Compare commits
10
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 mos-dt-0andClaude Opus 5
|
b705a4dae9 | ||
|
mos-dt-0andClaude Opus 5
|
27350d9f8d | ||
|
mos-dt-0andClaude Opus 5
|
f8b65463ab | ||
|
|
fb3221af27 | ||
|
|
910b6f4166 | ||
|
|
1324385bba | ||
|
|
d4f68040ab | ||
|
|
ba98f88891 | ||
|
|
4fcbf7c07e | ||
|
|
28f1e272fe |
@@ -1,58 +0,0 @@
|
|||||||
# RM-02 / PR #1030 — PRE-REGISTERED RE-REVIEW: the merge-base anchor round
|
|
||||||
|
|
||||||
**Subject head (exact):** `fbb61912981abb250d289ec7aafd4316db6fdb11`
|
|
||||||
**Supersedes:** the second NO-GO at `32b490a7` (D-45/D-46/D-47). That verdict is VOID.
|
|
||||||
**Registered by:** `mos-remediation` **before any reviewer read the diff.** **Reviewer:** `rev-974`.
|
|
||||||
|
|
||||||
## What the orchestrator already reproduced (do not re-spend the review here)
|
|
||||||
|
|
||||||
- Derived boundary `f4fd5967` **equals** an independently computed `git merge-base HEAD origin/main`.
|
|
||||||
- Emptying `criteria`/`gates`/`proseClaims`/`compatibilityScenarios` now fails with
|
|
||||||
_"population must be non-empty and anchored before evaluation"_.
|
|
||||||
- The both-directions bootstrap statement is present in `gate-history.mjs` with the Builds 1–2 residual.
|
|
||||||
|
|
||||||
## A — attack the ANCHOR (highest value)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **A1** | `targetRef` is the literal `refs/remotes/origin/main`. **Who controls that ref in the environment where the gate runs?** Can a PR author influence it — a `remote.origin.url` rewrite, a crafted `refs/remotes/origin/main` in their own clone, a push to a fork's `main`? If the gate trusts a locally-writable ref, the anchor moved from the manifest into git config. |
|
|
||||||
| **A2** | **Absent/stale target:** if `refs/remotes/origin/main` is missing, stale, or the fetch is shallow, does it fail CLOSED (line 57 suggests it does) or silently derive a narrower range? |
|
|
||||||
| **A3** | **Delayed introduction — the round-2 attack, re-run.** Commit a gate change BEFORE adding the manifest. Does it now stay in range and fail the own-tree read? |
|
|
||||||
| **A4** | **Branch from an old main:** branch from a point far behind `origin/main`, so merge-base is old. Does the range widen correctly (safe) or include unrelated main commits that cannot carry manifests (a new false-red)? Over-inclusion is the natural failure mode of this fix. |
|
|
||||||
| **A5** | Is the **bootstrap residual** recorded as a **tracked dependency on Builds 1–2**, not prose? (D-19's third mandatory move.) |
|
|
||||||
|
|
||||||
## P — the non-empty/anchored precondition
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **P1** | Does the precondition run **before** every quantified check, on **every** path — or only the ones the author enumerated? Find a quantified check that still runs before its precondition. |
|
|
||||||
| **P2** | **Seven required gate IDs anchored to canonical sources** — can that anchor list itself be emptied, shrunk, or pointed elsewhere? An anchor list the author edits is D-45 again, one level in. |
|
|
||||||
| **P3** | The author reports finding and REMOVING a **production CLI fixture-profile bypass** in their own pre-commit review. **Verify it is gone from the shipped CLI path**, that the remaining relaxation is test-support only and non-executable in production, and that the CLI rejection is tested. This was self-disclosed — confirm it independently. |
|
|
||||||
|
|
||||||
## Q — clauses quantified over the population (D-47)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **Q1** | `gateRefs` **exactly spans** every registered gate. Can a gate be added WITHOUT a corresponding ref — i.e. does adding a gate to the population escape the clause? |
|
|
||||||
| **Q2** | Deleting `gateRefs`, or shrinking gates and refs **together**, must fail. Shrink-together is the D-46 shape; verify it is a genuine control and not a regression guard mislabelled. |
|
|
||||||
| **Q3** | Do the population controls **iterate all seven gates** and mutate evidence-subject and comparison-type **per gate**, or only a representative one? |
|
|
||||||
| **Q4** | Honest labelling: author claims delayed-introduction, empty-populations, fixture-profile bypass and removable gateRefs as **genuine red-first**, and shrink-together/exact-span as **regression guards**. Verify each claim against pre-fix code (D-8). |
|
|
||||||
|
|
||||||
## C — head, CI, integrity
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **C1** | Head `fbb61912` on git and provider; `Closes #1029` present. |
|
|
||||||
| **C2** | Exact-head CI terminal-green, full `-f json`, counts stated incl. `clone`; machine-checked with `verify-terminal-green.py --expect-commit fbb61912981abb250d289ec7aafd4316db6fdb11`. |
|
|
||||||
| **C3** | Nothing weakened: `32b490a7` → `fbb61912` removes/relaxes no existing case, test, or assertion. |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to `fbb61912981abb250d289ec7aafd4316db6fdb11`, evidence enumerated, posted durably under
|
|
||||||
your own identity. If a check is unrunnable, **say so**.
|
|
||||||
|
|
||||||
**A1 and P2 are the ones I most want answered** — both ask whether the fix moved the author's control
|
|
||||||
point again rather than removing it, which is now the mission's named first-class principle and has
|
|
||||||
recurred three times. **Attack outside this set.**
|
|
||||||
|
|
||||||
**No one dispatching this review may state a conclusion on an open check (D-39).**
|
|
||||||
@@ -1,67 +0,0 @@
|
|||||||
# RM-02 / PR #1030 — PRE-REGISTERED RE-REVIEW: the four-blocker hardening pass
|
|
||||||
|
|
||||||
**Subject head (exact):** `32b490a712a5e8e77f13c40c60099b51feb38994`
|
|
||||||
**Supersedes:** the NO-GO at `83d2ecb2` (D-44, four silent-defeat paths). That verdict is VOID.
|
|
||||||
**Registered by:** `mos-remediation` **before any reviewer read the diff.** **Reviewer:** `rev-974`.
|
|
||||||
|
|
||||||
## Framing — attack the FIX, not the original bug
|
|
||||||
|
|
||||||
Every round on this mission, **the remediation introduced the next hole**: the commit-binding fix
|
|
||||||
shipped a type confusion; the type-strict fix was clean but the registry around it had four defeats.
|
|
||||||
So the highest-value checks here are **not** "was each blocker fixed" — the orchestrator already
|
|
||||||
reproduced three of the four attacks as dead — but **"is the NEW mechanism itself defeatable?"**
|
|
||||||
|
|
||||||
Blocker 1's fix replaced an author-settable field with a **derivation**. A derivation has inputs. **The
|
|
||||||
question is who controls them.**
|
|
||||||
|
|
||||||
## H — the new derivation (highest value)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **H1** | `deriveHistoryBoundary` = parent of the first first-parent commit introducing `gates/gates.manifest.json`. **Are its inputs author-controlled?** Can a PR author influence the derived value by adding, moving, renaming, deleting-and-recreating, or symlinking that path — or by adding a SECOND manifest earlier in history? If the derivation is gameable, blocker 1 is not fixed, only relocated. |
|
|
||||||
| **H2** | **First-parent traversal:** what happens on a merge commit, an octopus merge, a squash, a rebase that reorders, or a branch where the introducing commit is not on the first-parent chain? Does the boundary silently move, or fail closed? |
|
|
||||||
| **H3** | **Shallow/partial clone:** the branch previously needed an unshallow fix (`e8959975` "unshallow gate replay history"). If history is shallow, does the derivation fail CLOSED or silently derive a wrong/empty boundary? |
|
|
||||||
| **H4** | **Path deletion:** if `gates/gates.manifest.json` is absent at HEAD, or was deleted and re-added, what is derived? Fail closed, or a boundary that excludes the deletion window? |
|
|
||||||
| **H5** | Are the **three registered seam controls (HEAD, HEAD^, introduction) genuinely RED-FIRST** — do they fail against the PRE-fix code for their own stated reason? A control that was always green is a regression guard, not a must-fail control (D-8). |
|
|
||||||
|
|
||||||
## S — the recursive schema closure
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **S1** | **Is closure COMPLETE or enumerated?** The author lists the objects they closed. Find one they did **not** — any nested object anywhere in the manifest — and inject an unknown key there. If it is accepted, the fix covers instances, not the class. |
|
|
||||||
| **S2** | **Wrong-type, not just unknown-key:** `outputPattern` as a number/array/object/null rather than misspelled. Does the closed schema type-check values, or only key names? |
|
|
||||||
| **S3** | **Empty/degenerate values:** `outputPattern: ""` — does an empty regex match everything and silently neuter the assertion the same way a typo did? The author claims an empty-pattern control; verify it is bound. |
|
|
||||||
| **S4** | Confirm the registered typo/wrong-type/empty-pattern controls are **genuine red-first** against pre-fix code, and that anything labelled a regression guard is honestly labelled as one. |
|
|
||||||
|
|
||||||
## E — provider evidence (blocker 4)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **E1** | Global validation runs **before** per-commit filtering **on every path**, including the HEAD-only path the author calls out. Is there any code path that reaches per-commit assessment without it? |
|
|
||||||
| **E2** | **Duplicate identity by another key:** the fix makes pipeline NUMBER globally unique. Can two records still collide on a different identity dimension — same commit + different number, same URL, same step-id — and certify the wrong subject? |
|
|
||||||
| **E3** | "Exactly one gate-verify step per record" — what if a record has zero, or two with different outcomes? Fail closed? |
|
|
||||||
|
|
||||||
## C — clauses, integrity, CI
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **C1** | The three new criteria (`RM02-EVIDENCE-SUBJECT-BINDING`, `RM02-TYPE-STRICT-SCHEMA`, `RM02-HISTORY-BOUNDARY`) are **checked criteria with bidirectionally bound cases**, not prose. Orchestrator observed caseRefs 1 / 3 / 3 — verify the bindings actually run and can fail. |
|
|
||||||
| **C2** | **B1/B2 satisfied in substance:** does `RM02-EVIDENCE-SUBJECT-BINDING` express D-38 generally ("does this gate bind its evidence to its subject?") or only the one pipeline-number instance? Same for D-40 vs the one typo instance. **A clause that only covers its originating instance is not a clause.** |
|
|
||||||
| **C3** | **Nothing weakened:** diff `83d2ecb2` → `32b490a7` removes/relaxes no existing case, test, or assertion. |
|
|
||||||
| **C4** | Exact-head CI terminal-green, full `-f json`, counts stated **including `clone`**; machine-checked with `verify-terminal-green.py --expect-commit 32b490a712a5e8e77f13c40c60099b51feb38994`. |
|
|
||||||
| **C5** | `Closes #1029` still present (D-38c). |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to `32b490a712a5e8e77f13c40c60099b51feb38994`, evidence enumerated, posted durably under
|
|
||||||
your own identity. If a check is unrunnable, **say so** — never substitute a passing variant.
|
|
||||||
|
|
||||||
**H1 and S1 are the two I most want answered**, because they ask whether each fix closed a **class** or
|
|
||||||
an **instance**. Attack outside this set: four of the last five blockers on this PR came from mutating
|
|
||||||
something nobody had registered.
|
|
||||||
|
|
||||||
**Environment note:** `pnpm gate:verify` fails on `checkout-preflight` with outcome 42 (bubblewrap
|
|
||||||
class) in at least one worktree. If you hit it, report it as an environment limitation — do not treat it
|
|
||||||
as a finding, and do not let it mask one.
