docs(remediation): mission charter + reconciled execution backlog #1026

2026-07-31T22:11:25Z

mos-dt-0 commented

2026-07-31 22:11:25 +00:00

Docs-only. Stacked on #1025 — its diff here is documentation exclusively. Retarget to main
once #1025 merges.

What

The durable mission record for the postmortem remediation, plus the reconciled execution backlog.

MISSION.md / KICKSTART.md / MACP-WIRING-SCOUT.md — charter, 15 decisions, 4-build plan,
compaction-survival resume procedure.
BOARD.md — live orchestrator state (kept under an 8 KB cap).
DECOMP-OPUS.md + DECOMP-SOL.md — two independent adversarial decompositions.
TASKS.md — the reconciled 58-task backlog across P0-P5.

Why both decompositions are committed

planner-opus (robustness bias) and planner-sol (pragmatic bias) each decomposed the plan without
seeing the other's output. Both raw decomps are committed alongside the reconciliation so the
disagreements remain auditable instead of being flattened into a false consensus.

Where they converged independently, the conclusion is treated as settled — neither could see the
other, so agreement is real signal. Where they conflicted, the conflict is adjudicated in writing
with a stated rationale, not averaged. Their cost estimates are ~18x apart; rather than split the
difference, the plan adopts sol's scope with opus's rigor and makes first-dogfood a hard budget
checkpoint.

The headline: both planners reject the charter's own wire-in point

The charter names mosaic_orchestrator.py::run_single_task as the integration point for the choke
point. Both planners independently rejected it on the same evidence: that controller is
"enabled": false and references a dispatcher path absent from this checkout. Wiring a new choke
point into a disabled rail yields a stranded executor — the same built-but-unwired disease one layer
up, which would look "done" in a PR.

The charter text is deliberately left unchanged in this PR and the conflict is escalated as
DECISION-1. An orchestrator should not silently rewrite its own charter.

Open decisions (dispatch is blocked on these, by design)

DECISION-1 — the wire-in point above (Mos/Jason; changes the charter).
DECISION-2 — does "hard cutover, no interim" permit a rehearsed rollback snapshot, and do we
pre-commit in writing to "no DB means the fleet stops"? (Jason; real availability trade.)
DECISION-3 — queue-guard ownership vs. the parked PR #1023 (Mos; two lanes can claim it).

No task blocked on these is dispatched until they are ruled.

Verification

All three gates green with no bypass: pnpm typecheck 42/42, pnpm lint 23/23,
pnpm format:check clean.

**Docs-only.** Stacked on #1025 — its diff here is documentation exclusively. Retarget to `main` once #1025 merges. ## What The durable mission record for the postmortem remediation, plus the reconciled execution backlog. - `MISSION.md` / `KICKSTART.md` / `MACP-WIRING-SCOUT.md` — charter, 15 decisions, 4-build plan, compaction-survival resume procedure. - `BOARD.md` — live orchestrator state (kept under an 8 KB cap). - `DECOMP-OPUS.md` + `DECOMP-SOL.md` — two **independent** adversarial decompositions. - `TASKS.md` — the reconciled 58-task backlog across P0-P5. ## Why both decompositions are committed `planner-opus` (robustness bias) and `planner-sol` (pragmatic bias) each decomposed the plan without seeing the other's output. Both raw decomps are committed alongside the reconciliation so the disagreements remain auditable instead of being flattened into a false consensus. Where they converged independently, the conclusion is treated as settled — neither could see the other, so agreement is real signal. Where they conflicted, the conflict is **adjudicated in writing with a stated rationale**, not averaged. Their cost estimates are ~18x apart; rather than split the difference, the plan adopts sol's scope with opus's rigor and makes first-dogfood a hard budget checkpoint. ## The headline: both planners reject the charter's own wire-in point The charter names `mosaic_orchestrator.py::run_single_task` as the integration point for the choke point. Both planners independently rejected it on the same evidence: that controller is `"enabled": false` and references a dispatcher path absent from this checkout. Wiring a new choke point into a disabled rail yields a stranded executor — the same built-but-unwired disease one layer up, which would look "done" in a PR. The charter text is deliberately left **unchanged** in this PR and the conflict is escalated as DECISION-1. An orchestrator should not silently rewrite its own charter. ## Open decisions (dispatch is blocked on these, by design) 1. **DECISION-1** — the wire-in point above (Mos/Jason; changes the charter). 2. **DECISION-2** — does "hard cutover, no interim" permit a rehearsed rollback snapshot, and do we pre-commit in writing to "no DB means the fleet stops"? (Jason; real availability trade.) 3. **DECISION-3** — queue-guard ownership vs. the parked PR #1023 (Mos; two lanes can claim it). No task blocked on these is dispatched until they are ruled. ## Verification All three gates green with no bypass: `pnpm typecheck` 42/42, `pnpm lint` 23/23, `pnpm format:check` clean.

