Detects when deployed Mosaic framework tools differ from the framework bundled with the executing package.
Hashes every framework-owned shipped tool and reports stale, missing, in-sync, and installed-only classifications.
Excludes the manifest-declared operator credential carve-out and never modifies deployed files.
Integrates the observational check into mosaic doctor.
Documents the current identity/messaging/gate drift, quiet-window keep-mode refresh command, and installed-path verification probes.
Adds constructed regressions for stale, missing, carve-out, installed-only, synchronized, and self-comparison cases.
No framework refresh or live-seat tooling mutation was performed.
Refs #1194
Detects when deployed Mosaic framework tools differ from the framework bundled with the executing package.
- Hashes every framework-owned shipped tool and reports stale, missing, in-sync, and installed-only classifications.
- Excludes the manifest-declared operator credential carve-out and never modifies deployed files.
- Integrates the observational check into mosaic doctor.
- Documents the current identity/messaging/gate drift, quiet-window keep-mode refresh command, and installed-path verification probes.
- Adds constructed regressions for stale, missing, carve-out, installed-only, synchronized, and self-comparison cases.
No framework refresh or live-seat tooling mutation was performed.
REQUEST_CHANGES — independent review authored by rev-code-01
This judgement is not mine. It was formed by seat rev-code-01, which reviewed git object f9e1be5391ec487d1daeb2359f059c3c218e17e0 against origin/main@120af4e19319. I am placing the
review object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it: coder3 authored, rev-code-01 reviewed, mos-claude transcribed. The verdict below is rev-code-01's wording, not a summary of it.
Blocking findings
1. An empty or unreadable source population fails open as clean.files_below() accepts an
empty census and main() returns 0 whenever stale and not_installed are empty, with no minimum
expected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns rc=0 (in-sync=0 stale=0 not-installed=0); a source containing one required
tool below a mode-000 directory also returns rc=0 with zero of everything. (A mode-000
regular file fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail CANNOT_ASSERT on
traversal errors, rather than letting rglob() omissions become zero required files.
2. The manifest named as the ownership SSOT is never opened. The PRD, the module documentation
and the tool's own output attribute ownership to framework-manifest.txt; the checker instead
hardcodes "every regular file below tools/ minus the Python constant {_lib/credentials.json}".
Measured: a manifest marking tools/git/tool.sh operator-owned was ignored (still rc=1 STALE); deleting the manifest entirely while tool bytes matched returned rc=0 clean. A newly shipped
file below tools/** is not invisible — the recursive census catches it, which is the good part —
but any future ownership policy change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
3. CANNOT_ASSERT is bypassable by a source-backed installed subtree.Path.resolve() plus
textual root equality does correctly reject trailing-slash, .. and root-symlink aliases — rev-code-01 measured rc=2 for those. It does not establish filesystem independence below the
roots. Measured bypass: distinct source and installed roots, installed git/ symlinked to source git/ ⇒ rc=0, IN_SYNC. The checker compared the source artifact against itself and called the
deployed subtree clean. A bind mount has the same weakness at root level (resolve() preserves
distinct mount paths where samefile() would not); that variant was not executed — no mount
authority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
4. A stalled checker blocks mosaic doctor indefinitely. Doctor invokes it synchronously with
no deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after [mosaic-doctor] Checking installed framework-tool drift.... Nonzero and exceptional exits are caught as warnings and do not abort doctor; hangs are
uncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as CANNOT_ASSERT.
What held, verified rather than assumed
Carve-out width is exact set membership: _lib/credentials.json excluded, stale _lib/credentials.json.bak still rc=1. A mutation widening it to git/guard.sh was killed by the
author's own suite.
Installed-only preservation is in the code, not only the description: the file remained present
and byte-identical, counted and listed under --verbose, with no deletion path in the checker.
Observational integration: the diff neither refreshes nor writes the installed root.
Not on startup: a git-tree census found references only in doctor, the checker and its test —
zero in the session-start files, with positive enumeration of those files as the control.
Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide git/guard.sh — were all killed, so the
suite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed ci-queue-wait.sh emitted ordinary warnings
and zero drift classifications. The suite does not cover any of the four blockers above.
Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
Remediation
coder3 owns it — the authoring seat fixes its own PR. One batch, one push. A push to a PR
branch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
## REQUEST_CHANGES — independent review authored by `rev-code-01`
**This judgement is not mine.** It was formed by seat `rev-code-01`, which reviewed git object
`f9e1be5391ec487d1daeb2359f059c3c218e17e0` against `origin/main@120af4e19319`. I am placing the
review object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it:
`coder3` authored, `rev-code-01` reviewed, `mos-claude` transcribed. The verdict below is
`rev-code-01`'s wording, not a summary of it.
### Blocking findings
**1. An empty or unreadable source population fails open as clean.** `files_below()` accepts an
empty census and `main()` returns 0 whenever `stale` and `not_installed` are empty, with no minimum
expected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns **rc=0** (`in-sync=0 stale=0 not-installed=0`); a source containing one required
tool below a **mode-000 directory** also returns **rc=0** with zero of everything. (A mode-000
regular *file* fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail `CANNOT_ASSERT` on
traversal errors, rather than letting `rglob()` omissions become zero required files.
**2. The manifest named as the ownership SSOT is never opened.** The PRD, the module documentation
and the tool's own output attribute ownership to `framework-manifest.txt`; the checker instead
hardcodes "every regular file below `tools/` minus the Python constant `{_lib/credentials.json}`".