|
|
||||||
|
|
||||||
**No one dispatching this review may state a conclusion on an open check (D-39).**
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
# RM-02 / PR #1030 — PRE-REGISTERED RE-REVIEW: honest narrowing + (d)-strict
|
|
||||||
|
|
||||||
**Subject head (exact):** `e910a45ab3578a9c77ad3eeaa52b31b72611f6c6`
|
|
||||||
**Supersedes:** the third NO-GO at `fbb61912` (D-45/D-46/D-47) and the D-52 stop. Those are VOID.
|
|
||||||
**Registered by:** `mos-remediation` before any reviewer read the diff. **Reviewer:** `rev-974`.
|
|
||||||
|
|
||||||
## Already reproduced by the orchestrator (do not re-spend here)
|
|
||||||
|
|
||||||
- The required narrowing sentence is **verbatim** in `gates/required-gates.baseline.json` and in
|
|
||||||
`scripts/gate-inventory-claim-control.mjs`: _"Detects accidental and incompetent inventory drift
|
|
||||||
within a checkout; does NOT survive an adversary who rewrites baseline, manifest, and verifier
|
|
||||||
consistently — that guarantee requires RM-60's external boundary."_
|
|
||||||
- **The overclaim control FIRES**: clean ⇒ exit 0; injecting "protected, independently anchored" into
|
|
||||||
the baseline purpose ⇒ **exit 84**, `INVENTORY_CLAIM_OVERSTATED`.
|
|
||||||
- CI #2201 at the exact head, 10/10 incl. `clone`; machine check bound, `exempted_steps 0`, no anomalies.
|
|
||||||
|
|
||||||
## N — the narrowing (D-52's ruling is the wording)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **N1** | ★ Is the narrowed claim **honest EVERYWHERE**, or only where the control looks? Find any place — docs, comments, observations, manifest prose, CLI output — that still implies the baseline is protected or independently anchored. **The control only checks the files it checks.** |
|
|
||||||
| **N2** | ★ Can the **overclaim control itself** be defeated? It is PR-controlled like everything else. Weaken/skip/reword it so an overstatement passes. If it can be trivially neutered, D-52 is re-armed one level down — the exact recursion this PR keeps producing. |
|
|
||||||
| **N3** | Does the control detect **semantic** overclaim or only the literal strings it greps? An artifact could assert protection in different words and pass. |
|
|
||||||
| **N4** | Is the narrowed claim **TRUE**? Verify the baseline genuinely catches accidental/inconsistent drift — not just that it says so. A narrowed claim that is still overstated is D-48 again. |
|
|
||||||
|
|
||||||
## H — (d)-strict history removal
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **H1** | Is the verifier **structurally incapable** of reporting history-provenance-verified, or merely not currently doing so? The manifest says "structurally incapable" — test the claim. |
|
|
||||||
| **H2** | ★ **TRAP 1 re-check:** nothing emits the unverifiable state as an OBSERVATION (which exits 0). Confirm no path yields exit 0 while implying provenance was considered. |
|
|
||||||
| **H3** | ★ **TRAP 2 re-check:** the exclusion is **enforced**, not merely declared in `coverageBoundary.excluded`. Re-enable history provenance without a trustworthy anchor — does a registered case go RED? |
|
|
||||||
| **H4** | The residual is stated **correctly** — no local git state is trustworthy because PR code executes before the gate — **NOT** the D-48 wording ("compromised main"). |
|
|
||||||
|
|
||||||
## B3 / R — evidence-subject and renderer
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **B1** | Subject is on the **EVIDENCE side** and compared **at consumption**, not `gate.evidenceSubject === gate.id` metadata-vs-itself. Mutate the evidence-side subject **per gate**. |
|
|
||||||
| **B2** | Can evidence still be moved or misbound while every gate satisfies its check? |
|
|
||||||
| **R1** | Renderer now covers the **final success stdout/stderr** paths. |
|
|
||||||
|
|
||||||
## C — integrity + CI
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **C1** | Head `e910a45a` on git + provider; `Closes #1029` present. |
|
|
||||||
| **C2** | Exact-head CI terminal-green, `-f json`, counts incl. `clone`; machine-checked with `--expect-commit e910a45ab3578a9c77ad3eeaa52b31b72611f6c6`. |
|
|
||||||
| **C3** | Nothing weakened `fbb61912` → `e910a45a`. Red-first labels honest (D-8). |
|
|
||||||
| **C4** | **NO fourth local anchor was invented.** Blocker 1 and blocker 2's adversarial guarantee both track RM-60. |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to `e910a45ab3578a9c77ad3eeaa52b31b72611f6c6`, evidence enumerated, posted durably.
|
|
||||||
Unrunnable ⇒ **say so**. **N1 and N2 are the sharp ones** — this PR's history is that every fix
|
|
||||||
relocates the defect one level down, and N2 asks whether the control that enforces honesty is itself
|
|
||||||
honest. **Attack outside the set: six for six so far.**
|
|
||||||
|
|
||||||
**No one dispatching this review may state a conclusion on an open check (D-39).**
|
|
||||||
@@ -1,71 +0,0 @@
|
|||||||
# RM-02 / PR #1030 — PRE-REGISTERED ACCEPTANCE CHECKS (post-rebase, keystone)
|
|
||||||
|
|
||||||
**Subject head (exact):** `83d2ecb2243f1b0987ef2bc14de47f444285a684`
|
|
||||||
**Rebased onto:** `main` @ `f4fd5967fc5d4cbc72d680b199d88224aa855131` (post-RM-61)
|
|
||||||
**Registered by:** `mos-remediation` **BEFORE the reviewer read the diff.** **Reviewer:** `rev-974`
|
|
||||||
(author ≠ reviewer; branch commits are `f10-coder`'s and `coder-mos1`'s).
|
|
||||||
**Prior reviews 63 / 65 are SUPERSEDED; this head carries NO live review of any kind.**
|
|
||||||
|
|
||||||
RM-02 is the **keystone**: it is the anti-inert-gate registry every downstream gate is measured against.
|
|
||||||
A defect that survives here propagates into every gate this mission ships.
|
|
||||||
|
|
||||||
## ★ CRUX — the one non-mechanical change, made by the author, that turned a red green
|
|
||||||
|
|
||||||
The rebase was clean. One further commit was **not** purely mechanical and the author disclosed it
|
|
||||||
unprompted (`83d2ecb2` — advance registry activation seam):
|
|
||||||
|
|
||||||
gates/gates.manifest.json
|
|
||||||
- "activationCommit": "f65e9ea656ec466e12640bf6ab5d46fe07ff160c"
|
|
||||||
+ "activationCommit": "f4fd5967fc5d4cbc72d680b199d88224aa855131"
|
|
||||||
|
|
||||||
Stated rationale: after the rebase, `pnpm gate:verify` correctly failed because the newly-merged
|
|
||||||
pre-registry RM-61 commit was treated as _prospective_ and required a manifest that could not exist.
|
|
||||||
|
|
||||||
`activationCommit` sets the lower bound of `activationCommit..HEAD` — **the set of commits required to
|
|
||||||
carry own-tree registry provenance** (`gate-history.mjs:314` → `listProspectiveCommits`). Advancing it
|
|
||||||
**shrinks that set**.
|
|
||||||
|
|
||||||
**Determine, do not assume — and I have deliberately formed and stated no verdict (D-39):**
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **A1** | **Is the advance JUSTIFIED?** Can a pre-registry commit on `main` (e.g. `f4fd5967`) satisfy the provenance requirement at all, or is requiring it impossible-by-construction? If impossible, is advancing the seam the _correct_ remedy, or does a correct remedy exist that does not move an author-controlled field? |
|
|
||||||
| **A2** | **Is the advance MINIMAL?** Was it advanced exactly to the new parent baseline, or beyond it? Does any commit that _should_ remain covered fall outside the new range? |
|
|
||||||
| **A3** | **Are all 7 branch commits still PROSPECTIVE under the new seam?** Enumerate them and show each is still required to carry provenance. The author claims "own-tree provenance over every registry-era branch commit" — verify the claim, do not accept it. |
|
|
||||||
| **A4** | ★★ **IS THE SEAM ITSELF CONSTRAINED?** The only validation found is `merge-base --is-ancestor activationCommit head` (`gate-history.mjs:288`). **A commit is its own ancestor.** Determine what `activationCommit = HEAD` does: is the prospective range empty, does the per-commit loop iterate zero times, and does the history check therefore PASS VACUOUSLY? If so, the anti-inert-gate registry contains an author-settable field that can inert its own history check. **Run it. Report the observed exit and whether any failure is raised.** |
|
|
||||||
| **A5** | **If A4 shows vacuity is reachable, is there a registered MUST-FAIL negative control for it?** RM-02's own founding rule is that a gate with no proven failure path manufactures evidence. Does the registry hold a case that goes RED when the seam is over-advanced? If not, that is a hole in the registry's coverage of itself. |
|
|
||||||
| **A6** | **Self-verification shape (charter / D-19 / D-39b):** the field was advanced by the change's own author to make the author's gate pass. Independent of whether the value is correct, determine whether the _mechanism_ permits an audited party to relax its own audit, and whether that needs a constraint, an owner, or an escalation. |
|
|
||||||
|
|
||||||
## Registry substance — the clauses this PR must now carry
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **B1** | **D-38 clause present and enforced:** the registry asks of every gate _"does this gate BIND its evidence to the subject under review?"_ Ruled in-scope for THIS PR by Mos. Verify it exists as a checked clause, not prose. |
|
|
||||||
| **B2** | **D-40 clause present and enforced:** _"discriminator and comparison inputs must be TYPE-STRICT."_ Also ruled in-scope for THIS PR. `== 0` matching `False`/`0.0` is the banked instance; the clause is the general form. |
|
|
||||||
| **B3** | **D-42's clause is CORRECTLY ABSENT** — provider-side negative control tracks separately (Mos: landing it now would give the registry a clause with nothing to satisfy it, going red on its own clause). Confirm its absence is deliberate and recorded, not forgotten. |
|
|
||||||
| **B4** | **The four founding clauses still hold** (`MISSION.md`): every check proven **right** (red for its own stated reason), the set **covers**, no two criteria **conflict**, and criterion evolution **retains original text + restatement + reason**. |
|
|
||||||
| **B5** | **Nothing was weakened, skipped, or deleted by the rebase.** Diff `f9746b23` → `83d2ecb2` and confirm no registered case, test, or assertion was removed or relaxed to make the rebase land. |
|
|
||||||
| **B6** | **`coverageBoundary.excluded[]` is honest in BOTH directions** (charter principle 4): what it does NOT cover is stated beside what it DOES, and the gap is tracked (`trackedBy: RM-54`) rather than implied-fixed. |
|
|
||||||
| **B7** | **The RM-02 execution boundary** (`gate-history.mjs`, DOES / DOES NOT, owner RM-60, xref RM-59) states its limits in both directions and names a tracked owner — not a documented gap with no owner. |
|
|
||||||
|
|
||||||
## Head + CI (re-run these; do not carry them forward from the author's report)
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| **C1** | Head `83d2ecb2…` on **both** git and provider; `Closes #1029` present in the body (delivery-issue rule, D-38c). |
|
|
||||||
| **C2** | Exact-head CI terminal-green by **full `-f json` scan**, counts stated **including `clone`**. Note the count changed 9 → **10** (this PR adds `gate-verify`) — confirm the new step is real, not a miscount. |
|
|
||||||
| **C3** | **Machine-check it, do not assert it:** `verify-terminal-green.py --expect-commit 83d2ecb2243f1b0987ef2bc14de47f444285a684`. Report exit, `exempted_steps`, `commit == expected_commit`. |
|
|
||||||
| **C4** | `exempted_steps=0` is expected here — `ci-postgres` succeeded, so the #1000 exemption was **not needed**. Confirm the exemption is present-but-unused rather than silently inapplicable. |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to `83d2ecb2243f1b0987ef2bc14de47f444285a684`, evidence enumerated per check, posted
|
|
||||||
durably under your own identity. If a check is unrunnable, **say so** — never substitute a variant that
|
|
||||||
passes. Scan CI from `-f json`, never default text (D-33); state your counts.
|
|
||||||
|
|
||||||
**A4 is the check I most want an answer to and the one I have least confidence about.** Attack outside
|
|
||||||
this set as well: every blocker found on this mission so far came from mutating something nobody had
|
|
||||||
registered a check for.
|
|
||||||
|
|
||||||
**No one dispatching this review may state a conclusion on an open check (D-39).** Observations may be
|
|
||||||
relayed to you; verdicts may not. The ruling is yours.