mos-dt-0 changed target branch from fix/hygiene-inert-format-gate to main

2026-07-31 22:25:00 +00:00

mos-dt-0 added 7 commits 2026-07-31 22:25:34 +00:00

docs(remediation): mission charter + kickstart + live board for the postmortem remediation 28f1e272fe

15/15 proposals decided (13 accept, 2 modify). Collapses to 4 builds + hygiene on one
PG spine + choke-point service. Durable mission record for the mos-remediation project
orchestrator; compaction-survival resume in KICKSTART.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_018XCrpMFmCAXbtSQtQAhDth

docs(remediation): board reflects actual state + 4 dogfood findings from startup 4fcbf7c07e

Corrects the premature "DISPATCHED" planner line (per Mos): both planners are now
dispatched for real on GUARANTEED-clean context, not requested-clean.

Records Mos rulings: mission.json is retired-rail residue (do not invest); gate-16
holds on interim mos-dt-0 since rev-974 reviews; remote-control path is Mos-relay.

Captures 4 live failure classes observed while standing this seat up (D-1..D-4),
including an agent that silently ignored an in-message context reset — direct
evidence for the postmortem thesis that instructions are not enforcement.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): reconciled execution backlog from two independent decompositions ba98f88891

TASK-1 complete. planner-opus (robustness, 38 tasks/8 dissents) and planner-sol
(pragmatic, 25 tasks/10 defers/7 dissents) each decomposed the 4-build plan without
seeing the other's work. Both decomps are committed alongside the reconciliation so
the disagreements stay auditable rather than being flattened into a consensus.

Reconciled into 58 tasks across P0-P5 (docs/remediation/TASKS.md):
- 7 independent convergences, treated as settled because neither planner could see
  the other. The headline: BOTH reject the charter's wire-in point
  (mosaic_orchestrator.py::run_single_task) because that controller is disabled and
  references a dispatcher absent from this checkout — wiring it would produce a
  stranded executor, the same built-but-unwired disease one layer up.
- 7 genuine disagreements ADJUDICATED, not averaged. The cost estimates are ~18x
  apart; rather than split the difference, the plan adopts sol's scope with opus's
  rigor and treats the first-dogfood gate as a hard budget checkpoint.
- 3 decisions escalated (wire-in point, rollback artifact + availability trade,
  queue-guard ownership vs parked PR #1023). No task blocked on them is dispatched.

Keystone dogfood case recorded (TASKS.md 1a): merged PR #868 shipped a file failing
pnpm format:check, then an unrelated PR reformatted it as a side effect, so main went
green and the gate's failure to fire left no trace. Detection must therefore be
per-merge-commit against that commit's own tree.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): board — PRs #1025/#1026 open, review dispatched, D-6 queue-guard finding d4f68040ab

Third independent live instance of the inert-gate class this session: the mandated
ci-queue-wait.sh returned exit 0 on state=unknown while guarding a push.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): apply Mos rulings on D-1/D-2/D-3; bank D-7 tmpfs ENOSPC 1324385bba

D-1 RULED — corrected wire-in target is a new production Node TaskExecutor on the
LIVE dispatch path (packages/mosaic launch + packages/coord) that Coord/Forge/live
dispatch submit through. The Python rail is deleted, not ported. RM-21/26/27/52 updated.

D-2 — Jason-pending and explicitly NON-blocking. Binding meanwhile: the DB spine must
not be a single-point hard-stop; degraded mode + rollback artifact become design
requirements on RM-12/13/23/36/53. This reverses the earlier recommendation to
pre-commit 'no DB means the fleet stops'.