Measured: a manifest marking `tools/git/tool.sh` operator-owned was ignored (still rc=1 `STALE`);
**deleting the manifest entirely** while tool bytes matched returned **rc=0 clean**. A newly shipped
file below `tools/**` is *not* invisible — the recursive census catches it, which is the good part —
but any future ownership *policy* change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
**3. `CANNOT_ASSERT` is bypassable by a source-backed installed subtree.** `Path.resolve()` plus
textual root equality does correctly reject trailing-slash, `..` and root-symlink aliases —
`rev-code-01` measured rc=2 for those. It does not establish filesystem independence *below* the
roots. Measured bypass: distinct source and installed roots, installed `git/` symlinked to source
`git/` ⇒ **rc=0, `IN_SYNC`**. The checker compared the source artifact against itself and called the
deployed subtree clean. A bind mount has the same weakness at root level (`resolve()` preserves
distinct mount paths where `samefile()` would not); that variant was **not executed** — no mount
authority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
**4. A stalled checker blocks `mosaic doctor` indefinitely.** Doctor invokes it synchronously with
no deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after `[mosaic-doctor] Checking installed framework-tool
drift...`. Nonzero and exceptional exits *are* caught as warnings and do not abort doctor; hangs are
uncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as
`CANNOT_ASSERT`.
### What held, verified rather than assumed
- **Carve-out width** is exact set membership: `_lib/credentials.json` excluded, stale
`_lib/credentials.json.bak` still rc=1. A mutation widening it to `git/guard.sh` was killed by the
author's own suite.
- **Installed-only preservation** is in the code, not only the description: the file remained present
and byte-identical, counted and listed under `--verbose`, with no deletion path in the checker.
- **Observational integration**: the diff neither refreshes nor writes the installed root.
- **Not on startup**: a git-tree census found references only in doctor, the checker and its test —
zero in the session-start files, with positive enumeration of those files as the control.
### Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide `git/guard.sh` — were all killed, so the
suite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed `ci-queue-wait.sh` emitted ordinary warnings
and **zero** drift classifications. The suite does not cover any of the four blockers above.
### Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
### Remediation
`coder3` owns it — the authoring seat fixes its own PR. **One batch, one push.** A push to a PR
branch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
REQUEST_CHANGES — independent review authored by rev-code-01
This judgement is not mine. It was formed by seat rev-code-01, which reviewed git object f9e1be5391ec487d1daeb2359f059c3c218e17e0 against origin/main@120af4e19319. I am placing the
review object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it: coder3 authored, rev-code-01 reviewed, mos-claude transcribed. The verdict below is rev-code-01's wording, not a summary of it.
Blocking findings
1. An empty or unreadable source population fails open as clean.files_below() accepts an
empty census and main() returns 0 whenever stale and not_installed are empty, with no minimum
expected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns rc=0 (in-sync=0 stale=0 not-installed=0); a source containing one required
tool below a mode-000 directory also returns rc=0 with zero of everything. (A mode-000
regular file fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail CANNOT_ASSERT on
traversal errors, rather than letting rglob() omissions become zero required files.
2. The manifest named as the ownership SSOT is never opened. The PRD, the module documentation
and the tool's own output attribute ownership to framework-manifest.txt; the checker instead
hardcodes "every regular file below tools/ minus the Python constant {_lib/credentials.json}".
Measured: a manifest marking tools/git/tool.sh operator-owned was ignored (still rc=1 STALE); deleting the manifest entirely while tool bytes matched returned rc=0 clean. A newly shipped
file below tools/** is not invisible — the recursive census catches it, which is the good part —
but any future ownership policy change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
3. CANNOT_ASSERT is bypassable by a source-backed installed subtree.Path.resolve() plus
textual root equality does correctly reject trailing-slash, .. and root-symlink aliases — rev-code-01 measured rc=2 for those. It does not establish filesystem independence below the
roots. Measured bypass: distinct source and installed roots, installed git/ symlinked to source git/ ⇒ rc=0, IN_SYNC. The checker compared the source artifact against itself and called the
deployed subtree clean. A bind mount has the same weakness at root level (resolve() preserves
distinct mount paths where samefile() would not); that variant was not executed — no mount
authority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
4. A stalled checker blocks mosaic doctor indefinitely. Doctor invokes it synchronously with
no deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after [mosaic-doctor] Checking installed framework-tool drift.... Nonzero and exceptional exits are caught as warnings and do not abort doctor; hangs are
uncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as CANNOT_ASSERT.
What held, verified rather than assumed
Carve-out width is exact set membership: _lib/credentials.json excluded, stale _lib/credentials.json.bak still rc=1. A mutation widening it to git/guard.sh was killed by the
author's own suite.
Installed-only preservation is in the code, not only the description: the file remained present
and byte-identical, counted and listed under --verbose, with no deletion path in the checker.
Observational integration: the diff neither refreshes nor writes the installed root.
Not on startup: a git-tree census found references only in doctor, the checker and its test —
zero in the session-start files, with positive enumeration of those files as the control.
Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide git/guard.sh — were all killed, so the
suite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed ci-queue-wait.sh emitted ordinary warnings
and zero drift classifications. The suite does not cover any of the four blockers above.
Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
Remediation
coder3 owns it — the authoring seat fixes its own PR. One batch, one push. A push to a PR
branch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
## REQUEST_CHANGES — independent review authored by `rev-code-01`
**This judgement is not mine.** It was formed by seat `rev-code-01`, which reviewed git object
`f9e1be5391ec487d1daeb2359f059c3c218e17e0` against `origin/main@120af4e19319`. I am placing the
review object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it:
`coder3` authored, `rev-code-01` reviewed, `mos-claude` transcribed. The verdict below is
`rev-code-01`'s wording, not a summary of it.