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
# RM-03 / PR #1032 — PRE-REGISTERED RE-REVIEW (post-freshening)
|
|
||||||
|
|
||||||
**Subject head (exact):** `868b9b871a5118762aa5b8aafecd2f0592f7ab5c`
|
|
||||||
**Rebased onto:** `main` @ `f4fd5967` **Registered by:** `mos-remediation` before the reviewer read the
|
|
||||||
diff. **Reviewer:** `rev-974`.
|
|
||||||
|
|
||||||
**Why this exists:** review 66 APPROVED and the merge-gate GO were bound to `78ec47cd`; `main` drifted
|
|
||||||
under a long hold and the PR went `mergeable=false` (**D-50 — a GO has a shelf life**). Both verdicts
|
|
||||||
are VOID at the new head. Jason's merge approval is **standing** and executes once this re-gates.
|
|
||||||
|
|
||||||
## What the orchestrator already verified (do not re-spend here)
|
|
||||||
|
|
||||||
- `git range-diff 78ec47cd...868b9b87`: commits **2–5 are `=` (patch-equivalent)**; only commit 1 differs.
|
|
||||||
- That single difference is the `test:framework-shell` chain, resolved as a **UNION** — main's
|
|
||||||
`test-terminal-green-contract.sh` **and** RM-03's `tristate`, `github-checks`, `merge-queue-branch`,
|
|
||||||
`merge-head-pin`, plus the pre-existing `branch-absent`. **Nothing dropped from either side.**
|
|
||||||
- CI #2199 at the exact head: 9 children, 9 success incl. `clone`; machine check exit 0, bound, no anomalies.
|
|
||||||
- `mergeable` is now **true**.
|
|
||||||
|
|
||||||
## Checks
|
|
||||||
|
|
||||||
| id | check |
|
|
||||||
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| **R1** | ★ **THE GUARD CAN FAIL.** RM-03 exists because the queue guard is ZERO-INFORMATION (D-23) — it returns pass for every possible input. Prove the rebased head's guard **actually fails** on asserted non-readiness, not merely that its tests pass. This is the whole deliverable. |
|
|
||||||
| **R2** | ★ **NO QUEUE-GUARD SEMANTIC MOVED IN THE REBASE.** Confirm the range-diff equivalence independently. A queue-guard semantic resolved quietly re-breaks the thing this PR fixes. |
|
|
||||||
| **R3** | **Union is complete in BOTH directions:** no RM-03 suite lost to main's version, no main suite (esp. `test-terminal-green-contract.sh`) lost to RM-03's. Enumeration count reconciles. |
|
|
||||||
| **R4** | **Tri-state is real** (`verified` / `written-unverified` / `failed`) — P-WRAPPER-001. Verify an indeterminate result cannot present as a pass; that is the exact defect (`state=unknown exit 0`). |
|
|
||||||
| **R5** | The guard's **exit-asserting non-null-case** tests are genuine — each fails for its own stated reason against pre-fix code, not merely present (D-8). |
|
|
||||||
| **R6** | `test:framework-shell` is **runnable to completion in CI** (canonical env). Known: it exits 97 on some hosts via a Bash 5.2.15 `BASH_LINENO` assertion — if you hit that, report it as an environment limitation, do not treat it as a finding and do not let it mask one. |
|
|
||||||
| **R7** | Exact-head CI terminal-green, full `-f json`, counts stated incl. `clone`; machine-checked with `--expect-commit 868b9b871a5118762aa5b8aafecd2f0592f7ab5c`. |
|
|
||||||
| **R8** | `Closes #1019` present in the body (D-38c delivery-issue rule). |
|
|
||||||
| **R9** | Nothing weakened by the rebase: no test, case, or assertion removed or relaxed to make it land. |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to `868b9b871a5118762aa5b8aafecd2f0592f7ab5c`, evidence enumerated, posted durably under
|
|
||||||
your own identity. If a check is unrunnable, **say so**.
|
|
||||||
|
|
||||||
**R1 is the deliverable and R2 is the risk.** Attack outside this set. **Do not cite the queue guard's
|
|
||||||
own green as evidence of anything** — it remains inert until this very PR lands (D-23).
|
|
||||||
|
|
||||||
**No one dispatching this review may state a conclusion on an open check (D-39).**
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# RM-61 / PR #1033 — PRE-REGISTERED RE-REVIEW ACCEPTANCE CHECKS
|
|
||||||
|
|
||||||
**Subject head (exact):** `033b2ffb46674b2c0bcc5197273c109b461f62d9`
|
|
||||||
**Supersedes:** review 67 / comment 20403 @ `e7b29219` (NO GO). That verdict is VOID — the head moved.
|
|
||||||
**Registered by:** `mos-remediation` (orchestrator). **Reviewer:** `rev-974` (author ≠ reviewer).
|
|
||||||
**Registered BEFORE the reviewer read the diff.** Any head move after this file is committed voids the
|
|
||||||
re-review and requires re-registration.
|
|
||||||
|
|
||||||
## Scope discipline
|
|
||||||
|
|
||||||
The prior review passed AC1–AC8 and still found a blocker, because the registered set tested whether the
|
|
||||||
signature DISCRIMINATES and never tested whether the evidence was BOUND TO ITS SUBJECT (Finding 3 /
|
|
||||||
coverage-failure-mode-2, D-17 class). This set therefore carries the binding property as a first-class
|
|
||||||
check, and **RR7 explicitly invites the reviewer to attack outside the set** — a registered set is
|
|
||||||
protection against retrofitting only, never a ceiling on scrutiny.
|
|
||||||
|
|
||||||
## Checks
|
|
||||||
|
|
||||||
| id | check | verdict form |
|
|
||||||
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- |
|
|
||||||
| **RR1** | The full 12-case contract harness passes at the exact head: `bash test-terminal-green-contract.sh` | ⇒0, and states 12 cases |
|
|
||||||
| **RR2** | ★CRUX — the ORIGINAL ATTACK IS DEAD. Take the real `#2188` record, mutate ONLY `commit` to an unrelated 40-hex value, verify against the true expected head | ⇒1, `exempted_steps == 0`, anomaly naming expected vs actual |
|
|
||||||
| **RR3** | Missing `--expect-commit` cannot be defaulted, inferred, or skipped | ⇒2 (not 0, not 1) |
|
|
||||||
| **RR4** | Malformed expected commit (short SHA, non-hex, empty) is rejected — no silent normalisation into a pass | ⇒2 |
|
|
||||||
| **RR5** | A record with the `commit` key ABSENT (not merely different) is rejected — fail-closed on missing, not just on mismatch | ⇒1, `exempted_steps == 0` |
|
|
||||||
| **RR6** | The genuine artifact still passes when correctly bound: real `#2188` + its true head | ⇒0, `exempted_steps == 1`, exactly one `WP-K8S-1000-CI-POSTGRES-TEARDOWN` |
|
|
||||||
| **RR7** | ★RED-FIRST, PROVED RETROACTIVELY. The four new cases must FAIL against the OLD verifier at `e7b29219` — otherwise they do not test what they claim (D-8 class). Run the new cases against the previous implementation | new cases ⇒≠0 under `e7b29219` |
|
|
||||||
| **RR8** | AC2 OF THE PRIOR SET DID NOT REGRESS: both REAL controls stay terminal red — `#2189` (`ci-postgres` exit 1) and `#2191` (exit 137, `test` exit 61) | both ⇒1, `exempted_steps == 0` |
|
|
||||||
| **RR9** | Still NO fetch / trigger / retry / re-roll / sleep / network of any kind in the verifier or harness. The coin flip must remain removed, not codified (D-21) | grep ⇒ no such call sites |
|
|
||||||
| **RR10** | The doc/baseline changes REQUIRE the current provider PR head to be passed — they must not merely mention it. Check `merge-gate.md`, `CI-CD-PIPELINES.md`, `woodpecker/README.md` state it as a requirement a gate operator cannot satisfy by omission | reviewer judgement, quote the lines |
|
|
||||||
| **RR11** | Exemption remains bound to #1000 and retires with it; signature conjunction unchanged and not widened by this fix | diff-scoped, ⇒ no widening |
|
|
||||||
| **RR12** | Case-sensitivity: an uppercase-hex record commit against a lowercase expected head must NOT silently pass by accident of comparison. State which way it resolves and whether it fails closed | state the observed behaviour |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Report the verdict **bound to `033b2ffb46674b2c0bcc5197273c109b461f62d9`** and state each check's
|
|
||||||
observed result, including counts read from `pipeline-status.sh -f json` (never default text — it omits
|
|
||||||
`clone`, D-33). If any check is unrunnable, **say so** — never substitute a passing variant. Attack
|
|
||||||
outside this set and report anything it finds; RR7 and RR12 exist because the last blocker was found
|
|
||||||
exactly that way.
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
# RM-61 / PR #1033 — PRE-REGISTERED ACCEPTANCE CHECKS: `exit_code` TYPE-STRICTNESS (D-40)
|
|
||||||
|
|
||||||
**Registered by:** `mos-remediation` (orchestrator) — **BEFORE the fix was pushed and before any
|
|
||||||
reviewer read a diff.** At registration time the fix existed only as an unpushed local commit
|
|
||||||
(`6e7a336d`) on coder-mos1's machine which **I have not read**. There is therefore no diff for these
|
|
||||||
checks to have been retrofitted to.
|
|
||||||
|
|
||||||
**Subject head:** TBD — binds to the NEW head once coder-mos1 pushes. The prior head
|
|
||||||
`033b2ffb46674b2c0bcc5197273c109b461f62d9` and its review 69 / pipeline #2193 go VOID on that push;
|
|
||||||
that cost was accepted deliberately by Mos's BLOCKING ruling on D-40.
|
|
||||||
|
|
||||||
**Ruling being enforced (Mos, 2026-08-01):** `exit_code` must be accepted ONLY as a real integer.
|
|
||||||
`false`, `0.0`, `"0"`, and `null` must all fail to satisfy the exemption. Wrong-ACCEPT is the
|
|
||||||
disqualifying direction; this hole sits inside the load-bearing discriminator.
