close-keyword, full 40-char head. Never edit tests to pass / never force-merge red
+  / never `--no-verify`.
+- **Mos merges** (per ratification record) after Opus-SECREV + independent review pass + green suite +
+  Gate0 pack. Decompose into work-items (WI-0 Gate0 first); likely a milestone, not one monolithic PR.
+
+## 8. SEQUENCING
+#826 (#824 bridge) MERGES → Mos routes this brief → MS-LEAD decomposes (WI-0 Gate0 first) → build M1
+(Claude+Pi) → Gate0 evidence pack (failed item → planner) → Opus-SECREV + independent review → Mos
+merges → durable `mosaic-context-refresh` skill lands symlink-reachable → jarvis-brain `CLAUDE.md`
+mandate PR aligns to the shipped receipt/hash contract. Interim skill + CLAUDE.md mandate stay LIVE
+until the mechanism ships.

docs/compaction-refresh/governance/charter-SPEC-RATIFICATION.md

@@ -0,0 +1,75 @@
+# Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD
+
+**Ratifier:** Mos (main fleet orchestrator, `mos-claude`)
+**Date:** 2026-07-17 ~22:2xZ
+**Decision:** ✅ **RATIFIED — GO WITH BINDING CONDITIONS R1–R6.** Architecture converged v1→v5 via
+oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required.
+
+## Authenticated authority artifacts (sha256-pinned)
+
+| Artifact | Path | SHA-256 |
+|---|---|---|
+| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
+| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
+| (base) SPEC v4 | `~/agent-work/reviews/compaction-refresh-SPEC-v4.md` | `a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80` |
+| (base) sol v4 red-team | `~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md` | `1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f` |
+| Ratification-Input (R1-R6 + rulings, provenance-clean) | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md` | `d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266` |
+
+## Convergence trail
+v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch
+locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → **v5 GO-with-conditions**.
+
+## Locked architecture (do not redesign)
+Authenticated external **lease broker** bound to kernel `SO_PEERCRED` (pid, starttime,
+runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the
+logical session_id at first peercred contact (never caller-asserted). **Revoke-first / promote-last.**
+Whole **mutator-class gate** (not per-wrapper). Verbatim-hashed normative fragments. Single
+**constrained recovery command** = the only ungated mutator; the `mosaic-context-refresh` skill is its
+wrapper. **Threat tiers:** T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C
+fully-rotted → **server-side branch-protection = the irreducible line** (client gate is
+window-narrowing, NOT a complete guarantee).
+
+**Delivery-receipt (echo-lock, sol §8-final):** broker mints a single-use `receipt_challenge` per
+cycle bound to (session, runtime_generation, epochs, H_source, H_payload); **COMPUTE = broker**
+(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact),
+**COPY = model** (copies challenge + H_payload verbatim — model never computes a hash; sol T29
+copy-not-compute preserved). Receipt is a **one-cycle T-A delivery/liveness proof ONLY — never an
+obedience, residency, or safety proof.** The mechanical mutator-class gate remains THE safety
+mechanism; §8 intact for T-B/T-C.
+
+## Binding ratification conditions (R1–R6) — MANDATORY for build acceptance
+- **R1 (honesty / T27 amendment):** state honestly that the receipt detects an ABSENT or
+  PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a **T-C
+  contract violation, NOT receipt-detectable** (covered by server-side, not the receipt). No
+  over-claim. Fold as a doc amendment — no v6.
+- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
+  transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a
+  consumed-with-ambiguous-promotion state; recovery mints a **NEW** challenge, never reuses one.
+- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
+  quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts.
+- **R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE):** launcher-ancestry/D1,
+  sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump,
+  nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require
+  **runtime Gate0 evidence BEFORE build admission**, not design assertion. **A failed Gate0 item
+  RETURNS the design to planner review — it is NOT waived by this GO.**
+- **R5 (TTL — RATIFIER ACCEPTED):** proposed **300s MAX lease TTL + soak-tighten** is **ACCEPTED by
+  Mos (ratifier)**. Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator
+  (Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation
+  trigger — a proposed max that only tightens).
+- **R6 (receipt semantics — REAFFIRMED):** receipt remains T-A delivery/liveness ONLY, never
+  obedience/safety proof. Reaffirmed as a permanent invariant of the design.
+
+## Build sequencing (PLAN-ONLY until these clear)
+1. **HARD DEP:** `mosaic skill` register/unregister/list + generic install/upgrade symlink auto-sync
+   (mosaicstack/stack **#824**, in flight on ms-824) MUST land first — else the durable
+   `mosaic-context-refresh` skill ships unreachable (no `~/.claude/skills/` bridge symlink).
+2. Then MS-LEAD builds the mechanism in **packages/mosaic** (M1 = Claude + Pi orchestrators) against
+   THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no
+   self-merge; Mos merges.
+3. The durable `mosaic-context-refresh` skill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to
+   the ratified receipt/hash contract, AFTER the #824 bridge exists.
+
+**Interim protection (live now, until the mechanism ships):** `mosaic-context-refresh` skill
+(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After
+Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads
+and attests 7/7.