docs: roll-up projection contract (S2 contract 8) #1442

2026-08-27T00:42:00Z

fred commented

2026-08-27 00:42:00 +00:00

S2 contract 8 of 9 (webui-audit REPORT.md prerequisite list): the read-only roll-up projection — aggregation semantics (per-workspace task counts by status, every hierarchy level, closed response schema inside the A1 §8.2.4 carve-out), reader authorization semantics (aggregation over only readable workspaces, node visibility, no existence oracles, live evaluation with contract 2 revocation bound), mechanical read-only enforcement, dependencies on A5 ranks 1-3, 8 witness families, PRD §12.1 drafting-addition disclosure, and a one-sentence ruling request (granted-but-empty node: zero counts vs indistinguishable-from-nonexistent).

Sources: native-kanban-sot.md §8 (A1 amendment), A5 rank 5 + P1 roll-up row (~/.mosaic/fleet/lanes/webui-audit/findings/A5-tooling-baseline.md), REPORT.md line 79. Docs-only, one new file.

No self-merge before independent review (gate 16). Model review to follow.

S2 contract 8 of 9 (webui-audit REPORT.md prerequisite list): the read-only roll-up projection — aggregation semantics (per-workspace task counts by status, every hierarchy level, closed response schema inside the A1 §8.2.4 carve-out), reader authorization semantics (aggregation over only readable workspaces, node visibility, no existence oracles, live evaluation with contract 2 revocation bound), mechanical read-only enforcement, dependencies on A5 ranks 1-3, 8 witness families, PRD §12.1 drafting-addition disclosure, and a one-sentence ruling request (granted-but-empty node: zero counts vs indistinguishable-from-nonexistent). Sources: native-kanban-sot.md §8 (A1 amendment), A5 rank 5 + P1 roll-up row (~/.mosaic/fleet/lanes/webui-audit/findings/A5-tooling-baseline.md), REPORT.md line 79. Docs-only, one new file. No self-merge before independent review (gate 16). Model review to follow.

fred added 1 commit 2026-08-27 00:42:01 +00:00

docs: roll-up projection contract (S2 contract 8)

ci/woodpecker/pr/ci Pipeline is pending

Details

61c495dd63

fred added 1 commit 2026-08-27 00:58:00 +00:00

docs(rollup): revision 2 — membership locality, executable no-oracle predicate, closed schema enumeration, widened fixtures (terra F1-F7)

ci/woodpecker/pr/ci Pipeline was canceled

Details

df0085dbe2

fred added 1 commit 2026-08-27 01:07:00 +00:00

docs: roll-up projection contract revision 3 (terra re-review residuals)

ci/woodpecker/pr/ci Pipeline was successful

Details

61d8c5fdd9

F2: partial-scope witnesses reconstructed at platform-project and
estate sibling levels, where chain grants can differ; the
workspace-sibling construction is stated non-constructible under
contract 1 grant targets.
F3: section 2.5 defines one field-exact recursive roll-up node record
(id/type/name/totals/children at every depth, required children array,
empty at workspaces, ascending-id ordering, no wrapper); whole-result
rules moved to section 2.6 at section scope; section 6.7 witness
asserts the recursive shape.
F6: fixture assigns workspaces to named platform-projects; grant-level
cases limited to the three levels contract 1 defines, workspace access
covered by membership with the no-workspace-grant fact stated.

rev-code-01 approved these changes 2026-08-27 01:12:10 +00:00

rev-code-01 left a comment

APPROVED — rev-code-01, pinned to head 61d8c5fdd9dde61f448f929d033270cb6be9bd61 (re-verified unmoved immediately before posting).

Scope: doc-only, single file docs/requirements/rollup-projection.md (+351 lines vs merge-base 2a30c68b, 3 revisions). Verified independently of the terra r3 review:

Source anchors verbatim (native-kanban-sot.md on this branch): §8.1.3 read-only roll-up wording, §8.2.2 never-a-write + generated-projections (§3 invariant 5), §8.2.4 carve-out exact text ("per-workspace task counts and statuses aggregated up the parent chain, over workspaces the reader is authorized on", everything beyond remaining a non-goal), §8.3 acceptance (no mutation, aggregates only over authorized workspaces, no cross-tenant existence oracles). A5 rank-5 row and P1 roll-up row verified in the lane findings file (lines 133/145, sot.md line cites match).
Cross-contract claims verified at the sibling heads I reviewed myself: contract 1 (rev 9, e3b03752 — my review id 328) grants target exactly company_id|estate_id|platform_project_id with no workspace target (§3.1), and §2.5's chain-resolution-by-construction backs §2.2's no-double-count claim; contract 2 (501112d2 — my review id 324) §3.1 deny-by-default + membership confers nothing up the chain, §3.2 down-the-chain, §3.5 live/fail-closed, §6 revocation bound, §7.4; contract 5 (9597be90 — my review id 325) §4.1 typed DTOs and §4.2's indistinguishable-on-the-wire rule that §3.4's equivalence predicate makes executable. The rev-3 reconstruction (partial-scope at project- and estate-sibling levels, not workspace siblings, because no workspace grant target exists) is correct against contract 1 §3.1 — I re-derived the same impossibility myself.
Internal quality: §2.5's single recursive five-field record with required ordered children (empty at workspaces) removes the leaf/interior ambiguity; §2.6's whole-result rules at section scope; explicit-zero totals representation; the seven §7 drafting additions are honestly disclosed and severable, correctly excluding the traced aggregation/authorization/read-only/no-oracle core; the one ruling request (granted-but-empty node: zero counts vs nonexistent-equivalent) is well-framed with a recommendation, not silently decided.
Gates in a fresh worktree at this head: format:check rc=0, typecheck rc=0 (45/45), lint rc=0 (25/25).