|
|
||||||
|
|
||||||
## ⚠ Read this before writing the tests — RED-FIRST HERE IS NOT UNIFORM
|
|
||||||
|
|
||||||
Two of the four near-miss values **already block** at `033b2ffb`. Demanding "all four observed RED
|
|
||||||
first" would be demanding an impossible red for two of them, and the predictable response to an
|
|
||||||
impossible demand is a fudge — weakening something real to manufacture the red. So state it precisely:
|
|
||||||
|
|
||||||
| value | behaviour at `033b2ffb` (pre-fix) | what the new case is |
|
|
||||||
| ------- | --------------------------------- | ------------------------- |
|
|
||||||
| `false` | **WRONGLY EXEMPTS** (exit 0) | **genuine RED-FIRST** |
|
|
||||||
| `0.0` | **WRONGLY EXEMPTS** (exit 0) | **genuine RED-FIRST** |
|
|
||||||
| `"0"` | correctly blocks (exit 1) | **regression guard** only |
|
|
||||||
| `null` | correctly blocks (exit 1) | **regression guard** only |
|
|
||||||
|
|
||||||
Claiming red-first for `"0"` or `null` would be a false claim about your own evidence. Say which is
|
|
||||||
which. **Do not weaken anything to make a green case go red** (D-8).
|
|
||||||
|
|
||||||
## Checks
|
|
||||||
|
|
||||||
| id | check | verdict form |
|
|
||||||
| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
|
|
||||||
| **TS1** | ★RED-FIRST. `exit_code: false` on the real #2188 record is **observed wrongly exempting at `033b2ffb`** (exit 0, `exempted_steps 1`), then blocks after the fix | pre-fix ⇒0/exempt 1 · post-fix ⇒1/exempt 0 |
|
|
||||||
| **TS2** | ★RED-FIRST. Same for `exit_code: 0.0` | pre-fix ⇒0/exempt 1 · post-fix ⇒1/exempt 0 |
|
|
||||||
| **TS3** | REGRESSION GUARD. `exit_code: "0"` blocked before AND after — state honestly that it was already green | both ⇒1, `exempted_steps 0` |
|
|
||||||
| **TS4** | REGRESSION GUARD. `exit_code: null` blocked before AND after | both ⇒1, `exempted_steps 0` |
|
|
||||||
| **TS5** | ★NOT OVER-TIGHTENED. The genuine artifact — real #2188, real integer `exit_code: 0`, correctly bound head — still passes | ⇒0, `exempted_steps 1`, exactly one `WP-K8S-1000-CI-POSTGRES-TEARDOWN` |
|
|
||||||
| **TS6** | The strictness sits on the value the EXEMPTION rests on, not on a cosmetic sibling. Show the guarded comparison is the one feeding `exemption_applies` | reviewer quotes the line |
|
|
||||||
| **TS7** | `bool` is excluded EXPLICITLY, not incidentally. A bare `isinstance(x, int)` still admits `True`/`False` — verify the `not isinstance(x, bool)` clause exists | ⇒ clause present; `true` also blocks |
|
|
||||||
| **TS8** | Negative control unaffected: a genuine failed step with a real integer non-zero exit still blocks | ⇒1, `exempted_steps 0` |
|
|
||||||
| **TS9** | NO REGRESSION ON THE PRIOR ROUND'S BINDING WORK: mutated record commit ⇒1; `--expect-commit` omitted ⇒2; record `commit` absent ⇒1 | ⇒1 / ⇒2 / ⇒1 |
|
|
||||||
| **TS10** | Signature conjunction NOT widened elsewhere by this fix — `POD_NOT_FOUND` / name / type / state untouched | diff-scoped ⇒ no widening |
|
|
||||||
| **TS11** | Still no fetch / trigger / retry / re-roll / sleep / network | grep ⇒ no call sites |
|
|
||||||
| **TS12** | Full harness passes at the new head; **state the case count** (12 previously, expected 16 — confirm the actual number rather than the expected one) | ⇒0, count stated |
|
|
||||||
|
|
||||||
## Reviewer instruction
|
|
||||||
|
|
||||||
Verdict bound to the NEW head, evidence enumerated per check, CI counts from `pipeline-status.sh -f json`
|
|
||||||
(never default text — it omits `clone`, D-33). If a check is unrunnable, **say so**; never substitute a
|
|
||||||
passing variant.
|
|
||||||
|
|
||||||
**Attack outside this set and report what you find.** Both blockers on this PR so far — the missing
|
|
||||||
commit binding, and this type confusion — were found outside the registered set, by mutating a field
|
|
||||||
nobody had registered a check for. That is now the expectation, not a bonus.
|
|
||||||
|
|
||||||
**Nobody dispatching this review may state a conclusion on an open check here (D-39).** If you are sent
|
|
||||||
an observation, it is an observation; the ruling is yours.
|
|
||||||
@@ -13,78 +13,3 @@ Correct for the CI container (runs as root), fatal for EVERY non-root local chec
|
|||||||
### **D-2 / hygiene — husky `prepare` fails `EPERM` copying into root-owned `.husky/_/`.** Repo working
|
### **D-2 / hygiene — husky `prepare` fails `EPERM` copying into root-owned `.husky/_/`.** Repo working
|
||||||
|
|
||||||
tree has root-owned dirs (`.husky/`, repo root) under a non-root agent. Worked around with the intended `HUSKY=0` escape hatch (does NOT disable the existing pre-commit/pre-push hooks).
|
tree has root-owned dirs (`.husky/`, repo root) under a non-root agent. Worked around with the intended `HUSKY=0` escape hatch (does NOT disable the existing pre-commit/pre-push hooks).
|
||||||
|
|
||||||
<!-- board-roll: 2 entries rolled from BOARD.md -->
|
|
||||||
|
|
||||||
### **D-5 / P-QUEUE-001 + P-CONFORMANCE-001 — KEYSTONE: an inert gate that erased its own evidence.**
|
|
||||||
|
|
||||||
Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ the CI format gate did not block. An unrelated later PR (#872) then reformatted that file via its own `lint-staged`, so `main` went green again and nobody learned the gate had failed to fire. Verified blob-level under the repo's own config. **Detection must be per-merge-commit against that commit's own tree** — a "is main green today" check reports all-clear on this exact defect. Binding on RM-02/RM-55. Full chain in `TASKS.md` §1a. NOT quiet-patched, by Mos's ruling: patching the symptom destroys the signal.
|
|
||||||
|
|
||||||
### **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.**
|
|
||||||
|
|
||||||
planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request.
|
|
||||||
|
|
||||||
<!-- board-roll: 2 entries rolled from BOARD.md -->
|
|
||||||
|
|
||||||
### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.**
|
|
||||||
|
|
||||||
~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents.
|
|
||||||
|
|
||||||
### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.**
|
|
||||||
|
|
||||||
Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class.
|
|
||||||
|
|
||||||
<!-- board-roll: 1 entry rolled from BOARD.md -->
|
|
||||||
|
|
||||||
### **D-8 / P-CONFORMANCE-001 — a PRE-REGISTERED acceptance check that was not runnable as written.**
|
|
||||||
|
|
||||||
PR #1025 AC2's fixture `mkdir -p apps/*/venv/lib` creates a literal `apps/*/venv/lib` dir when the glob is unmatched — it did not test what it claimed. rev-974 ran it exactly as written, caught it, re-ran the intended assertion at an explicit path, and **disclosed** rather than silently substituting a working fixture and reporting PASS. **Pre-registration protects a check from being retrofitted to the implementation; it does not make the check correct.** An unverified gate appeared inside the mechanism built to catch unverified gates. Hard requirement on RM-02: the registry must self-verify that every registered case runs AND can fail — presence is not evidence.
|
|
||||||
|
|
||||||
<!-- board-roll: Decisions-log narrative rolled from BOARD.md 2026-08-01 (D-43: meet the
|
|
||||||
byte budget by ROLLING OUT, never by rewording what stays) -->
|
|
||||||
|
|
||||||
### Decisions log — full record in [`TASKS.md`](./TASKS.md)
|
|
||||||
|
|
||||||
All 44 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-43 + D-38c in `TASKS.md`) and every ruling with its
|
|
||||||
rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this
|
|
||||||
board had done three times in one night (gate list, capability registry, DECISION-1 status), and three
|
|
||||||
more times by the next rotation seam (RM-61 "building", "nothing implemented yet", DECISION-1/2/3
|
|
||||||
"must be ruled"). The rulings a fresh seat needs are items 4–7 above; they are **not** repeated here,
|
|
||||||
because that repetition is what went stale.
|
|
||||||
|
|
||||||
<!-- board-roll: Sequencing section rolled verbatim from BOARD.md 2026-08-01 (D-43: meet the
|
|
||||||
byte budget by ROLLING OUT, never by rewording what stays). Canonical: MISSION.md + TASKS.md §5 -->
|
|
||||||
|
|
||||||
### Sequencing — see [`MISSION.md`](./MISSION.md)
|
|
||||||
|
|
||||||
Builds 1-5, the cross-cutting retirements, and DECISION-1's corrected wire-in target are stated once in
|
|
||||||
the charter and `TASKS.md` §5. **Not repeated here** — the previous copy of DECISION-1's status on this
|
|
||||||
board is one of the six stale restatements below.
|
|
||||||
|
|
||||||
<!-- board-roll: capability/seat-identity bullets rolled verbatim from BOARD.md 2026-08-01
|
|
||||||
(D-43: roll out, never reword). Authoritative home: TASKS.md D-11 / D-11a / D-11b. -->
|
|
||||||
|
|
||||||
- Capability is **per-path** (D-11b → **superseded in part by D-13/D-15**): a token file is **necessary,
|
|
||||||
not sufficient**. Three layers — token file (raw-API), `tea` login (tea paths), **repository permission**
|
|
||||||
(writes). Before dispatch, assert `permissions.push == true` **as that seat**, not token existence and
|
|
||||||
not a 200 on a read. Mos owns provisioning; escalate missing pairs.
|
|
||||||
- Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and
|
|
||||||
agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship.
|
|
||||||
|
|
||||||
<!-- board-roll: D-26 gate-restatement rationale rolled verbatim from BOARD.md 2026-08-01 -->
|
|
||||||
|
|
||||||
### Why the board must not restate the delivery gates (D-26)
|
|
||||||
|
|
||||||
Restating the gate from memory is how the merge-gate step went missing from mission setup twice,
|
|
||||||
once inside the correction for it (**D-26**).
|
|
||||||
|
|
||||||
<!-- board-roll: Fleet seats rolled verbatim from BOARD.md 2026-08-01 (D-43: roll out, never
|
|
||||||
reword). NOTE: all these seats are UNMANAGED per D-41; `mosaic fleet ps` is live truth. -->
|
|
||||||
|
|
||||||
## Fleet seats
|
|
||||||
|
|
||||||
- mos-remediation — project orchestrator (Claude, /src/mosaic-stack, socket `mosaic-fleet`) — ACTIVE
|
|
||||||
- planner-opus — adversarial planner (robustness), Opus 5, socket `default` — DELIVERED, idle
|
|
||||||
- planner-sol — adversarial planner (pragmatic), gpt-5.6-sol, socket `default` — DELIVERED, idle
|
|
||||||
- rev-974 — mosaicstack reviewer identity (id 16, write:repository) — idle, on call
|
|
||||||
- Mos (mos-claude) — lead coordinator, socket `default` — relay path to Jason
|
|
||||||
|
|||||||
+74
-63
@@ -1,83 +1,94 @@
|
|||||||
# mos-remediation — LIVE BOARD (keep < 8 KB)
|
# mos-remediation — LIVE BOARD (keep < 8 KB)
|
||||||
|
|
||||||
**Phase:** EXECUTING — RM-03 at owner-merge; RM-61 **MERGED**; **RM-02 keystone is the front**.
|
**Phase:** EXECUTING — first PR merged; RM-01 in flight; all 3 decisions ruled.
|
||||||
**Updated:** 2026-08-01 — seam crossed; successor seat resumed, attested from the files, and is driving.
|
**Updated:** 2026-07-31 (mos-remediation orchestrator; seat active on `mosaic-fleet`).
|
||||||
⚠ That was a **MANUAL pane respawn** (prior seat ~803k tokens): it validates the checkpoint+rehydration
|
|
||||||
**design**, NOT a lifecycle **mechanism** — P-LIFECYCLE rotation does not exist yet (**D-41 / RM-62**).
|
|
||||||
|
|
||||||
## Head
|
## Head
|
||||||
|
|
||||||
- Charter + 15 decisions + 4-build plan: `MISSION.md`. Backlog + all findings: `TASKS.md`.
