docs: custody pointer and consent schema contract (S2 contract 7) #1440

Merged

fred merged 13 commits from contract/custody-schema into next 2026-08-27 10:39:33 +00:00

Conversation 1 Commits 13 Files Changed 1

+1742

fred commented 2026-08-27 00:10:21 +00:00

Collaborator

Copy Link

Copy Source

S2 contract 7 of 9 (webui-audit remediation): D14 custody boundary — sensitive-category registry, pointer schema, consent schema, mode application, verification witnesses. Docs-only; ends in a one-sentence ruling request for Jason (five-row initial registry, fail-closed classification, background/education non-sensitive).

Gate 16: author fred; independent model review (GPT-5.6 sol) + rev-code-01 approval required before merge. No self-merge without review.

S2 contract 7 of 9 (webui-audit remediation): D14 custody boundary — sensitive-category registry, pointer schema, consent schema, mode application, verification witnesses. Docs-only; ends in a one-sentence ruling request for Jason (five-row initial registry, fail-closed classification, background/education non-sensitive). Gate 16: author fred; independent model review (GPT-5.6 sol) + rev-code-01 approval required before merge. No self-merge without review.

fred added 1 commit 2026-08-27 00:10:23 +00:00

docs: custody pointer and consent schema contract (S2 contract 7) caa5b04096

rev-code-01 referenced this pull request 2026-08-27 00:31:53 +00:00

docs: deployment mode and conversion contract (S2 contract 6) #1439

fred added 1 commit 2026-08-27 00:39:08 +00:00

docs(custody): revision 2 — classifier registry, grantee model, exact schemas, witness closure (sol r1 F1-F6) 8079d8dc91

fred added 1 commit 2026-08-27 01:33:25 +00:00

docs: custody-schema contract revision 3 (sol re-review residuals F1-F9) 671b872ec9

fred added 1 commit 2026-08-27 02:02:16 +00:00

docs: custody-schema contract revision 4 (sol r3 residuals F1/F2/F4/F6/F7/F9 + F10/F11) 269aeda193

fred added 1 commit 2026-08-27 02:25:56 +00:00

docs: custody-schema contract revision 5 (sol r4 residuals F9/F11 + F12/F13) a8111998c7

fred added 1 commit 2026-08-27 03:06:08 +00:00

docs: custody-schema contract revision 6 (sol r5 residuals F9/F12 + F14) 8ca4564b5e

fred added 1 commit 2026-08-27 03:38:27 +00:00

docs: custody-schema contract revision 7 (sol r6 F15: within-cycle blocking retry preserves the one-cycle orphan bound under lock contention) 482400d93c

fred referenced this pull request 2026-08-27 04:06:30 +00:00

flaky: web guards.spec.tsx GuestGuard pending-session test times out under CI concurrency (blocks unrelated PRs) #1448

fred added 1 commit 2026-08-27 04:08:16 +00:00

docs: custody-schema contract revision 8 (sol r7 residual F15: declared hold deadline + arrival-order grants make the one-cycle bound wall-clock provable) f8ac64f58a

fred added 1 commit 2026-08-27 07:22:21 +00:00

docs: custody-schema contract revision 9 (sol r8 F15 residual + F16: independent deadline supervisor, brain fence via conditional application, reservation-at-skip, computed fixed cycle maximum with explicit exceedance carry-over) c6a2237dde

fred added 1 commit 2026-08-27 08:04:54 +00:00

docs: custody-schema contract revision 10 (sol r9 F16 residual + F17: ABA-resistant per-locator fence epoch — fresh mint on every mutation incl. byte-identical and absence tombstone, fence-advance at lock acquisition invalidating stale tails before first mutation, repair advances before observing; distinct-locator no-contention narrowed to locator locks) b10cfb1e69

fred added 1 commit 2026-08-27 08:47:31 +00:00

custody contract revision 11: acquisition-token guard on the fence-advance (sol r10 F16 residual, F18) ... 2c02631324

The fence-advance is itself fenced against an older acquisition: a
per-locator acquisition token minted by the lock authority at every
lock grant, carried unchanged across the acquisition's brain
operations and swap-loop retries, compared and recorded by the brain
store atomically with every brain mutation (advance included). A
superseded acquisition's delayed advance is refused, mints nothing,
and yields no usable fence (mandatory abort-release-surface,
expected on deadline supersession). The 'refused unconditionally'
claim is precisified to the exact linearization boundary; the
pre-step-1 interruption predicates are restated over exact
content/database state, expressly permitting the advance's
epoch/token change (F18). New §7.10 stale-advance refusal and
pre-advance linearization controls; token invariants added to the
fence static controls (§7.10, §7.16); §8 item 16 and preamble
extended.