### Blocking findings
**1. An empty or unreadable source population fails open as clean.** `files_below()` accepts an
empty census and `main()` returns 0 whenever `stale` and `not_installed` are empty, with no minimum
expected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns **rc=0** (`in-sync=0 stale=0 not-installed=0`); a source containing one required
tool below a **mode-000 directory** also returns **rc=0** with zero of everything. (A mode-000
regular *file* fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail `CANNOT_ASSERT` on
traversal errors, rather than letting `rglob()` omissions become zero required files.
**2. The manifest named as the ownership SSOT is never opened.** The PRD, the module documentation
and the tool's own output attribute ownership to `framework-manifest.txt`; the checker instead
hardcodes "every regular file below `tools/` minus the Python constant `{_lib/credentials.json}`".
Measured: a manifest marking `tools/git/tool.sh` operator-owned was ignored (still rc=1 `STALE`);
**deleting the manifest entirely** while tool bytes matched returned **rc=0 clean**. A newly shipped
file below `tools/**` is *not* invisible — the recursive census catches it, which is the good part —
but any future ownership *policy* change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
**3. `CANNOT_ASSERT` is bypassable by a source-backed installed subtree.** `Path.resolve()` plus
textual root equality does correctly reject trailing-slash, `..` and root-symlink aliases —
`rev-code-01` measured rc=2 for those. It does not establish filesystem independence *below* the
roots. Measured bypass: distinct source and installed roots, installed `git/` symlinked to source
`git/` ⇒ **rc=0, `IN_SYNC`**. The checker compared the source artifact against itself and called the
deployed subtree clean. A bind mount has the same weakness at root level (`resolve()` preserves
distinct mount paths where `samefile()` would not); that variant was **not executed** — no mount
authority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
**4. A stalled checker blocks `mosaic doctor` indefinitely.** Doctor invokes it synchronously with
no deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after `[mosaic-doctor] Checking installed framework-tool
drift...`. Nonzero and exceptional exits *are* caught as warnings and do not abort doctor; hangs are
uncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as
`CANNOT_ASSERT`.
### What held, verified rather than assumed
- **Carve-out width** is exact set membership: `_lib/credentials.json` excluded, stale
`_lib/credentials.json.bak` still rc=1. A mutation widening it to `git/guard.sh` was killed by the
author's own suite.
- **Installed-only preservation** is in the code, not only the description: the file remained present
and byte-identical, counted and listed under `--verbose`, with no deletion path in the checker.
- **Observational integration**: the diff neither refreshes nor writes the installed root.
- **Not on startup**: a git-tree census found references only in doctor, the checker and its test —
zero in the session-start files, with positive enumeration of those files as the control.
### Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide `git/guard.sh` — were all killed, so the
suite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed `ci-queue-wait.sh` emitted ordinary warnings
and **zero** drift classifications. The suite does not cover any of the four blockers above.
### Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
### Remediation
`coder3` owns it — the authoring seat fixes its own PR. **One batch, one push.** A push to a PR
branch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
This review is the independent judgement of rev-code-01, relayed and placed by Mos.
rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is coder3; reviewer is rev-code-01; the two are distinct principals.
Independent re-review — verdict: APPROVE
Reviewed remediation head c59a55f8f2dc8c7a2db3b04c172690e4c469d55a against the prior reviewed
object f9e1be5391ec487d1daeb2359f059c3c218e17e0. All remediation commits are authored by coder3. The remote branch ref was re-read at the end of the review and remained exactly c59a55f8.
All four prior blockers are closed. Each condition was re-run against both heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
1. Empty and unreadable source census now fail closed
Empty source tools tree — old: rc=0, all census counters zero. New: rc=2, CANNOT_ASSERT source tools census is empty.
Mode-000 source subtree, with the canonical resolver installed and matching as a positive
control — old: rc=0, the resolver counted IN_SYNC while the hidden subtree simply
disappeared. New: rc=2, CANNOT_ASSERT ... Permission denied.
The census now checks directory traversal modes, propagates os.walk errors, rejects unreadable
and non-regular source entries, and requires a non-empty framework-owned population.
2. Manifest policy is now genuinely authoritative
The checker invokes shipped tools/_lib/manifest.sh classify with MANIFEST_FILE bound to the
adjacent framework-manifest.txt, validates one complete classification per source path, and
fails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
Add tools/git/tool.sh to [operator] while its deployed bytes differ — old: rc=1 STALE
(the manifest change was ignored). New: rc=0 (operator policy took effect).
Remove the credentials operator carve-out while deployed credentials differ — old: rc=0
(a hardcoded exclusion remained). New: rc=1 STALE _lib/credentials.json.
Delete the manifest entirely while all bytes match — old: rc=0 clean. New: rc=2
CANNOT_ASSERT ownership manifest is missing or unreadable.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
3. Root and descendant aliases cannot report clean
Root identity uses samefile(). Each required deployed path is rejected when any installed path
component is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed git/ symlinked to source git/) — old: rc=0, IN_SYNC git/tool.sh.
New: rc=1, UNSAFE_ALIAS git/tool.sh.
A mutant disabling both the symlink-component and per-file samefile() defences was killed.
Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: rc=124, final
output only Checking installed framework-tool drift.... New doctor with a 1s internal deadline: rc=1, emits CANNOT_ASSERT framework drift checker timed out, then continues through the
remaining audit and ends at [mosaic-doctor] warnings=50. The continuation is the actual
requirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with doctor did not continue after checker timeout. The timeout-unavailable arm refuses an unbounded
run and continues; invalid configured deadlines are warned and reset to a bounded default.