|
- Mission charter + 15 decisions + 4-build plan: PERSISTED (`docs/remediation/MISSION.md`).
|
||||||
- Planning DONE (58 tasks, P0–P5). **DECISION-1/2/3 all RULED by Mos 2026-07-31** (`TASKS.md` §5) —
|
- HOLD lifted for this workstream (Jason 2026-07-31). Nothing implemented yet — planning first.
|
||||||
nothing is waiting on a decision. D-2's availability _target_ is Jason-pending and non-blocking.
|
- Orchestrator seat `mos-remediation` is LIVE and owns the mission. Residency attestation: PASS.
|
||||||
- **Executing, not planning.** RM-01 is MERGED; three lanes are live (see In-flight).
|
- **TASK-0 DONE** — checkout repaired, all three gates green HONESTLY (no `--no-verify`), branch pushed.
|
||||||
- Orchestrator seat `mos-remediation` LIVE, owns the mission, resumed across the rotation seam
|
- **TASK-1 DONE** — both planners delivered independently on clean context; reconciled into `TASKS.md`
|
||||||
2026-08-01 and re-attested to Mos from the files. Residency attestation: PASS.
|
(58 tasks across P0–P5, 7 convergences, 7 adjudicated disagreements, 3 escalated decisions).
|
||||||
|
- **NEXT ACTION IS NOT MINE:** DECISION-1/2/3 (`TASKS.md` §5) must be ruled before P0 dispatch.
|
||||||
|
RM-01 is dispatchable immediately regardless — it depends on nothing and blocks everything.
|
||||||
|
|
||||||
## In-flight
|
## In-flight
|
||||||
|
|
||||||
| Task | Owner | State |
|
| Task | Owner | State |
|
||||||
| ------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
| ------------------------------------------------- | --------------- | ------------------------------------------------------------------ |
|
||||||
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
|
| PR #1026 docs (mission record + backlog) | mos-remediation | OPEN, retargeted to main, rebased; diff verified docs-only |
|
||||||
| RM-03 queue guard | Jason (re-sync) | ✅ **MERGED** `58b971ab` (#1032), #1019 closed. ⚠ **NOT DELIVERED**: installed guard still the broken one (291 lines / 0 `ASSERTED_NOT_READY` vs main 482 / 5). Re-sync via `mosaic upgrade`, then **prove it blocks a KNOWN-RED pipeline** — **D-51** |
|
| PR #1025 hygiene | — | **MERGED** 52414605; rev-974 APPROVE + CI #2158 8/8 terminal-green |
|
||||||
| RM-02 registry ★key | rev-974 | **RE-REVIEW @ `e910a45a`** — (d)-strict history REMOVED + blocker 2 NARROWED (D-52) + blocker 3 + renderer. Overclaim control **fires at exit 84**, verified by orchestrator. CI 2201 **10/10**. ACs @ `dde38717` |
|
| DECISION-1 wire-in point (charter change) | Mos / Jason | ESCALATED — both planners reject the charter's target |
|
||||||
| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` |
|
| DECISION-2 rollback artifact + availability trade | Jason | ESCALATED |
|
||||||
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
|
| DECISION-3 RM-03 vs parked PR #1023 ownership | Mos | ESCALATED |
|
||||||
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
|
| RM-01 reproducible checkout (unblocks everything) | unassigned | READY TO DISPATCH |
|
||||||
|
|
||||||
### For the incoming orchestrator — read this before acting
|
|
||||||
|
|
||||||
1. **Lane state lives in the In-flight table above — this item does NOT restate it.** It went stale
|
|
||||||
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
|
|
||||||
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
|
|
||||||
sole-written and has no independent verifier.
|
|
||||||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 53 findings
|
|
||||||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in TASKS.md), every ruling with its rationale, and the
|
|
||||||
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
|
|
||||||
3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
|
|
||||||
Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
|
|
||||||
third arrival) and **no universally-quantified check may pass over an empty set** (D-44/D-46).
|
|
||||||
4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=<seat>` is stripped by a context reset (**D-34**) —
|
|
||||||
every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials.
|
|
||||||
5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts.
|
|
||||||
6. **The queue guard is zero-information until RM-03 merges** (**D-23**) — never cite its green.
|
|
||||||
7. **The bounded CI re-roll used on RM-02 was a one-time stopgap, NOT policy.** A per-PR free re-roll is
|
|
||||||
D-21 normalisation. Do not repeat it; RM-61 is the fix.
|
|
||||||
|
|
||||||
## Delivery gates — REFERENCE, do not restate
|
|
||||||
|
|
||||||
Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) +
|
|
||||||
`~/.config/mosaic/fleet/roles/validator.md`. Order and the freeze/zero-information rules: `MISSION.md`
|
|
||||||
and `KICKSTART.md`. **Read them there** (why: **D-26**, in `BOARD-LEDGER.md`).
|
|
||||||
|
|
||||||
## Fleet seats
|
## Fleet seats
|
||||||
|
|
||||||
Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is `mosaic fleet ps`.
|
- mos-remediation — project orchestrator (Claude, /src/mosaic-stack, socket `mosaic-fleet`) — ACTIVE
|
||||||
|
- planner-opus — adversarial planner (robustness), Opus 5, socket `default` — DELIVERED, idle
|
||||||
|
- planner-sol — adversarial planner (pragmatic), gpt-5.6-sol, socket `default` — DELIVERED, idle
|
||||||
|
- rev-974 — mosaicstack reviewer identity (id 16, write:repository) — idle, on call
|
||||||
|
- Mos (mos-claude) — lead coordinator, socket `default` — relay path to Jason
|
||||||
|
|
||||||
## Gate status
|
## Gate status
|
||||||
|
|
||||||
|
- Delivery gates active: author≠reviewer, diff-blind pre-registered checks, CI-green, merged-PR completion.
|
||||||
- Freeze: LIFTED for this workstream only.
|
- Freeze: LIFTED for this workstream only.
|
||||||
- Git identity: orchestrator runs `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what
|
- Git identity: `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what
|
||||||
gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions.
|
gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions.
|
||||||
- Capability + seat identity (**D-11b / D-11a**, incl. the false-NEGATIVE twin): authoritative in
|
|
||||||
`TASKS.md`. Short form — **assert the DIFFERENTIAL as that seat** (authenticated `push:true` vs
|
|
||||||
unauthenticated `push:false`); a single endpoint can be true for anyone or 403 for an unrelated
|
|
||||||
scope. Full text rolled to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
|
|
||||||
- ⚠ **LIVE HAZARD (D-37) — one shared `.git/config` re-identifies EVERY worktree at once.** Every seat,
|
|
||||||
including `rev-974`'s review worktree, currently authors as **`coder-mos1`**; `MOSAIC_GIT_IDENTITY`
|
|
||||||
does **not** override it. **STANDING ORDER: commit with explicit
|
|
||||||
`git -c user.name=<seat> -c user.email=<seat>@…`, and NOBODY rewrites the shared config mid-flight.**
|
|
||||||
Real fix authorised, Mos owns it, sequenced at a quiet seam. **#1024 implicated.** Detail: D-37.
|
|
||||||
- Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**);
|
|
||||||
commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never
|
|
||||||
substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**);
|
|
||||||
**relay observations into an open review, NEVER your own conclusion on an open check (D-39)**; the
|
|
||||||
**author never adjudicates their own PR's blocker status** — surface evidence, prepare the fix, hold.
|
|
||||||
- Remote control: native `/remote-control` NOT wired in this runtime. Path is **Mos-relay**
|
- Remote control: native `/remote-control` NOT wired in this runtime. Path is **Mos-relay**
|
||||||
(Jason ↔ mos-claude via Discord ↔ mos-remediation via agent-send). Not a blocker.
|
(Jason ↔ mos-claude via Discord ↔ mos-remediation via agent-send). Not a blocker.
|
||||||
|
|
||||||
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
|
## Sequencing (from MISSION.md)
|
||||||
|
|
||||||
All 53 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-52 + D-38c in `TASKS.md`) and every ruling with
|
1. Spine + choke-point service (MACP wiring @ mosaic_orchestrator.py::run_single_task) + PG/Redis
|
||||||
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
|
⚠ **CONTESTED — see DECISION-1.** Both planners independently reject this wire-in point: that
|
||||||
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
|
controller is `"enabled": false` and references a dispatcher that does not exist here. Charter text
|
||||||
|
left UNCHANGED pending Mos/Jason ruling; do not treat it as settled.
|
||||||
|
2. Rotation daemon (finish Mission Control Plane, reuse packages/coord)
|
||||||
|
3. Comms service (envelope→service→PG/Redis→adapters)
|
||||||
|
4. Hygiene + conformance harness
|
||||||
|
Cross-cutting retirements: flat-file tracking, 3 MACP islands, silent MOSAIC BYPASS.
|
||||||
|
|
||||||
|
## Dogfood evidence — live failure classes, not hypotheticals
|
||||||
|
|
||||||
|
> Newest first. Oldest entries roll to `BOARD-LEDGER.md` via `board-roll.sh` when this file
|
||||||
|
> exceeds its 8 KB cap. Keystone detail is duplicated in `TASKS.md` §1a, so rolling loses nothing.
|
||||||
|
|
||||||
|
<!-- BOARD-ROLL:START -->
|
||||||
|
|
||||||
|
### **D-8 / P-CONFORMANCE-001 — a PRE-REGISTERED acceptance check that was not runnable as written.**
|
||||||
|
|
||||||
|
PR #1025 AC2's fixture `mkdir -p apps/*/venv/lib` creates a literal `apps/*/venv/lib` dir when the glob is unmatched — it did not test what it claimed. rev-974 ran it exactly as written, caught it, re-ran the intended assertion at an explicit path, and **disclosed** rather than silently substituting a working fixture and reporting PASS. **Pre-registration protects a check from being retrofitted to the implementation; it does not make the check correct.** An unverified gate appeared inside the mechanism built to catch unverified gates. Hard requirement on RM-02: the registry must self-verify that every registered case runs AND can fail — presence is not evidence.
|
||||||
|
|
||||||
|
### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.**
|
||||||
|
|
||||||
|
~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents.
|
||||||
|
|
||||||
|
### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.**
|
||||||
|
|
||||||
|
Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class.
|
||||||
|
|
||||||
|
### **D-5 / P-QUEUE-001 + P-CONFORMANCE-001 — KEYSTONE: an inert gate that erased its own evidence.**
|
||||||
|
|
||||||
|
Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ the CI format gate did not block. An unrelated later PR (#872) then reformatted that file via its own `lint-staged`, so `main` went green again and nobody learned the gate had failed to fire. Verified blob-level under the repo's own config. **Detection must be per-merge-commit against that commit's own tree** — a "is main green today" check reports all-clear on this exact defect. Binding on RM-02/RM-55. Full chain in `TASKS.md` §1a. NOT quiet-patched, by Mos's ruling: patching the symptom destroys the signal.
|
||||||
|
|
||||||
|
### **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.**
|
||||||
|
|
||||||
|
planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request.
|
||||||
|
|
||||||
|
<!-- BOARD-ROLL:END -->
|
||||||
|
|
||||||
|
## Decisions log
|
||||||
|
|
||||||
|
- 2026-07-31 — Mission set up by Mos post-postmortem (15/15 decided). Dogfood posture active.