Non-blocking notes:

[S1] Merge order (same as the set): references hierarchy-schema.md (#1435), rbac-grant-model.md (#1436), tool-gateway-mapping.md (#1438) — none on next yet at review time; land with the set so docs/requirements/ is self-contained.
[S2] §6.3's cross-tenant case covers an unauthorized reader naming company B; a same-company reader with zero grants naming their own tenant's nodes is behaviorally the §6.2 nonexistent-equivalent path — covered, but the implementing PR should include one such probe for completeness.

CI note: 2845 running on this head (2843/2840 killed/canceled under load). Merge waits on 2845 terminal green and the lane's order.

**APPROVED — rev-code-01, pinned to head `61d8c5fdd9dde61f448f929d033270cb6be9bd61`** (re-verified unmoved immediately before posting). Scope: doc-only, single file `docs/requirements/rollup-projection.md` (+351 lines vs merge-base 2a30c68b, 3 revisions). Verified independently of the terra r3 review: 1. **Source anchors verbatim** (`native-kanban-sot.md` on this branch): §8.1.3 read-only roll-up wording, §8.2.2 never-a-write + generated-projections (§3 invariant 5), §8.2.4 carve-out exact text ("per-workspace task counts and statuses aggregated up the parent chain, over workspaces the reader is authorized on", everything beyond remaining a non-goal), §8.3 acceptance (no mutation, aggregates only over authorized workspaces, no cross-tenant existence oracles). A5 rank-5 row and P1 roll-up row verified in the lane findings file (lines 133/145, sot.md line cites match). 2. **Cross-contract claims verified at the sibling heads I reviewed myself:** contract 1 (rev 9, e3b03752 — my review id 328) grants target exactly `company_id|estate_id|platform_project_id` with no workspace target (§3.1), and §2.5's chain-resolution-by-construction backs §2.2's no-double-count claim; contract 2 (501112d2 — my review id 324) §3.1 deny-by-default + membership confers nothing up the chain, §3.2 down-the-chain, §3.5 live/fail-closed, §6 revocation bound, §7.4; contract 5 (9597be90 — my review id 325) §4.1 typed DTOs and §4.2's indistinguishable-on-the-wire rule that §3.4's equivalence predicate makes executable. The rev-3 reconstruction (partial-scope at project- and estate-sibling levels, not workspace siblings, because no workspace grant target exists) is correct against contract 1 §3.1 — I re-derived the same impossibility myself. 3. **Internal quality:** §2.5's single recursive five-field record with required ordered `children` (empty at workspaces) removes the leaf/interior ambiguity; §2.6's whole-result rules at section scope; explicit-zero totals representation; the seven §7 drafting additions are honestly disclosed and severable, correctly excluding the traced aggregation/authorization/read-only/no-oracle core; the one ruling request (granted-but-empty node: zero counts vs nonexistent-equivalent) is well-framed with a recommendation, not silently decided. 4. **Gates in a fresh worktree at this head:** `format:check` rc=0, `typecheck` rc=0 (45/45), `lint` rc=0 (25/25). Non-blocking notes: - [S1] Merge order (same as the set): references `hierarchy-schema.md` (#1435), `rbac-grant-model.md` (#1436), `tool-gateway-mapping.md` (#1438) — none on `next` yet at review time; land with the set so `docs/requirements/` is self-contained. - [S2] §6.3's cross-tenant case covers an unauthorized reader naming company B; a same-company reader with zero grants naming their own tenant's nodes is behaviorally the §6.2 nonexistent-equivalent path — covered, but the implementing PR should include one such probe for completeness. CI note: 2845 running on this head (2843/2840 killed/canceled under load). Merge waits on 2845 terminal green and the lane's order.

fred merged commit a3b0770205 into next

2026-08-27 02:10:13 +00:00

fred referenced this pull request

2026-08-27 03:17:13 +00:00

trunk image builds broken: appservice Dockerfile missing COPY scripts/ (prepare fails), no green trunk pipeline since 2799 #1446

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1442