D-3 — RM-03 HOLD; PR #1023 marked SUPERSEDED-PENDING-JASON; RM-02/RM-55 proceed
independently since conformance assertion is not the gate-6 fix itself.

RM-03 now carries BOTH queue-guard defects: wrong exit on unknown, and evaluating
branch=main rather than the branch being pushed.

D-7 — shared 30G /tmp hit 100% ENOSPC, degrading two seats. ~5.2G of it is session
scratch dead for 8-9 days; this session's own footprint is 88K. Same missing
capability as P-FLEET-001 stale-session GC, applied to disk. Folded into RM-50, and
RM-01 gains artifacts-off-shared-tmp acceptance criteria.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): status — decisions ruled, RM-01 in flight 910b6f4166

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): D-7 reaper doctrine into RM-50; adopt board-roll for the LIVE board

ci/woodpecker/pr/ci Pipeline was canceled

Details

fb3221af27

D-7 resolution recorded. Mos verified attribution independently and reaped ~5.2G of
dead-session scratch as lead coordinator. The finding is the gap it exposed: the
authority to reap exists, the deterministic reaper does not.

Two doctrine points now binding on RM-50: (1) 'agents should tidy up' is
instructions-are-not-enforcement wearing another hat — a reaper must own it;
(2) refusing to unilaterally delete another session's scratch was correct, and the
fix is mechanically-decidable ownership/liveness, not braver deletion. Reaper
requirements specified: mechanical liveness (not mtime alone), age threshold,
dry-run, audit event per reap — never a heuristic sweep, which would reintroduce
the P-WORKFLOW-001 auto-sync failure in a more destructive form.

Board restructured into an explicit BOARD-ROLL zone and rolled with the framework's
own board-roll.sh (8432B -> 8014B, D-1 archived to BOARD-LEDGER.md) rather than
hand-trimmed. The tool exists precisely to stop coordinators hand-trimming; using it
is the dogfood.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

mos-dt-0 force-pushed remediation/mission-setup from db051f06f1 to fb3221af27

2026-07-31 22:25:34 +00:00

Compare

mos-dt-0 added 1 commit 2026-07-31 22:26:29 +00:00

docs(remediation): bank D-8 — a pre-registered check that was not runnable as written

ci/woodpecker/pr/ci Pipeline was canceled

Details

f8b65463ab

PR #1025's AC2 fixture (mkdir -p apps/*/venv/lib) does not do what it claims when the
glob is unmatched. rev-974 ran it exactly as written, caught the defect, re-ran the
intended assertion at an explicit path, and DISCLOSED the substitution rather than
silently reporting PASS.

Pre-registration protects a check from being retrofitted to the implementation. It
does not make the check correct. An unverified gate appeared inside the mechanism
built to catch unverified gates.

Requirement added to RM-02: the registry must self-verify that every registered case
actually runs and can actually fail — presence in the registry is not evidence.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

mos-dt-0 added 1 commit 2026-07-31 22:27:43 +00:00

docs(remediation): board — #1025 merged, D-8 banked, phase EXECUTING

ci/woodpecker/pr/ci Pipeline was canceled

Details

27350d9f8d

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

mos-dt-0 added 1 commit 2026-07-31 22:29:19 +00:00

docs(remediation): sharpen D-8 — the conformance harness must itself be conformance-tested

ci/woodpecker/pr/ci Pipeline was successful

Details

b705a4dae9

Per Mos. Two requirements, both load-bearing:

RM-02: the gate registry must SELF-VERIFY that every registered case demonstrably
runs and demonstrably fails on a known-bad input. Presence in the registry is not
evidence. A check is not trusted until it has been shown to fail. This is mutation
testing / negative control at the registry level — the conformance harness must
itself be conformance-tested. RM-55 inherits the same recursion: the harness must be
observed red before its green means anything.

Reviewer disclosure: rev-974 could have silently substituted a working fixture and
reported AC2 PASS, and nothing would have caught it. The 'if a check is unrunnable,
say so rather than silently substituting' clause is what makes a PASS mean anything,
and must appear in every reviewer brief this mission issues.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Mos merged commit 01e966f36d into main

2026-07-31 22:47:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1026