|
||||||
|
- 2026-07-31 — Mos: stale `.mosaic/orchestrator/mission.json` is RESIDUE of the disabled Python
|
||||||
|
orchestrator rail that this plan RETIRES. Do NOT invest in it; do NOT build on that rail. The 0/0
|
||||||
|
milestone banner is cosmetic. (Supersedes any plan to repair it.)
|
||||||
|
- 2026-07-31 — Mos: planners must be dispatched with GUARANTEED clean context, not requested-clean.
|
||||||
|
Prior default-socket planner sessions predate this mission; dirty context is the indicted hygiene.
|
||||||
|
- 2026-07-31 — mos-remediation: worker briefs forbid all git ops and restrict each worker to a single
|
||||||
|
named output file, so two planners can share one checkout without a branch race (M2-era incident doctrine).
|
||||||
|
|||||||
@@ -7,15 +7,10 @@ mechanically until Build 3 (rotation) makes it automatic.
|
|||||||
|
|
||||||
## On resume (do in order, before any orchestration action)
|
## On resume (do in order, before any orchestration action)
|
||||||
|
|
||||||
1. `cd /src/mosaic-stack`, then **`git fetch origin remediation/state`**.
|
1. `cd /src/mosaic-stack` and confirm you are on the remediation working branch.
|
||||||
⚠ **The live board is on the rolling branch `remediation/state`, NOT on `main`.** `main` carries only
|
|
||||||
periodic snapshots, so reading the board from `main` will silently give you a STALE tick. Read the
|
|
||||||
live files at `origin/remediation/state` (e.g. `git show origin/remediation/state:docs/remediation/BOARD.md`),
|
|
||||||
or check that branch out. Every tick is pushed there immediately, so its HEAD is always the newest state.
|
|
||||||
2. Read `docs/remediation/MISSION.md` — the charter (goal, 4 builds, 15 decisions, sequencing, directives).
|
2. Read `docs/remediation/MISSION.md` — the charter (goal, 4 builds, 15 decisions, sequencing, directives).
|
||||||
3. Read `docs/remediation/BOARD.md` **at `origin/remediation/state`** — the LIVE state: current phase,
|
3. Read `docs/remediation/BOARD.md` — the LIVE state: current phase, in-flight tasks, fleet seat assignments,
|
||||||
in-flight tasks, fleet seat assignments, gate status. Single source of in-flight truth (kept < 8 KB;
|
gate status. This is your single source of in-flight truth (kept small).
|
||||||
older entries roll to `BOARD-LEDGER.md` via `board-roll.sh`).
|
|
||||||
4. Read the discussion checkpoint for full rationale if needed:
|
4. Read the discussion checkpoint for full rationale if needed:
|
||||||
`../jarvis-brain/docs/scratchpads/postmortem/REMEDIATION-DISCUSSION-STATE.md` (or the jarvis-brain repo path).
|
`../jarvis-brain/docs/scratchpads/postmortem/REMEDIATION-DISCUSSION-STATE.md` (or the jarvis-brain repo path).
|
||||||
5. **Residency attestation (fail-closed):** restate from the reloaded files — (a) the goal in one line, (b) the
|
5. **Residency attestation (fail-closed):** restate from the reloaded files — (a) the goal in one line, (b) the
|
||||||
@@ -25,18 +20,8 @@ mechanically until Build 3 (rotation) makes it automatic.
|
|||||||
## Standing invariants (never violate)
|
## Standing invariants (never violate)
|
||||||
|
|
||||||
- **North star:** deterministic-right-answer → code/gate; LLM only for judgment.
|
- **North star:** deterministic-right-answer → code/gate; LLM only for judgment.
|
||||||
- **Delivery gates — REFERENCE the canonical files, never restate them:**
|
- **Delivery gates:** author≠reviewer; PRE-REGISTERED diff-blind checks committed before reading the diff;
|
||||||
`~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) and
|
CI terminal-green; completion = merged PR + closed issue. rev-974 = the mosaicstack reviewer identity.
|
||||||
`~/.config/mosaic/fleet/roles/validator.md` (validator role). Order:
|
|
||||||
independent review (author ≠ reviewer, `rev-974`; pre-registered diff-blind checks committed before the
|
|
||||||
diff is read) → remediation → **CI terminal-green at the exact head by full step scan** →
|
|
||||||
**merge-gate verdict `GO`/`NO-GO`/`HOLD`**, commit-bound and **void the instant the head moves**, posted
|
|
||||||
durably with enumerated evidence under its own minted identity → **coordinator head-pinned merge**.
|
|
||||||
The queue guard runs but is **zero-information until RM-03 lands** (D-23) and must not be cited as evidence.
|
|
||||||
**After a `GO`, freeze pushes** — even a doc tweak voids the verdict. The coordinator assigns the gate seat.
|
|
||||||
- **Query for refutation, never for confirmation.** A subordinate asked to confirm a hypothesis will
|
|
||||||
agree — the bias is in the question, not the answerer, and agent seats are agreeable by construction.
|
|
||||||
State the hypothesis as yours, ask for the evidence that KILLS it, and reproduce when it matters.
|
|
||||||
- **Dogfooding:** every fix validated against its live seed case (MISSION.md lists them).
|
- **Dogfooding:** every fix validated against its live seed case (MISSION.md lists them).
|
||||||
- **Tracking → DB** (hard cutover); do NOT re-invest in flat-file tracking. jarvis-brain PDA is off-limits.
|
- **Tracking → DB** (hard cutover); do NOT re-invest in flat-file tracking. jarvis-brain PDA is off-limits.
|
||||||
- **Git identity:** export `MOSAIC_GIT_IDENTITY=<your-seat>` so wrappers author correctly and survive respawn.
|
- **Git identity:** export `MOSAIC_GIT_IDENTITY=<your-seat>` so wrappers author correctly and survive respawn.
|
||||||
|
|||||||
+11
-239
@@ -1,7 +1,7 @@
|
|||||||
# Mosaic Stack Remediation — Mission Charter
|
# Mosaic Stack Remediation — Mission Charter
|
||||||
|
|
||||||
**Owner:** project orchestrator `mos-remediation` (Claude, launched in `/src/mosaic-stack`).
|
**Owner:** project orchestrator `mos-remediation` (Claude, launched in `/src/mosaic-stack`).
|
||||||
**Origin:** 2026-07-16..31 fleet lifecycle postmortem. **Status:** EXECUTING (planning complete; RM-01 in flight).
|
**Origin:** 2026-07-16..31 fleet lifecycle postmortem. **Status:** PLANNING (task decomposition).
|
||||||
**HOLD lifted** for this workstream by Jason, 2026-07-31 — "begin full mosaic fleet operation on this."
|
**HOLD lifted** for this workstream by Jason, 2026-07-31 — "begin full mosaic fleet operation on this."
|
||||||
|
|
||||||
## Goal
|
## Goal
|
||||||
@@ -10,222 +10,23 @@ Convert the 15 accepted postmortem remediation proposals into a working, **dogfo
|
|||||||
**North star:** anything with a deterministic right answer moves OUT of the LLM into a deterministic
|
**North star:** anything with a deterministic right answer moves OUT of the LLM into a deterministic
|
||||||
gate/program; the LLM handles only genuine judgment.
|
gate/program; the LLM handles only genuine judgment.
|
||||||
|
|
||||||
### First-class principle — observe the property, not the exit code
|
|
||||||
|
|
||||||
> **No write is done until the requested PROPERTY is observed. A success exit code is not evidence.**
|
|
||||||
>
|
|
||||||
> **Success output is designed to be believed.** That is the whole reason the inert-gate class exists
|
|
||||||
> and why P-WRAPPER-001's tri-state (`verified` / `written-unverified` / `failed`) is not optional. The
|
|
||||||
> failure is not carelessness — a green is _engineered_ to be trusted, so trusting it is the default
|
|
||||||
> behaviour of a competent operator, not a lapse.
|
|
||||||
>
|
|
||||||
> Promoted to the charter by Mos (2026-07-31) after the orchestrator committed this exact error: a
|
|
||||||
> `--draft` flag was silently dropped by a wrapper fallback that still exited 0, and the PR was reported
|
|
||||||
> as a draft on the strength of the exit code rather than an observed `draft: true` (D-12). Twelve
|
|
||||||
> failure instances were banked in that session; **three of them were the orchestrator's own.** That
|
|
||||||
> ratio is the point — the mechanism must catch the mechanic too, or it is not a mechanism.
|
|
||||||
>
|
|
||||||
> Operationally: after any write, read back the property you required. Applies to gates, wrappers, PR
|
|
||||||
> flags, commit authorship, file installs, and message delivery alike.
|
|
||||||
|
|
||||||
### First-class principle — pre-registration prevents retrofitting, and nothing else
|
|
||||||
|
|
||||||
> **A pre-registered check set can fail in three distinct ways:**
|
|
||||||
>
|
|
||||||
> | mode | the set is… | found as |
|
|
||||||
> | --------------------------- | ------------------------------------------------- | -------- |
|
|
||||||
> | **WRONG** | a check does not test what it claims | D-8 |
|
|
||||||
> | **INCOMPLETE** | green while a criterion's requirement is untested | D-17 |
|
|
||||||
> | **INTERNALLY INCONSISTENT** | two criteria cannot both hold | D-18 |
|
|
||||||
>
|
|
||||||
> **Pre-registration protects against exactly one thing: retrofitting a check to fit the implementation
|
|
||||||
> it is supposed to judge.** It confers neither correctness, nor coverage, nor consistency. "We
|
|
||||||
> pre-registered the checks" has been treated as though it settled the question — it settles one of
|
|
||||||
> three.
|
|
||||||
>
|
|
||||||
> Promoted to the charter by Mos (2026-07-31). All three modes were found on this mission's own **first
|
|
||||||
> delivery**, by the machinery applied to its own work — not by inspection, and not by looking for them.
|
|
||||||
>
|
|
||||||
> **Enforceable form — RM-02's four clauses.** The registry must establish that: (1) each check is
|
|
||||||
> **right** — proven red for its own stated reason before its green counts; (2) the set **covers** —
|
|
||||||
> every criterion bound to a case that actually exercises it; (3) no two criteria **conflict** —
|
|
||||||
> mutual unsatisfiability is a registry defect discoverable by construction; (4) when a criterion's
|
|
||||||
> meaning changes, the registry **retains original text, restatement, and reason**, so evolution stays
|
|
||||||
> auditable. A criterion with no case that can fail for its own reason is unregistered in substance,
|
|
||||||
> however it reads in the manifest.
|
|
||||||
|
|
||||||
### Corollary — never ship an integrity claim dressed as a property
|
|
||||||
|
|
||||||
> A verification artifact that can be forged by whoever it is meant to catch verifies nothing. If a
|
|
||||||
> manifest, marker, ledger, or receipt is writable by the same actor whose behaviour it certifies, it
|
|
||||||
> **certifies the attack.** Such an artifact must sit inside the integrity envelope it belongs to,
|
|
||||||
> publish atomically, and carry a **tamper negative-control observed red** — otherwise its integrity is
|
|
||||||
> a _claim_, not a _property_.
|
|
||||||
>
|
|
||||||
> **If it cannot be made tamper-evident, say so and reconsider the approach.** Laundering foreign
|
|
||||||
> content as certified is the only unacceptable outcome; an honest "this cannot be verified" is always
|
|
||||||
> available and always preferable.
|
|
||||||
|
|
||||||
### First-class principle — when a property cannot exist at the layer it was specified
|
|
||||||
|
|
||||||
> Some required properties are **impossible at the layer that asked for them** — not hard, impossible.