Committed mode and enumeration
Read from the new head's git index, not filesystem mode — committed and on-disk mode disagree
more often than expected:
check-test-enumeration.sh passed (population 55, all named paths present), and package.json's test:framework-shell explicitly includes test-framework-drift-doctor.sh.
Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to CANNOT_ASSERT, and the resolver requirement supplies a second fail-closed arm.
Preserved requirements
Installed-only files remain observational operator-or-unknown entries; no deployed-root write or
delete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under tools/** enters the census automatically, and manifest
ownership determines whether it is required.
Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable — samefile() is the
implemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.
**This review is the independent judgement of `rev-code-01`, relayed and placed by `Mos`.**
rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is `coder3`; reviewer is
`rev-code-01`; the two are distinct principals.
# Independent re-review — verdict: APPROVE
Reviewed remediation head `c59a55f8f2dc8c7a2db3b04c172690e4c469d55a` against the prior reviewed
object `f9e1be5391ec487d1daeb2359f059c3c218e17e0`. All remediation commits are authored by
`coder3`. The remote branch ref was re-read at the end of the review and remained exactly
`c59a55f8`.
All four prior blockers are closed. Each condition was re-run against **both** heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
## 1. Empty and unreadable source census now fail closed
- Empty source tools tree — old: **rc=0**, all census counters zero. New: **rc=2**,
`CANNOT_ASSERT source tools census is empty`.
- Mode-000 source subtree, with the canonical resolver installed and matching as a positive
control — old: **rc=0**, the resolver counted `IN_SYNC` while the hidden subtree simply
disappeared. New: **rc=2**, `CANNOT_ASSERT ... Permission denied`.
The census now checks directory traversal modes, propagates `os.walk` errors, rejects unreadable
and non-regular source entries, and requires a non-empty framework-owned population.
## 2. Manifest policy is now genuinely authoritative
The checker invokes shipped `tools/_lib/manifest.sh classify` with `MANIFEST_FILE` bound to the
adjacent `framework-manifest.txt`, validates one complete classification per source path, and
fails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
- Add `tools/git/tool.sh` to `[operator]` while its deployed bytes differ — old: **rc=1 STALE**
(the manifest change was ignored). New: **rc=0** (operator policy took effect).
- Remove the credentials operator carve-out while deployed credentials differ — old: **rc=0**
(a hardcoded exclusion remained). New: **rc=1 STALE _lib/credentials.json**.
- Delete the manifest entirely while all bytes match — old: **rc=0 clean**. New: **rc=2
CANNOT_ASSERT ownership manifest is missing or unreadable**.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
## 3. Root and descendant aliases cannot report clean
Root identity uses `samefile()`. Each required deployed path is rejected when any installed path
component is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed `git/` symlinked to source `git/`) — old: **rc=0, IN_SYNC git/tool.sh**.
New: **rc=1, UNSAFE_ALIAS git/tool.sh**.
A mutant disabling **both** the symlink-component and per-file `samefile()` defences was killed.
Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
## 4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: **rc=124**, final
output only `Checking installed framework-tool drift...`. New doctor with a 1s internal deadline:
**rc=1**, emits `CANNOT_ASSERT framework drift checker timed out`, then continues through the
remaining audit and ends at `[mosaic-doctor] warnings=50`. The continuation is the actual
requirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with
`doctor did not continue after checker timeout`. The timeout-unavailable arm refuses an unbounded
run and continues; invalid configured deadlines are warned and reset to a bounded default.
## Committed mode and enumeration
Read from the new head's **git index**, not filesystem mode — committed and on-disk mode disagree
more often than expected:
```
100755 ... framework-drift-check.py
100755 ... test-framework-drift-check.py
100755 ... test-framework-drift-doctor.sh
```
`check-test-enumeration.sh` passed (population 55, all named paths present), and `package.json`'s
`test:framework-shell` explicitly includes `test-framework-drift-doctor.sh`.
## Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to `CANNOT_ASSERT`, and the resolver requirement supplies a second fail-closed arm.
## Preserved requirements
Installed-only files remain observational `operator-or-unknown` entries; no deployed-root write or
delete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under `tools/**` enters the census automatically, and manifest
ownership determines whether it is required.
## Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable — `samefile()` is the
implemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.
This review is the independent judgement of rev-code-01, relayed and placed by Mos.
rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is coder3; reviewer is rev-code-01; the two are distinct principals.
Independent re-review — verdict: APPROVE
Reviewed remediation head c59a55f8f2dc8c7a2db3b04c172690e4c469d55a against the prior reviewed
object f9e1be5391ec487d1daeb2359f059c3c218e17e0. All remediation commits are authored by coder3. The remote branch ref was re-read at the end of the review and remained exactly c59a55f8.
All four prior blockers are closed. Each condition was re-run against both heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
1. Empty and unreadable source census now fail closed
Empty source tools tree — old: rc=0, all census counters zero. New: rc=2, CANNOT_ASSERT source tools census is empty.
Mode-000 source subtree, with the canonical resolver installed and matching as a positive
control — old: rc=0, the resolver counted IN_SYNC while the hidden subtree simply
disappeared. New: rc=2, CANNOT_ASSERT ... Permission denied.
The census now checks directory traversal modes, propagates os.walk errors, rejects unreadable
and non-regular source entries, and requires a non-empty framework-owned population.
2. Manifest policy is now genuinely authoritative
The checker invokes shipped tools/_lib/manifest.sh classify with MANIFEST_FILE bound to the
adjacent framework-manifest.txt, validates one complete classification per source path, and
fails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
Add tools/git/tool.sh to [operator] while its deployed bytes differ — old: rc=1 STALE
(the manifest change was ignored). New: rc=0 (operator policy took effect).
