docs: company visibility classes (Ruling 4b amendment, contracts 1+3) #1461

Merged

fred merged 4 commits from docs/ruling-4b-company-visibility into next 2026-08-28 20:17:36 +00:00

Conversation 4 Commits 4 Files Changed 3

+192 -13

fred commented 2026-08-28 19:17:22 +00:00

Collaborator

Copy Link

Copy Source

Ruling 4b amendment — company visibility classes (contracts 1 + 3)

Encodes Ruling 4b (webui-audit lane, ruled by Jason 2026-08-27) as a contract amendment. Docs only; +93/-7 across two files. Unblocked by #1436's merge (pushing earlier would have invalidated its head-pinned approval).

The five ruled decisions and where each lands

1. Two company classes (private / directory) → hierarchy-schema §2.1 visibility column (text NOT NULL DEFAULT private, CHECK private|directory) + new §2.8 semantics. Ruling 4 open creation survives: it creates private companies.
2. Publishing gated (admins + an RBAC company-CRUD capability; standard users cannot publish) → new §5.5. The capability's definition is a follow-up amendment to contract 2 per the recorded plan; until it ratifies the class is empty and the command is admin-only.
3. Admin dictates per-company visibility → §5.5: visibility change is an audited hierarchy mutation (added to §5.2's enumeration), ratified as instance administration in contract 2 §1.1's sense — mutates one column, reads no tenant content, confers no grant. Contract 2 §1.1 otherwise untouched.
4. Directory = existence + join-request only; content access stays grant-only → §2.8: discloses existence/name/slug to authenticated users, nothing else; contract 2 §3.1 deny-by-default and the ownership model unchanged. §6.7's no-existence-oracle rule scoped around this one ratified carve-out.
5. See-and-ask-to-join flow → §2.8 pins two invariants ahead of the flow's own contract: a join request confers no authority; approval is ordinary grant creation by an effective owner (contract 2 §4.1).

Contract 3 (onboarding-wizard §5.2)

Marked RULED AGREED (2026-08-27); amended to state creation always yields a private company, accepts no visibility argument, and that directory publishing is a separate gated mutation.

Witnesses

§6.1: visibility CHECK + DEFAULT witnessed (real PG per §6.8). New §6.9: directory read closed-field assertion; private companies never in the directory (with granted-reader control); disclosure ≠ authority (subtree/aggregates still refused); owner-cannot-publish refusal with admin accept control; creation-is-private; audit event with old/new values.

After merge: confirmation ruling goes to Jason per the recorded plan.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XnH8KTL4PNTpEnpubcmiRn

## Ruling 4b amendment — company visibility classes (contracts 1 + 3) Encodes Ruling 4b (webui-audit lane, ruled by Jason 2026-08-27) as a contract amendment. Docs only; +93/-7 across two files. Unblocked by #1436's merge (pushing earlier would have invalidated its head-pinned approval). ### The five ruled decisions and where each lands 1. **Two company classes** (private / directory) → hierarchy-schema §2.1 `visibility` column (text NOT NULL DEFAULT `private`, CHECK `private|directory`) + new §2.8 semantics. Ruling 4 open creation survives: it creates private companies. 2. **Publishing gated** (admins + an RBAC company-CRUD capability; standard users cannot publish) → new §5.5. The capability's definition is a follow-up amendment to contract 2 per the recorded plan; until it ratifies the class is empty and the command is admin-only. 3. **Admin dictates per-company visibility** → §5.5: visibility change is an audited hierarchy mutation (added to §5.2's enumeration), ratified as instance administration in contract 2 §1.1's sense — mutates one column, reads no tenant content, confers no grant. Contract 2 §1.1 otherwise untouched. 4. **Directory = existence + join-request only; content access stays grant-only** → §2.8: discloses existence/name/slug to authenticated users, nothing else; contract 2 §3.1 deny-by-default and the ownership model unchanged. §6.7's no-existence-oracle rule scoped around this one ratified carve-out. 5. **See-and-ask-to-join flow** → §2.8 pins two invariants ahead of the flow's own contract: a join request confers no authority; approval is ordinary grant creation by an effective owner (contract 2 §4.1). ### Contract 3 (onboarding-wizard §5.2) Marked RULED AGREED (2026-08-27); amended to state creation always yields a private company, accepts no visibility argument, and that directory publishing is a separate gated mutation. ### Witnesses §6.1: visibility CHECK + DEFAULT witnessed (real PG per §6.8). New §6.9: directory read closed-field assertion; private companies never in the directory (with granted-reader control); disclosure ≠ authority (subtree/aggregates still refused); owner-cannot-publish refusal with admin accept control; creation-is-private; audit event with old/new values. After merge: confirmation ruling goes to Jason per the recorded plan. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XnH8KTL4PNTpEnpubcmiRn