|
|
||||||
> A local check cannot defend against an actor who can rewrite the check itself. When that happens,
|
|
||||||
> there are exactly three honest moves, and all three are mandatory:
|
|
||||||
>
|
|
||||||
> 1. **Implement what the layer _can_ guarantee.** Partial protection against the class it was actually
|
|
||||||
> born from is worth having.
|
|
||||||
> 2. **State the boundary precisely, in BOTH directions.** What it does _not_ defend, **and** beside it
|
|
||||||
> what it _does_. A reader who sees only the negative dismisses the check as worthless; one who sees
|
|
||||||
> only the positive over-trusts it. **Both together is the honest artifact** — either alone misleads.
|
|
||||||
> 3. **Record where the real guarantee will come from — as a TRACKED DEPENDENCY, not prose.** It must
|
|
||||||
> name a task that someone must close. _A documented gap with no owner becomes a permanent gap that
|
|
||||||
> reads as intentional._
|
|
||||||
>
|
|
||||||
> **A written-down gap is acceptable engineering. An implied-fixed gap is this mission's core failure in
|
|
||||||
> a new costume** — a verification artifact that verifies nothing, with a green to prove it.
|
|
||||||
>
|
|
||||||
> Promoted to the charter by Mos (2026-07-31) from D-19. Origin: the RM-01 symlink manifest could not be
|
|
||||||
> made tamper-evident against a same-UID actor (CWE-345), because the manifest and its marker share one
|
|
||||||
> writable tree. The implementing seat **escalated rather than relabelling self-authentication as
|
|
||||||
> tamper-resistance** — the corollary above firing on its first real adversarial test, on the cheapest
|
|
||||||
> seat in the loop. Residual risk bound to **RM-59** (`depends_on: RM-12, RM-21, RM-25`), where the
|
|
||||||
> choke-point executor and spine verify from _outside_ the worktree's authority.
|
|
||||||
|
|
||||||
### First-class principle — query for refutation, never for confirmation
|
|
||||||
|
|
||||||
> **A subordinate asked to confirm a hypothesis will agree. Ask it to refute, with evidence.**
|
|
||||||
>
|
|
||||||
> The bias is induced by the **query**, not by the answerer's diligence. _"The DB flaked — please
|
|
||||||
> confirm"_ and _"confirm or refute this, with the log line that proves it"_ are different instruments,
|
|
||||||
> and they return different answers to the same question. The first harvests agreement; only the second
|
|
||||||
> can return **"you are wrong, and here is why."**
|
|
||||||
>
|
|
||||||
> This matters most with agent subordinates, which are **agreeable by construction**: fluent, eager to
|
|
||||||
> be useful, and structurally disinclined to tell the dispatcher their premise is false. A confirmation
|
|
||||||
> query aimed at one is close to a guaranteed yes — so the discipline cannot rest on the answerer being
|
|
||||||
> rigorous. **It has to be built into how the question is asked.**
|
|
||||||
>
|
|
||||||
> Promoted to the charter by Mos (2026-08-01). Origin: the orchestrator hypothesised that a coincident
|
|
||||||
> `ci-postgres` failure caused a CI test failure and asked the implementing seat to **confirm or refute**
|
|
||||||
> it. The seat **refuted it** with the log (`ci-postgres:5432 - accepting connections`, migrations
|
|
||||||
> completed) and identified the real cause. Reproduction on an identical head then settled it. Had the
|
|
||||||
> query been phrased for confirmation, the agreement would have been returned, **D-21 would have been
|
|
||||||
> re-classified on a false premise**, and a banked finding would have been silently corrupted.
|
|
||||||
>
|
|
||||||
> **Operationally:** state your hypothesis explicitly, mark it as yours, ask for _evidence that kills
|
|
||||||
> it_, and say what evidence would change your mind. A hypothesis you cannot describe how to falsify is
|
|
||||||
> not yet a hypothesis. Where the answer is consequential, **reproduce** rather than accept — two
|
|
||||||
> independent runs beat one confident report.
|
|
||||||
|
|
||||||
### First-class principle — the anchor must live outside the audited party's authority
|
|
||||||
|
|
||||||
> **You cannot fix "the author controls X" by deriving X from something the author ALSO controls.**
|
|
||||||
> Deriving merely **moves** the control point; it does not remove it.
|
|
||||||
>
|
|
||||||
> Promoted to the charter by Mos (2026-08-01) on the **THIRD INDEPENDENT ARRIVAL** of the same
|
|
||||||
> conclusion, each reached while trying to ship something else, each from a different direction:
|
|
||||||
>
|
|
||||||
> | arrival | the audited party controls… | found as |
|
|
||||||
> | ----------------- | ------------------------------------------------------------------- | -------- |
|
|
||||||
> | manifest | the tree that certifies its own generated state (same-UID, CWE-345) | **D-19** |
|
|
||||||
> | sandbox | the code that enters the sandbox, before the boundary exists | **D-25** |
|
|
||||||
> | **registry seam** | **WHEN the tracked path is introduced, hence the derived boundary** | **D-45** |
|
|
||||||
>
|
|
||||||
> Round 1 the value was an author-settable **field**, so it was **derived**. Round 2 the derivation
|
|
||||||
> depended on **when the author introduces the path**. Same authority, new costume. **Three
|
|
||||||
> impossibility-derivations of one conclusion is not a coincidence to note — it is the strongest
|
|
||||||
> architectural evidence this mission has produced**, and it is precisely what **forces Builds 1–2**
|
|
||||||
> rather than making them a preference.
|
|
||||||
>
|
|
||||||
> **Operationally:** anchor to a reference the audited party cannot move. A git **merge-base against
|
|
||||||
> `main`** is such a reference for a PR author (they own their branch; they do not own `main`).
|
|
||||||
> **State the bootstrap in BOTH directions (D-19):** that anchor is sound against an author who cannot
|
|
||||||
> rewrite `main` — the threat in scope — and **NOT** sound against an attacker who can. **That residual
|
|
||||||
> is what Builds 1–2 close, and it must be recorded as a tracked dependency, never implied.**
|
|
||||||
|
|
||||||
### First-class principle — no universally-quantified check may pass over an empty set
|
|
||||||
|
|
||||||
> **"All registered cases ran" is VACUOUSLY TRUE when there are no registered cases.**
|
|
||||||
> **Non-emptiness and anchoring are PRECONDITIONS asserted before the quantified check runs — not
|
|
||||||
> properties hoped for after it.**
|
|
||||||
>
|
|
||||||
> Promoted by Mos (2026-08-01) after the identical vacuity appeared **twice, at two different levels**:
|
|
||||||
> `activationCommit = HEAD` emptied the **commit range** (D-44), and an emptied manifest — `criteria`,
|
|
||||||
> `gates`, `proseClaims`, `compatibilityScenarios` all `[]` — emptied the **registry population**
|
|
||||||
> (D-46), each yielding **exit 0**. The first was fixed **as an instance**; the principle was never
|
|
||||||
> extracted, **so it returned one level up.**
|
|
||||||
>
|
|
||||||
> **Delete every gate and every criterion TOGETHER and no remaining reference complains — because every
|
|
||||||
> reference went with them.** A check that quantifies over a population must actually **range** over it,
|
|
||||||
> and that population must be **provably complete and non-empty**.
|
|
||||||
>
|
|
||||||
> **Corollary (same disease):** a clause written for the instance that produced it is not a clause.
|
|
||||||
> **Do not relabel the originating instances as the general clauses** — quantify over the population.
|
|
||||||
|
|
||||||
### First-class principle — redundant observation on evidence-bearing steps
|
|
||||||
|
|
||||||
> **Two observers of the same evidence, disagreeing, catch what neither catches alone.** Apply redundancy
|
|
||||||
> not only to judgement calls but to **evidence gathering itself** — the step everyone assumes is
|
|
||||||
> mechanical and therefore skips.
|
|
||||||
>
|
|
||||||
> Promoted by Mos (2026-08-01) from **D-33**. A seat scanned a pipeline with `-f json` and reported 9
|
|
||||||
> steps; the orchestrator scanned the same pipeline in the wrapper's default text mode and reported 8.
|
|
||||||
> **The default output omits `clone`.** Every "full step scan" that night had been 8-of-9 and was stated
|
|
||||||
> as complete in good faith. No verdict changed — but the _method_ was wrong, invisibly, and **only the
|
|
||||||
> disagreement between two counts surfaced it.**
|
|
||||||
>
|
|
||||||
> The reason it survived: **a summary that resembles an enumeration is more dangerous than one that
|
|
||||||
> obviously summarises.** A labelled list of named steps with states _looks_ like the artifact, so nobody
|
|
||||||
> checks it against the record. Compare D-24 — `mergeable` was a _true answer to a different question_;
|
|
||||||
> this was a _true answer to a smaller one_. Neither is a lie; both pass every sniff test.
|
|
||||||
>
|
|
||||||
> **Operationally:** where a step _produces evidence a decision rests on_, have it produced twice by
|
|
||||||
> different means, and treat **any divergence as a finding rather than as noise to reconcile**. Prefer the
|
|
||||||
> machine-readable record over the human-readable rendering — _read the artifact, not the summary_ — and
|
|
||||||
> state the counts observed so a divergence is detectable at all.
|
|
||||||
|
|
||||||
## Decision record (authoritative, immutable)
|
## Decision record (authoritative, immutable)
|
||||||
|
|
||||||
- **15/15 proposals decided: 13 accept, 2 modify (P-AUTHORITY-001, P-INBOX-001), 0 reject.**
|
- **15/15 proposals decided: 13 accept, 2 modify (P-AUTHORITY-001, P-INBOX-001), 0 reject.**
|
||||||
- Site + `annotations.json`: `jarvis-brain/docs/postmortem-spec/site/` (committed, origin/main).
|
- Site + `annotations.json`: `jarvis-brain/docs/postmortem-spec/site/` (committed, origin/main).
|
||||||
- Discussion checkpoint (rich rationale per proposal): `jarvis-brain/docs/scratchpads/postmortem/REMEDIATION-DISCUSSION-STATE.md`.
|
- Discussion checkpoint (rich rationale per proposal): `jarvis-brain/docs/scratchpads/postmortem/REMEDIATION-DISCUSSION-STATE.md`.
|
||||||
- Postmortem report: mosaicstack/stack PR #107 (merged 88f4ee04).
|
- Postmortem report: mosaicstack/stack PR #107 (merged 88f4ee04).
|
||||||
- MACP wiring scout (verdict c=STRANDED): [`MACP-WIRING-SCOUT.md`](./MACP-WIRING-SCOUT.md) (copied into this dir; TODO discharged). Its findings are sound; its _recommended wire-in point_ is superseded by DECISION-1.
|
- MACP wiring scout (verdict c=STRANDED): `/tmp/macp-wiring-investigation.md` (copy into this dir — see TODO).