fred added 1 commit 2026-08-27 09:19:34 +00:00

contract(custody-schema): revision 12 — exact token comparison base case, split stale database-half boundary ... 8085982396

sol r11 APPROVE minors:
- F19: strictly-less-than refusal made explicit; absent recorded token
  compares lower than every minted token, first acceptance creates the
  record; §7.10 virgin-locator control + delayed-first-grant race.
- F18 residual closed: §7.10 managed-deletion fault predicate restated
  as the exact §4.7 predicate (advance's epoch mint and token record
  permitted).
- F20: pre-advance linearization boundary distinguishes database
  halves — pair-conditioned step 2 for deletion/repair; terminated
  ordinary writer performs no pointer upsert, retry is a fresh
  acquisition; §7.10 control runs both branches.
- §8 item 16 revision-12 clause; preamble Revision 12 paragraph.

fred added 1 commit 2026-08-27 09:48:17 +00:00

contract(custody-schema): revision 13 — withdraw wrong §4.5 repair attribution (sol r12 F20 residual) ... 8a03d99e31

Sol's r12 confirm closed F18/F19 and found one MINOR residual on F20:
rev 12 assigned the terminated ordinary writer's committed-but-unpointed
content to §4.5 repair, but §4.5 enumerates pointers and repairs the
opposite state (pointer present, content absent) — unpointed content is
outside its input, so the §7.10 assertion had no conforming transition.

Per the prescribed correction: the §4.5 repair assertion is removed from
§3.7 and §7.10; the no-upsert assertion stays; the state is what §3.7
and §7.16 already define — inert unpointed content (no pointer, no read
path, no repair transition; a §4.5 cycle run against it changes
nothing), never acknowledged, converging only through the client's
retry as a fresh lock acquisition under a new token that recommits and
completes the pointer upsert. Preamble Revision 13 paragraph added.

rev-code-01 approved these changes 2026-08-27 10:03:45 +00:00

rev-code-01 left a comment

Member

Copy Link

Copy Source

APPROVED — rev-code-01, pinned to head 8a03d99e3194d3f36cfb088d23b59ebc2beea010 (re-verified unmoved immediately before posting).

Scope: doc-only, single new file docs/requirements/custody-schema.md (+1742 lines vs merge-base, 13 revisions — the longest convergence of the S2 set). Verified independently of the sol r1-r13 chain, with the load-bearing claims measured by me at this head:

1. PRD anchors verbatim: D14 ("user's own brain ONLY… PostgreSQL holds structural data, consent records, and pointers — never the content… enforced by architecture, not policy") at PRD lines 139-141; the Standalone-split MAY + recommended default and the D4/D6 authority lines all match the Part I text I verified in my #1439 review.
2. Schema-type facts (the F10-class fixes): users.id is text (BetterAuth identifiers — schema.ts:25), so the contract's text user FKs match the live store; the grantee binding target agents table exists with uuid id (schema.ts:284-286), matching the contract's agent_id uuid FK → agents(id) claim and its honest note that identity-lifecycle defines no enrollment surface to bind to instead; profile_answers and the four custody tables are new (absent from the live schema — clean slate).
3. Registry shape: the version-1 table carries exactly the 7 rows the ruling request scopes (5 sensitive incl. connector-content, 2 non-sensitive professional-background/education marked "per ruling"), with the amendment-only write rule, unknown-key refusal, and the shared/exclusive custody_config write fence at READ COMMITTED with lock-first statement order — internally coherent as written.
4. Rev-13 delta verified in full (the F20 withdrawal): the diff removes the §4.5 repair attribution from the §3.7 ordinary-writer boundary and the §7.10 control, replacing it with the inert-state statement. I confirmed against §4.5 itself: reconciliation enumerates pointers and repairs the opposite state (pointer present, content absent) — unpointed content is genuinely outside its input, so rev 12's attribution was wrong and rev 13's withdrawal is the correct fix, not a wording choice. The remaining two-outcome boundary (serialize-before-advance or refused) and the fresh-token retry path are the already-defined semantics, so "no behavioral change" is accurate.
5. Consent model spot-verified: the exact profile_consents column set, the three-way grantee discriminant CHECK, the partial unique active-grant index, and the cascade-cessation audit event are consistent with §7.11's FK-pinning witnesses; connector/feature registries are contract-owned and empty at v1, honestly declared.
6. Gates run by me in a fresh worktree at this head: format:check rc=0; typecheck rc=0 (45/45); lint rc=0 (25/25).

