docs: deployment mode and conversion contract (S2 contract 6) #1439

2026-08-26T23:58:23Z

fred commented

2026-08-26 23:58:23 +00:00

webui-audit S2 contract 6 of 9 (D3 mode/conversion). Docs-only: adds docs/requirements/mode-conversion.md. Binds mode as a canonical recorded property (bootstrap choice, immutable except conversion), the per-mode obligation owner map, the one-way standalone→enterprise transition (preconditions, atomic flip, admin authority + audit, enterprise terminal), and v1 non-foreclosure obligations (mode recorded, enterprise value reserved/refused, conversion deferred, federation not foreclosed). Embedded ruling request: v1 implements the mode record and immutability only; the conversion command is deferred to the Enterprise milestone per D11. No self-merge before independent review (gate 16).

fred added 1 commit 2026-08-26 23:58:24 +00:00

docs: deployment mode and conversion contract (S2 contract 6)

ci/woodpecker/pr/ci Pipeline was canceled

Details

be32b693d0

fred added 1 commit 2026-08-27 00:16:21 +00:00

docs: mode conversion revision 2 — identity precondition, preparation/flip boundary, vocabulary, witness matrix (luna F1-F7)

ci/woodpecker/pr/ci Pipeline was successful

Details

3231b91691

rev-code-01 approved these changes 2026-08-27 00:31:53 +00:00

rev-code-01 left a comment

APPROVED — rev-code-01, pinned to head 3231b916914856b5d51ca495b9e94d880f0e5e7e (re-verified unmoved immediately before posting).

Scope: doc-only, single file docs/requirements/mode-conversion.md (+279 lines vs merge-base, 2 commits). Verified independently of the luna r2 review; the load-bearing claims re-measured by me at this head:

PRD anchors exact: Part I §3 D3 mode table verbatim (four rows — brains, isolation, secrets, conversion — one-way, terminal state, federation deferred with "nothing in v1 may foreclose it"); §7 D14 (split optional in Standalone, keeping it the recommended default precisely for conversion forward-compatibility); §9 D11 (v1 = Standalone slice; Enterprise conversion in the deferred list); §12.1 (the drafting-addition ratification mechanism — §2.2's self-classification of the mode read command is a real route, not an invention).
Sibling-contract citations resolve, both directions: contract 3 §2.3 at 666e3dbf states verbatim that mode is an install-time input the wizard reads and never writes, that changing mode is conversion not a wizard re-run, and that v1 refuses enterprise at bootstrap — exactly the reciprocity this contract's §2.1/§2.3/§5.1 claim. Contract 1 §6.3(b)'s three prongs (symbol, class-table literal, raw-execution) + composition rules verified at rev 7 bf3bd6c4 and persisting at the current rev-8 head. Contract 7 (custody, PR #1440 at caa5b040) carries the D14 boundary, the Standalone split MAY/recommended-default, and its §7 witnesses — §5.3's boundary citation and the "requires contract 7 ratified" dependency are accurate. Tool-mapping §4.2 precondition/state class and §3.3 amendment route verified in my own review of #1438 this session (id 325); identity §2.2/§4.1 (the acknowledgment's registration/JIT values) verified in my own review of #1433 (id 323).
Clean implementation slate: no existing platform_mode table or mode-value parsing anywhere in apps/ or packages/ (grep empty) — the contract defines new schema, nothing conflicts.
Internal quality: the §4.3 Standalone-safe-representation rule (every preparation unit lands in a valid Standalone state, so interruption needs no rollback path) removes the class of half-converted states rather than fencing them; the §4.2 identity precondition's conversion-local acknowledgment adds no identity-contract obligation, as claimed; §5.4's two-value-only parsing with refusal before side effects plus no-DB-enum storage keeps federation non-foreclosed without parser speculation; the ruling request honestly scopes v1 to record + immutability + three non-foreclosure witnesses, naming the rejected alternative.

Gates run by me in a fresh worktree at this head: format:check rc=0 (pinned prettier; both revisions clean, no style delta); web-deps build rc=0; typecheck rc=0 (45/45); lint rc=0 (25/25).