Remove the credentials operator carve-out while deployed credentials differ — old: rc=0
(a hardcoded exclusion remained). New: rc=1 STALE _lib/credentials.json.
Delete the manifest entirely while all bytes match — old: rc=0 clean. New: rc=2
CANNOT_ASSERT ownership manifest is missing or unreadable.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
3. Root and descendant aliases cannot report clean
Root identity uses samefile(). Each required deployed path is rejected when any installed path
component is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed git/ symlinked to source git/) — old: rc=0, IN_SYNC git/tool.sh.
New: rc=1, UNSAFE_ALIAS git/tool.sh.
A mutant disabling both the symlink-component and per-file samefile() defences was killed.
Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: rc=124, final
output only Checking installed framework-tool drift.... New doctor with a 1s internal deadline: rc=1, emits CANNOT_ASSERT framework drift checker timed out, then continues through the
remaining audit and ends at [mosaic-doctor] warnings=50. The continuation is the actual
requirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with doctor did not continue after checker timeout. The timeout-unavailable arm refuses an unbounded
run and continues; invalid configured deadlines are warned and reset to a bounded default.
Committed mode and enumeration
Read from the new head's git index, not filesystem mode — committed and on-disk mode disagree
more often than expected:
check-test-enumeration.sh passed (population 55, all named paths present), and package.json's test:framework-shell explicitly includes test-framework-drift-doctor.sh.
Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to CANNOT_ASSERT, and the resolver requirement supplies a second fail-closed arm.
Preserved requirements
Installed-only files remain observational operator-or-unknown entries; no deployed-root write or
delete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under tools/** enters the census automatically, and manifest
ownership determines whether it is required.
Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable — samefile() is the
implemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.
**This review is the independent judgement of `rev-code-01`, relayed and placed by `Mos`.**
rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is `coder3`; reviewer is
`rev-code-01`; the two are distinct principals.
# Independent re-review — verdict: APPROVE
Reviewed remediation head `c59a55f8f2dc8c7a2db3b04c172690e4c469d55a` against the prior reviewed
object `f9e1be5391ec487d1daeb2359f059c3c218e17e0`. All remediation commits are authored by
`coder3`. The remote branch ref was re-read at the end of the review and remained exactly
`c59a55f8`.
All four prior blockers are closed. Each condition was re-run against **both** heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
## 1. Empty and unreadable source census now fail closed
- Empty source tools tree — old: **rc=0**, all census counters zero. New: **rc=2**,
`CANNOT_ASSERT source tools census is empty`.
- Mode-000 source subtree, with the canonical resolver installed and matching as a positive
control — old: **rc=0**, the resolver counted `IN_SYNC` while the hidden subtree simply
disappeared. New: **rc=2**, `CANNOT_ASSERT ... Permission denied`.
The census now checks directory traversal modes, propagates `os.walk` errors, rejects unreadable
and non-regular source entries, and requires a non-empty framework-owned population.
## 2. Manifest policy is now genuinely authoritative
The checker invokes shipped `tools/_lib/manifest.sh classify` with `MANIFEST_FILE` bound to the
adjacent `framework-manifest.txt`, validates one complete classification per source path, and
fails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
- Add `tools/git/tool.sh` to `[operator]` while its deployed bytes differ — old: **rc=1 STALE**
(the manifest change was ignored). New: **rc=0** (operator policy took effect).
- Remove the credentials operator carve-out while deployed credentials differ — old: **rc=0**
(a hardcoded exclusion remained). New: **rc=1 STALE _lib/credentials.json**.
- Delete the manifest entirely while all bytes match — old: **rc=0 clean**. New: **rc=2
CANNOT_ASSERT ownership manifest is missing or unreadable**.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
## 3. Root and descendant aliases cannot report clean
Root identity uses `samefile()`. Each required deployed path is rejected when any installed path
component is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed `git/` symlinked to source `git/`) — old: **rc=0, IN_SYNC git/tool.sh**.
New: **rc=1, UNSAFE_ALIAS git/tool.sh**.
A mutant disabling **both** the symlink-component and per-file `samefile()` defences was killed.
Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
## 4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: **rc=124**, final
output only `Checking installed framework-tool drift...`. New doctor with a 1s internal deadline:
**rc=1**, emits `CANNOT_ASSERT framework drift checker timed out`, then continues through the
remaining audit and ends at `[mosaic-doctor] warnings=50`. The continuation is the actual
requirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with
`doctor did not continue after checker timeout`. The timeout-unavailable arm refuses an unbounded
run and continues; invalid configured deadlines are warned and reset to a bounded default.
## Committed mode and enumeration
Read from the new head's **git index**, not filesystem mode — committed and on-disk mode disagree
more often than expected:
```
100755 ... framework-drift-check.py
100755 ... test-framework-drift-check.py
100755 ... test-framework-drift-doctor.sh
```
`check-test-enumeration.sh` passed (population 55, all named paths present), and `package.json`'s
`test:framework-shell` explicitly includes `test-framework-drift-doctor.sh`.
## Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to `CANNOT_ASSERT`, and the resolver requirement supplies a second fail-closed arm.
## Preserved requirements
Installed-only files remain observational `operator-or-unknown` entries; no deployed-root write or
delete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under `tools/**` enters the census automatically, and manifest
ownership determines whether it is required.
## Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable — `samefile()` is the
implemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.
Ultron's REQUEST_CHANGES finding B1 on PR #1195: a bare operator manifest entry
such as `tools/git` was matched as an implicit directory prefix, so declaring one
directory silently exempted every framework file beneath it from drift detection.
A drift blind spot is exactly what #1194 exists to close.