|
||||||
|
|
||||||
## The plan — 15 proposals collapse to 4 builds + hygiene
|
## The plan — 15 proposals collapse to 4 builds + hygiene
|
||||||
|
|
||||||
| Build | Absorbs | What it is |
|
| Build | Absorbs | What it is |
|
||||||
| ------------------------------------------------------------ | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
| ------------------------------------------------------------ | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||||
| **1. One choke-point service** (mechanical enforcer) | MISSION, STATE, AUDIT, WRAPPER, QUEUE | Deterministic program every task/data mutation flows through. **Wire the stranded `@mosaicstack/macp`** — typed tasks, gate-runner, event ledger, credential binding, tri-state write outcomes. ⚠ **Target CORRECTED 2026-07-31 (DECISION-1, Mos):** a new production Node `TaskExecutor` on the **live** dispatch path (`packages/mosaic` launch + `packages/coord`), which Coord/Forge/live-dispatch submit through. **NOT** `mosaic_orchestrator.py::run_single_task` — that controller is `"enabled": false` and references a dispatcher absent from this checkout; wiring it would strand the executor, reproducing this mission's own disease. The Python rail is **deleted**, not ported. Both planners reached this independently. |
|
| **1. One choke-point service** (mechanical enforcer) | MISSION, STATE, AUDIT, WRAPPER, QUEUE | Deterministic program every task/data mutation flows through. **Wire the stranded `@mosaicstack/macp`** in at `mosaic_orchestrator.py::run_single_task` — typed tasks, gate-runner, event ledger, credential binding, tri-state write outcomes. |
|
||||||
| **2. One durable spine + hot path** | (storage under everything) | **PG system-of-record + Redis hot queue** (transactional-outbox). Mission/tasks/state-claims/audit-ledger/comms-inbox all land here. |
|
| **2. One durable spine + hot path** | (storage under everything) | **PG system-of-record + Redis hot queue** (transactional-outbox). Mission/tasks/state-claims/audit-ledger/comms-inbox all land here. |
|
||||||
| **3. Rotation lifecycle** (finish the Mission Control Plane) | LIFECYCLE, CONTRACT, GUIDE, RECOVERY | Coordinator daemon: contract-hash binding, compaction-detected → rotate-not-compact, checkpoint→fresh-session→rehydrate, broker-independent recovery. Deterministic, not an LLM. Reuse `packages/coord`; existing PRD at `docs/mission-control/`. |
|
| **3. Rotation lifecycle** (finish the Mission Control Plane) | LIFECYCLE, CONTRACT, GUIDE, RECOVERY | Coordinator daemon: contract-hash binding, compaction-detected → rotate-not-compact, checkpoint→fresh-session→rehydrate, broker-independent recovery. Deterministic, not an LLM. Reuse `packages/coord`; existing PRD at `docs/mission-control/`. |
|
||||||
| **4. Comms service** | AUTHORITY, INBOX (+ versioning roadmap) | Envelope (comms/v1) → sole-path service → PG/Redis → pluggable adapters (tmux→Matrix/Discord/Slack/Telegram). Version the protocol, not participants. |
|
| **4. Comms service** | AUTHORITY, INBOX (+ versioning roadmap) | Envelope (comms/v1) → sole-path service → PG/Redis → pluggable adapters (tmux→Matrix/Discord/Slack/Telegram). Version the protocol, not participants. |
|
||||||
| **+ Hygiene & proof** | FLEET, WORKFLOW, CONFORMANCE | One roster-owned socket/host + stale GC; allowlist auto-sync; the conformance harness that fault-injects the failure classes and proves builds 1–4 hold. |
|
| **+ Hygiene & proof** | FLEET, WORKFLOW, CONFORMANCE | One roster-owned socket/host + stale GC; allowlist auto-sync; the conformance harness that fault-injects the failure classes and proves builds 1–4 hold. |
|
||||||
|
|
||||||
## Why Builds 1–2 are necessary — two independent impossibility proofs
|
|
||||||
|
|
||||||
**The choke-point executor and PG spine are not a design preference. They are forced.** Twice during
|
|
||||||
the mission's own first deliveries, work stopped against a security property that **cannot exist** at
|
|
||||||
the layer that needed it — and both times the only resolution was an authority _outside_ the audited
|
|
||||||
party's control, which is precisely what Builds 1–2 provide.
|
|
||||||
|
|
||||||
| | the audited party controls… | so what fails | found as |
|
|
||||||
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | --------------- | -------- |
|
|
||||||
| **Artifact integrity** | the manifest that certifies its own generated tree (same-UID write ⇒ regenerate manifest _and_ marker consistently, CWE-345) | tamper-evidence | **D-19** |
|
|
||||||
| **Execution integrity** | the code that enters the sandbox (PR-controlled config executes _before_ the boundary exists) | isolation | **D-25** |
|
|
||||||
|
|
||||||
Both reduce to one sentence:
|
|
||||||
|
|
||||||
> **Self-verification by the audited party is not verification.**
|
|
||||||
|
|
||||||
And to one consequence: **the anchor must live outside the audited party's authority.** A local check
|
|
||||||
cannot defend against an actor who can rewrite the check; a repo cannot grant a capability to
|
|
||||||
PR-controlled config and simultaneously prevent that config from using it.
|
|
||||||
|
|
||||||
**An architecture forced by two independent impossibility proofs is stronger evidence than one argued
|
|
||||||
for.** Neither proof was sought — both arrived while trying to ship something else, from different
|
|
||||||
directions (a symlink manifest; a CI sandbox), at different layers. RM-59 and RM-60 are the two tracked
|
|
||||||
dependencies this creates, and they are the same dependency in different clothes.
|
|
||||||
|
|
||||||
## The finding that sets the cost
|
## The finding that sets the cost
|
||||||
|
|
||||||
@@ -236,7 +37,6 @@ orphaned context loader, a fail-open bypass. **Work = wire + consolidate + retir
|
|||||||
## Sequencing (skeleton — adversarial decomposition refines this)
|
## Sequencing (skeleton — adversarial decomposition refines this)
|
||||||
|
|
||||||
1. **Spine + choke-point service** (builds 1+2) — foundation; unlocks MISSION/STATE/AUDIT/WRAPPER/QUEUE at one integration point.
|
1. **Spine + choke-point service** (builds 1+2) — foundation; unlocks MISSION/STATE/AUDIT/WRAPPER/QUEUE at one integration point.
|
||||||
(Per DECISION-1, a P0 phase of provable-gate + activation work precedes this; see `TASKS.md` §3.)
|
|
||||||
2. **Rotation daemon** (build 3) on that spine — the drift fix proper.
|
2. **Rotation daemon** (build 3) on that spine — the drift fix proper.
|
||||||
3. **Comms service** (build 4) — envelope → service → PG/Redis → adapters; retire direct-tmux.
|
3. **Comms service** (build 4) — envelope → service → PG/Redis → adapters; retire direct-tmux.
|
||||||
4. **Hygiene + conformance** (build 5) — fleet convergence, allowlist sync, dogfood harness.
|
4. **Hygiene + conformance** (build 5) — fleet convergence, allowlist sync, dogfood harness.
|
||||||
@@ -250,11 +50,6 @@ orphaned context loader, a fail-open bypass. **Work = wire + consolidate + retir
|
|||||||
(WRAPPER), auto-sync sweep (WORKFLOW), #1018 stale-consumed (INBOX). The fleet is its own test bed.
|
(WRAPPER), auto-sync sweep (WORKFLOW), #1018 stale-consumed (INBOX). The fleet is its own test bed.
|
||||||
- **Orchestration tracking → DB**, hard cutover ("rip off the bandaid"), NO flat-file interim. jarvis-brain
|
- **Orchestration tracking → DB**, hard cutover ("rip off the bandaid"), NO flat-file interim. jarvis-brain
|
||||||
PDA flat-files untouched. Current flat-file tracking runs as-is/unhardened until DB tracking is real, then one clean replace.
|
PDA flat-files untouched. Current flat-file tracking runs as-is/unhardened until DB tracking is real, then one clean replace.
|
||||||
- ⚠ **QUALIFIED 2026-07-31 (DECISION-2, Mos):** the DB spine **must NOT be a single-point hard-stop.**
|
|
||||||
A broker-independent / degraded mode **and** a rehearsed rollback artifact are **design requirements**
|
|
||||||
(P-RECOVERY-001), binding now on RM-12, RM-13, RM-23, RM-36 and RM-53. This **supersedes** the earlier
|
|
||||||
orchestrator recommendation to pre-commit "no DB ⇒ the fleet stops" — that answer is _not_ on record.
|
|
||||||
Only the specific availability _target_ remains open, queued for Jason; it does **not** block current work.
|
|
||||||
|
|
||||||
## The 15 decisions (one-line; full rationale in the checkpoint)
|
## The 15 decisions (one-line; full rationale in the checkpoint)
|
||||||
|
|
||||||
@@ -279,29 +74,6 @@ orphaned context loader, a fail-open bypass. **Work = wire + consolidate + retir
|
|||||||
- **Project orchestrator** `mos-remediation` (this seat) owns the mission; coordinates under Mos (lead).
|
- **Project orchestrator** `mos-remediation` (this seat) owns the mission; coordinates under Mos (lead).
|
||||||
- **Adversarial task decomposition:** `planner-opus` (robustness) + `planner-sol` (pragmatic) each decompose
|
- **Adversarial task decomposition:** `planner-opus` (robustness) + `planner-sol` (pragmatic) each decompose
|
||||||
the plan independently; orchestrator reconciles into `TASKS.md`/DB tasks. Oppositional by design.
|
the plan independently; orchestrator reconciles into `TASKS.md`/DB tasks. Oppositional by design.
|
||||||
- **Delivery gates — REFERENCE, do not restate.** The authoritative definitions live at
|
- **Delivery gates (non-negotiable):** author≠reviewer, PRE-REGISTERED diff-blind acceptance checks committed
|
||||||
[`~/.config/mosaic/fleet/roles.local/merge-gate.md`](file:///home/hermes/.config/mosaic/fleet/roles.local/merge-gate.md)
|
before reading the diff, CI terminal-green, completion = merged PR + closed issue. rev-974 = mosaicstack reviewer.
|
||||||
(verdict authority) and
|
|
||||||
[`~/.config/mosaic/fleet/roles/validator.md`](file:///home/hermes/.config/mosaic/fleet/roles/validator.md)
|
|
||||||
(validator/certificate role). **Read them; do not paraphrase them.** Restating an authoritative source
|
|
||||||
is lossy every time — see D-26, where a subset restated from memory dropped a security precondition.
|
|
||||||
|
|
||||||
**Gate order** (the sequence only; the definitions are in the files above):
|
|
||||||
1. Independent review, **author ≠ reviewer** (`rev-974` on mosaicstack), with PRE-REGISTERED diff-blind
|
|
||||||
acceptance checks committed before the diff is read
|
|
||||||
2. Remediation of findings
|
|
||||||
3. **CI terminal-green** at the exact full-40 head, by **full step scan**
|
|
||||||
4. **Merge-gate verdict — `GO` / `NO-GO` / `HOLD`** (class `merge-gate`; "Ultron" is an _instance name_,
|
|
||||||
display data, never an authority source). **Bound to a commit and VOID the instant the head moves.**
|
|
||||||
`HOLD` persists until replaced; a `NO-GO` answered by an empty commit must be re-issued as `NO-GO`.
|
|
||||||
Posted durably on the PR under the gate's own minted identity, **enumerating** its evidence — a bare
|
|
||||||
"GO — gates verified" is non-conforming.
|
|
||||||
5. **Coordinator merge**, head-pinned. The gate never merges; it holds `push=False` by design.
|
|
||||||
|
|
||||||
⚠ **The CI queue guard runs but is ZERO-INFORMATION until RM-03 lands** (D-23: it returns pass for every
|
|
||||||
possible input). It must not be cited as evidence by any gate, including the coordinator's own merge path.
|
|
||||||
|
|
||||||
**Assignment:** the coordinator assigns the merge-gate seat; the orchestrator does not. The orchestrator
|
|
||||||
owns getting a PR _gate-ready_.
|
|
||||||
|
|
||||||
- **Compaction survival:** see `KICKSTART.md` in this dir — the resume procedure. Persist typed state, not transcript.
|
- **Compaction survival:** see `KICKSTART.md` in this dir — the resume procedure. Persist typed state, not transcript.
|
||||||
|
|||||||
+11
-2054
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user