Non-blocking notes:

[S1] Merge order: this contract references custody-schema.md (#1440), onboarding-wizard.md (#1437), hierarchy-schema.md (#1435), identity-lifecycle.md (#1433), tool-gateway-mapping.md (#1438) — none present at this head. The lane's declared order (#1438 → #1439, custody later) still leaves §5.3/§4.4 cross-references dangling on next until #1440 lands; acceptable for a contract suite landing as a set, but the lane should land the full set before treating docs/requirements/ as self-contained.

CI note: 2835 pending on this head at review time (2827 killed earlier). Merge waits on 2835 terminal green and the lane's order after #1438.

**APPROVED — rev-code-01, pinned to head `3231b916914856b5d51ca495b9e94d880f0e5e7e`** (re-verified unmoved immediately before posting). Scope: doc-only, single file `docs/requirements/mode-conversion.md` (+279 lines vs merge-base, 2 commits). Verified independently of the luna r2 review; the load-bearing claims re-measured by me at this head: 1. **PRD anchors exact:** Part I §3 D3 mode table verbatim (four rows — brains, isolation, secrets, conversion — one-way, terminal state, federation deferred with "nothing in v1 may foreclose it"); §7 D14 (split optional in Standalone, keeping it the recommended default precisely for conversion forward-compatibility); §9 D11 (v1 = Standalone slice; Enterprise conversion in the deferred list); §12.1 (the drafting-addition ratification mechanism — §2.2's self-classification of the mode read command is a real route, not an invention). 2. **Sibling-contract citations resolve, both directions:** contract 3 §2.3 at `666e3dbf` states verbatim that mode is an install-time input the wizard reads and never writes, that changing mode is conversion not a wizard re-run, and that v1 refuses `enterprise` at bootstrap — exactly the reciprocity this contract's §2.1/§2.3/§5.1 claim. Contract 1 §6.3(b)'s three prongs (symbol, class-table literal, raw-execution) + composition rules verified at rev 7 `bf3bd6c4` and persisting at the current rev-8 head. Contract 7 (custody, PR #1440 at `caa5b040`) carries the D14 boundary, the Standalone split MAY/recommended-default, and its §7 witnesses — §5.3's boundary citation and the "requires contract 7 ratified" dependency are accurate. Tool-mapping §4.2 precondition/state class and §3.3 amendment route verified in my own review of #1438 this session (id 325); identity §2.2/§4.1 (the acknowledgment's registration/JIT values) verified in my own review of #1433 (id 323). 3. **Clean implementation slate:** no existing `platform_mode` table or mode-value parsing anywhere in `apps/` or `packages/` (grep empty) — the contract defines new schema, nothing conflicts. 4. **Internal quality:** the §4.3 Standalone-safe-representation rule (every preparation unit lands in a valid Standalone state, so interruption needs no rollback path) removes the class of half-converted states rather than fencing them; the §4.2 identity precondition's conversion-local acknowledgment adds no identity-contract obligation, as claimed; §5.4's two-value-only parsing with refusal before side effects plus no-DB-enum storage keeps federation non-foreclosed without parser speculation; the ruling request honestly scopes v1 to record + immutability + three non-foreclosure witnesses, naming the rejected alternative. Gates run by me in a fresh worktree at this head: `format:check` rc=0 (pinned prettier; both revisions clean, no style delta); web-deps build rc=0; `typecheck` rc=0 (45/45); `lint` rc=0 (25/25). Non-blocking notes: - [S1] Merge order: this contract references `custody-schema.md` (#1440), `onboarding-wizard.md` (#1437), `hierarchy-schema.md` (#1435), `identity-lifecycle.md` (#1433), `tool-gateway-mapping.md` (#1438) — none present at this head. The lane's declared order (#1438 → #1439, custody later) still leaves §5.3/§4.4 cross-references dangling on `next` until #1440 lands; acceptable for a contract suite landing as a set, but the lane should land the full set before treating `docs/requirements/` as self-contained. CI note: 2835 pending on this head at review time (2827 killed earlier). Merge waits on 2835 terminal green and the lane's order after #1438.

rev-code-01 referenced this pull request

2026-08-27 10:03:45 +00:00

docs: custody pointer and consent schema contract (S2 contract 7) #1440

rev-code-01 referenced this pull request

2026-08-27 10:30:31 +00:00

docs: onboarding wizard contract (S2 contract 3) #1437

fred merged commit 6e16675ea2 into next

2026-08-28 22:57:12 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1439