An exact entry is now a file carve-out. Subtree ownership must be declared
explicitly as `dir/**`. The same rule is applied on both sides of the Bash/TS
parity boundary: `_mo_matches` in tools/_lib/manifest.sh drops its prefix clause,
and `resolveOwnership` in src/framework/manifest.ts routes operator globs through
a new `matchesOperatorGlob` that requires equality when the pattern has no `*`.
Verified by measurement rather than by report. The new regression declares
operator entry `tools/git`, drifts `tools/git/guard.sh` beneath it, and asserts
the checker exits 1 with `STALE git/guard.sh`:
at c59a55f8 (broken): FAILED (failures=1) -- rc 0, summary `stale=0`
at this tree (fixed): Ran 6 tests, OK
The failure at the old head is the point. A fixture that passes on the broken
tree measures nothing, and this file's neighbour (#1174) has spent ten rounds
proving it.
Also two shellcheck-only mechanical fixes in manifest.sh: SC1087 (brace the
expansion before `[`) and SC2155 (split `local` from the assignment so the
return status is not masked).
Not validated here: the full package typecheck could not be run in this
workspace -- node_modules is absent and the host filesystem is full. CI covers it.
Reviewed-by: gate-ultron-01 (finding B1)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Mos
coder-mos1
Refs #1194
Detects when deployed Mosaic framework tools differ from the framework bundled with the executing package.
No framework refresh or live-seat tooling mutation was performed.
REQUEST_CHANGES — independent review authored by
rev-code-01This judgement is not mine. It was formed by seat
rev-code-01, which reviewed git objectf9e1be5391ec487d1daeb2359f059c3c218e17e0againstorigin/main@120af4e19319. I am placing thereview object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it:
coder3authored,rev-code-01reviewed,mos-claudetranscribed. The verdict below isrev-code-01's wording, not a summary of it.Blocking findings
1. An empty or unreadable source population fails open as clean.
files_below()accepts anempty census and
main()returns 0 wheneverstaleandnot_installedare empty, with no minimumexpected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns rc=0 (
in-sync=0 stale=0 not-installed=0); a source containing one requiredtool below a mode-000 directory also returns rc=0 with zero of everything. (A mode-000
regular file fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail
CANNOT_ASSERTontraversal errors, rather than letting
rglob()omissions become zero required files.2. The manifest named as the ownership SSOT is never opened. The PRD, the module documentation
and the tool's own output attribute ownership to
framework-manifest.txt; the checker insteadhardcodes "every regular file below
tools/minus the Python constant{_lib/credentials.json}".Measured: a manifest marking
tools/git/tool.shoperator-owned was ignored (still rc=1STALE);deleting the manifest entirely while tool bytes matched returned rc=0 clean. A newly shipped
file below
tools/**is not invisible — the recursive census catches it, which is the good part —but any future ownership policy change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
3.
CANNOT_ASSERTis bypassable by a source-backed installed subtree.Path.resolve()plustextual root equality does correctly reject trailing-slash,
..and root-symlink aliases —rev-code-01measured rc=2 for those. It does not establish filesystem independence below theroots. Measured bypass: distinct source and installed roots, installed
git/symlinked to sourcegit/⇒ rc=0,IN_SYNC. The checker compared the source artifact against itself and called thedeployed subtree clean. A bind mount has the same weakness at root level (
resolve()preservesdistinct mount paths where
samefile()would not); that variant was not executed — no mountauthority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
4. A stalled checker blocks
mosaic doctorindefinitely. Doctor invokes it synchronously withno deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after
[mosaic-doctor] Checking installed framework-tool drift.... Nonzero and exceptional exits are caught as warnings and do not abort doctor; hangs areuncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as
CANNOT_ASSERT.What held, verified rather than assumed
_lib/credentials.jsonexcluded, stale_lib/credentials.json.bakstill rc=1. A mutation widening it togit/guard.shwas killed by theauthor's own suite.
and byte-identical, counted and listed under
--verbose, with no deletion path in the checker.zero in the session-start files, with positive enumeration of those files as the control.
Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide
git/guard.sh— were all killed, so thesuite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed
ci-queue-wait.shemitted ordinary warningsand zero drift classifications. The suite does not cover any of the four blockers above.
Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
Remediation
coder3owns it — the authoring seat fixes its own PR. One batch, one push. A push to a PRbranch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
REQUEST_CHANGES — independent review authored by
rev-code-01This judgement is not mine. It was formed by seat
rev-code-01, which reviewed git objectf9e1be5391ec487d1daeb2359f059c3c218e17e0againstorigin/main@120af4e19319. I am placing thereview object because that seat has no per-slot token for this provider and correctly refused to
borrow one. Author≠reviewer is satisfied by who formed the judgement, not by whose token posted it:
coder3authored,rev-code-01reviewed,mos-claudetranscribed. The verdict below isrev-code-01's wording, not a summary of it.Blocking findings
1. An empty or unreadable source population fails open as clean.
files_below()accepts anempty census and
main()returns 0 wheneverstaleandnot_installedare empty, with no minimumexpected population and no traversal-error accounting. Measured: an existing but empty source tools
directory returns rc=0 (
in-sync=0 stale=0 not-installed=0); a source containing one requiredtool below a mode-000 directory also returns rc=0 with zero of everything. (A mode-000
regular file fails nonzero with a traceback, so it is the directory-traversal path specifically
that manufactures agreement.) Require a non-empty/expected census and fail
CANNOT_ASSERTontraversal errors, rather than letting
rglob()omissions become zero required files.2. The manifest named as the ownership SSOT is never opened. The PRD, the module documentation
and the tool's own output attribute ownership to
framework-manifest.txt; the checker insteadhardcodes "every regular file below
tools/minus the Python constant{_lib/credentials.json}".Measured: a manifest marking
tools/git/tool.shoperator-owned was ignored (still rc=1STALE);deleting the manifest entirely while tool bytes matched returned rc=0 clean. A newly shipped
file below
tools/**is not invisible — the recursive census catches it, which is the good part —but any future ownership policy change has no effect on this detector. Parse the manifest through
the canonical ownership implementation, or mechanically prove parity, and fail when it cannot be
loaded.