Non-blocking notes:

• [S1] The 13 revision-preamble blocks (~290 lines before §1) are the set's largest history payload; compress to an appendix at first amendment, same as my #1443 S1.
• [S2] Merge order: contract 7 is cited by #1439 (mode-conversion §5.3's conversion precondition) — landing after #1439 as fred sequenced leaves #1439's citation forward-referencing until this lands; the set completes either way, but the pair should land adjacently in the batch.

CI note: 2880 running on this head at review time (2873/2876/2878 green on earlier revisions). Merge waits on 2880 terminal green + the merge slot after #1439.

**APPROVED — rev-code-01, pinned to head `8a03d99e3194d3f36cfb088d23b59ebc2beea010`** (re-verified unmoved immediately before posting). Scope: doc-only, single new file `docs/requirements/custody-schema.md` (+1742 lines vs merge-base, 13 revisions — the longest convergence of the S2 set). Verified independently of the sol r1-r13 chain, with the load-bearing claims measured by me at this head: 1. **PRD anchors verbatim:** D14 ("user's own brain ONLY… PostgreSQL holds structural data, consent records, and pointers — never the content… enforced by architecture, not policy") at PRD lines 139-141; the Standalone-split MAY + recommended default and the D4/D6 authority lines all match the Part I text I verified in my #1439 review. 2. **Schema-type facts (the F10-class fixes):** `users.id` is `text` (BetterAuth identifiers — schema.ts:25), so the contract's `text` user FKs match the live store; the grantee binding target `agents` table exists with `uuid` id (schema.ts:284-286), matching the contract's `agent_id uuid FK → agents(id)` claim and its honest note that identity-lifecycle defines no enrollment surface to bind to instead; `profile_answers` and the four custody tables are new (absent from the live schema — clean slate). 3. **Registry shape:** the version-1 table carries exactly the 7 rows the ruling request scopes (5 sensitive incl. `connector-content`, 2 non-sensitive `professional-background`/`education` marked "per ruling"), with the amendment-only write rule, unknown-key refusal, and the shared/exclusive `custody_config` write fence at `READ COMMITTED` with lock-first statement order — internally coherent as written. 4. **Rev-13 delta verified in full (the F20 withdrawal):** the diff removes the §4.5 repair attribution from the §3.7 ordinary-writer boundary and the §7.10 control, replacing it with the inert-state statement. I confirmed against §4.5 itself: reconciliation enumerates **pointers** and repairs the opposite state (pointer present, content absent) — unpointed content is genuinely outside its input, so rev 12's attribution was wrong and rev 13's withdrawal is the correct fix, not a wording choice. The remaining two-outcome boundary (serialize-before-advance or refused) and the fresh-token retry path are the already-defined semantics, so "no behavioral change" is accurate. 5. **Consent model spot-verified:** the exact `profile_consents` column set, the three-way grantee discriminant CHECK, the partial unique active-grant index, and the cascade-cessation audit event are consistent with §7.11's FK-pinning witnesses; connector/feature registries are contract-owned and empty at v1, honestly declared. 6. **Gates run by me in a fresh worktree at this head:** `format:check` rc=0; `typecheck` rc=0 (45/45); `lint` rc=0 (25/25). Non-blocking notes: - [S1] The 13 revision-preamble blocks (~290 lines before §1) are the set's largest history payload; compress to an appendix at first amendment, same as my #1443 S1. - [S2] Merge order: contract 7 is cited by #1439 (mode-conversion §5.3's conversion precondition) — landing after #1439 as fred sequenced leaves #1439's citation forward-referencing until this lands; the set completes either way, but the pair should land adjacently in the batch. CI note: 2880 running on this head at review time (2873/2876/2878 green on earlier revisions). Merge waits on 2880 terminal green + the merge slot after #1439.

fred merged commit 01904b8f69 into next 2026-08-27 10:39:33 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

rev-code-01

Labels

Clear labels

bug

Defect in framework tooling or delivered code

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1440