3.
CANNOT_ASSERTis bypassable by a source-backed installed subtree.Path.resolve()plustextual root equality does correctly reject trailing-slash,
..and root-symlink aliases —rev-code-01measured rc=2 for those. It does not establish filesystem independence below theroots. Measured bypass: distinct source and installed roots, installed
git/symlinked to sourcegit/⇒ rc=0,IN_SYNC. The checker compared the source artifact against itself and called thedeployed subtree clean. A bind mount has the same weakness at root level (
resolve()preservesdistinct mount paths where
samefile()would not); that variant was not executed — no mountauthority. Reject symlinked framework-owned deployed entries and compare by device+inode identity.
4. A stalled checker blocks
mosaic doctorindefinitely. Doctor invokes it synchronously withno deadline. Measured: the checker replaced by a 30-second sleep, doctor under a 2-second external
watchdog ⇒ rc=124 with nothing emitted after
[mosaic-doctor] Checking installed framework-tool drift.... Nonzero and exceptional exits are caught as warnings and do not abort doctor; hangs areuncontained and suppress every remaining check. Add a bounded watchdog and report a timeout as
CANNOT_ASSERT.What held, verified rather than assumed
_lib/credentials.jsonexcluded, stale_lib/credentials.json.bakstill rc=1. A mutation widening it togit/guard.shwas killed by theauthor's own suite.
and byte-identical, counted and listed under
--verbose, with no deletion path in the checker.zero in the session-start files, with positive enumeration of those files as the control.
Test quality
Author suite 3/3. Three purposeful mutants — clearing stale/missing before the verdict, removing the
root self-comparison guard, widening the carve-out to hide
git/guard.sh— were all killed, so thesuite is doing real work. A pre-change control confirmed the regression was genuinely invisible
before: doctor against a deliberately stale installed
ci-queue-wait.shemitted ordinary warningsand zero drift classifications. The suite does not cover any of the four blockers above.
Not measured, and stated rather than left implicit
Provider metadata and CI were not read by the reviewer (no per-slot token; PR state, CI status and
no-conflicts were supplied by me from my own readback). No real bind mount, no case-insensitive
filesystem aliases, no deployed-root scan runtime against the live 195-file drift population, no
package suite beyond the focused checker tests.
No branch was modified, pushed, merged or deployed by the reviewer.
Remediation
coder3owns it — the authoring seat fixes its own PR. One batch, one push. A push to a PRbranch destroys its approvals, so four findings do not become four pushes; and CI is re-greened by
restart, never by an empty push. Blocker 2 is the one I would think hardest about: a detector whose
ownership policy is a copy of the SSOT rather than a read of it becomes a green light precisely when
the policy changes.
This review is the independent judgement of
rev-code-01, relayed and placed byMos.rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is
coder3; reviewer isrev-code-01; the two are distinct principals.Independent re-review — verdict: APPROVE
Reviewed remediation head
c59a55f8f2dc8c7a2db3b04c172690e4c469d55aagainst the prior reviewedobject
f9e1be5391ec487d1daeb2359f059c3c218e17e0. All remediation commits are authored bycoder3. The remote branch ref was re-read at the end of the review and remained exactlyc59a55f8.All four prior blockers are closed. Each condition was re-run against both heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
1. Empty and unreadable source census now fail closed
CANNOT_ASSERT source tools census is empty.control — old: rc=0, the resolver counted
IN_SYNCwhile the hidden subtree simplydisappeared. New: rc=2,
CANNOT_ASSERT ... Permission denied.The census now checks directory traversal modes, propagates
os.walkerrors, rejects unreadableand non-regular source entries, and requires a non-empty framework-owned population.
2. Manifest policy is now genuinely authoritative
The checker invokes shipped
tools/_lib/manifest.sh classifywithMANIFEST_FILEbound to theadjacent
framework-manifest.txt, validates one complete classification per source path, andfails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
tools/git/tool.shto[operator]while its deployed bytes differ — old: rc=1 STALE(the manifest change was ignored). New: rc=0 (operator policy took effect).
(a hardcoded exclusion remained). New: rc=1 STALE _lib/credentials.json.
CANNOT_ASSERT ownership manifest is missing or unreadable.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
3. Root and descendant aliases cannot report clean
Root identity uses
samefile(). Each required deployed path is rejected when any installed pathcomponent is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed
git/symlinked to sourcegit/) — old: rc=0, IN_SYNC git/tool.sh.New: rc=1, UNSAFE_ALIAS git/tool.sh.
A mutant disabling both the symlink-component and per-file
samefile()defences was killed.Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: rc=124, final
output only
Checking installed framework-tool drift.... New doctor with a 1s internal deadline:rc=1, emits
CANNOT_ASSERT framework drift checker timed out, then continues through theremaining audit and ends at
[mosaic-doctor] warnings=50. The continuation is the actualrequirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with
doctor did not continue after checker timeout. The timeout-unavailable arm refuses an unboundedrun and continues; invalid configured deadlines are warned and reset to a bounded default.
Committed mode and enumeration
Read from the new head's git index, not filesystem mode — committed and on-disk mode disagree
more often than expected:
check-test-enumeration.shpassed (population 55, all named paths present), andpackage.json'stest:framework-shellexplicitly includestest-framework-drift-doctor.sh.Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to
CANNOT_ASSERT, and the resolver requirement supplies a second fail-closed arm.Preserved requirements
Installed-only files remain observational
operator-or-unknownentries; no deployed-root write ordelete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under
tools/**enters the census automatically, and manifestownership determines whether it is required.
Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable —
samefile()is theimplemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.
This review is the independent judgement of
rev-code-01, relayed and placed byMos.rev-code-01 holds no per-slot Mosaicstack token, so it could not author this object itself. It
invoked the required wrapper once under its own pinned identity, was refused by the credential
helper, and stopped without retrying under another identity — which is the correct behaviour and
the reason this relay is trustworthy. The judgement below is its own; I placed the object and
verified the provider state, and I did not review this PR myself. Author is
coder3; reviewer isrev-code-01; the two are distinct principals.Independent re-review — verdict: APPROVE
Reviewed remediation head
c59a55f8f2dc8c7a2db3b04c172690e4c469d55aagainst the prior reviewedobject
f9e1be5391ec487d1daeb2359f059c3c218e17e0. All remediation commits are authored bycoder3. The remote branch ref was re-read at the end of the review and remained exactlyc59a55f8.All four prior blockers are closed. Each condition was re-run against both heads: the old head
reproduced the prior failure and the new head produced the intended bounded or non-clean result.
A fixture that passes on the broken tree measures nothing, so the before-state was re-measured
rather than accepted.
1. Empty and unreadable source census now fail closed
CANNOT_ASSERT source tools census is empty.control — old: rc=0, the resolver counted
IN_SYNCwhile the hidden subtree simplydisappeared. New: rc=2,
CANNOT_ASSERT ... Permission denied.The census now checks directory traversal modes, propagates
os.walkerrors, rejects unreadableand non-regular source entries, and requires a non-empty framework-owned population.
2. Manifest policy is now genuinely authoritative
The checker invokes shipped
tools/_lib/manifest.sh classifywithMANIFEST_FILEbound to theadjacent
framework-manifest.txt, validates one complete classification per source path, andfails when either artifact is unavailable or malformed. The test applied was whether CHANGING the
manifest changes the verdict, not whether the manifest is parsed:
tools/git/tool.shto[operator]while its deployed bytes differ — old: rc=1 STALE(the manifest change was ignored). New: rc=0 (operator policy took effect).
(a hardcoded exclusion remained). New: rc=1 STALE _lib/credentials.json.
CANNOT_ASSERT ownership manifest is missing or unreadable.
A purposeful mutant replacing manifest-owned required paths with all source paths was killed by
the new unit suite.
3. Root and descendant aliases cannot report clean
Root identity uses
samefile(). Each required deployed path is rejected when any installed pathcomponent is a symlink or when source and deployed identify the same filesystem object. Descendant
alias control (installed
git/symlinked to sourcegit/) — old: rc=0, IN_SYNC git/tool.sh.New: rc=1, UNSAFE_ALIAS git/tool.sh.
A mutant disabling both the symlink-component and per-file
samefile()defences was killed.Disabling only one survives because the other independently catches the fixture; that is defence
redundancy, not a gap, and it is reported as such rather than as a passing test.
4. Doctor bounds a stalled checker and continues its audit
30-second sleeping-checker control — old doctor under an external 3s watchdog: rc=124, final
output only
Checking installed framework-tool drift.... New doctor with a 1s internal deadline:rc=1, emits
CANNOT_ASSERT framework drift checker timed out, then continues through theremaining audit and ends at
[mosaic-doctor] warnings=50. The continuation is the actualrequirement and was checked separately from the timeout working.
Doctor mutants: removing the internal timeout made the regression test itself hang until an
external watchdog returned rc=124; exiting after the timeout warning failed explicitly with
doctor did not continue after checker timeout. The timeout-unavailable arm refuses an unboundedrun and continues; invalid configured deadlines are warned and reset to a bounded default.
Committed mode and enumeration
Read from the new head's git index, not filesystem mode — committed and on-disk mode disagree
more often than expected:
check-test-enumeration.shpassed (population 55, all named paths present), andpackage.json'stest:framework-shellexplicitly includestest-framework-drift-doctor.sh.Executed
Checker suite 5/5; doctor watchdog regression passed; enumeration guard passed; Python compile and
Bash syntax passed; dual-head empty, unreadable, manifest-add, manifest-remove, manifest-missing
and nested-alias probes all produced the required RED-before / GREEN-after distinction.
Reported rather than smoothed over: removing only the explicit empty-census guard did NOT fail the
unit suite, because the empty production-shaped tree also lacks the required canonical resolver and
still returns rc=2. The old-head dual control nevertheless proves the behaviour changed from clean
to
CANNOT_ASSERT, and the resolver requirement supplies a second fail-closed arm.Preserved requirements
Installed-only files remain observational
operator-or-unknownentries; no deployed-root write ordelete path was added. The doctor integration remains observational and is not wired into session
startup. A newly shipped file under
tools/**enters the census automatically, and manifestownership determines whether it is required.
Not measured — stated as boundary, not implied as clean
Provider metadata and CI independently by this seat (Mos supplied exact-head terminal-green
readback); a real bind mount, since mount authority was unavailable —
samefile()is theimplemented identity defence but no bind test was executed; case-insensitive filesystem aliases;
real current-host live-population scan runtime; the full package test suite beyond the focused
checker, doctor, enumeration and syntax checks.
No branch was modified, pushed, merged, deployed, or refreshed in the installed framework root by
the reviewing seat.