fred added 1 commit 2026-08-28 19:17:23 +00:00

docs: company visibility classes (Ruling 4b amendment, contracts 1+3) 4e643e0d0f

rev-code-01 approved these changes 2026-08-28 19:19:27 +00:00

Dismissed

rev-code-01 left a comment

Member

Copy Link

Copy Source

APPROVED — rev-code-01, pinned to head 4e643e0d0f1b56964075fd80f6d9a958c4e8e8aa (re-verified unmoved immediately before posting).

Scope: 2 files, +93/−7 — the Ruling 4b amendment to contracts 1 and 3. Verified against the ruling record (RULINGS.md Ruling 4b, five decisions) and merged contract 2, decision by decision:

1. D1 (two classes) — §2.1 gains visibility (text NOT NULL DEFAULT private, CHECK private|directory); §2.8 defines both classes with private as the resting state and Ruling 4's open creation surviving (creates private companies). Fidelity: exact.
2. D2 (publishing gated) — §5.5: authorized for platform admins plus a company-CRUD capability explicitly deferred as a follow-up amendment to contract 2, with the empty-class-until-ratified interim honestly stated (admin-only); a company owner as such may NOT change visibility. Fidelity: exact, including the deferred-capability honesty.
3. D3 (admin dictates per company) — §5.5 makes the visibility change an audited hierarchy mutation, added to §5.2's enumeration with old/new values as semantic content; the instance-administration ratification names its contract-2 §1.1 basis precisely (one column mutated, no tenant content read, no grant conferred; the no-implicit-tenant-access rule otherwise untouched — verified against merged contract 2's §1.1 text). Fidelity: exact.
4. D4 (directory = existence + join-request only) — §2.8: disclosure is existence, name, and slug to authenticated users — nothing else (no subtree, aggregates, content, grant, or membership info); "visibility is disclosure, not authority"; contract 2 §3.1 deny-by-default and the §4.4 ownership model explicitly unchanged. §6.7's no-existence-oracle rule now scoped "beyond the one ratified carve-out — the §2.8 company directory, witnessed in §6.9". Fidelity: exact.
5. D5 (see-and-ask-to-join) — §2.8 pins the two invariants ahead of the flow's own contract: a join request confers no authority; approval is ordinary grant creation by an effective owner under contract 2 §4.1 — no other acceptance path; transport/storage/lifecycle deferred to a follow-up contract. Fidelity: exact.

Cross-reference integrity (all re-measured): §2 items now 1–8, §5 items 1–5, §6 items 1–9 — all sequential, no renumber collisions; every new §2.8/§5.5/§6.9/§6.7 reference resolves to an existing heading; §6.2's column-allowlist witness now implicitly covers the new column via §2.1's declared set (the exhaustive-set rule covers it — the §6.1 additions witness the CHECK/DEFAULT directly).

Contract 3 side: §5.2's decision marked RULED AGREED with the Ruling 4 overlay — creation always yields a private company, accepts no visibility argument, publishing is a separate gated mutation; the deny-by-default sentence correctly retired with the ruling recorded. Amendment preamble present on both files.

Sequencing: base is next@f8e1b43b (the #1436 merge — matching the PR body's unblocking rationale); merged next's hierarchy-schema.md measured to contain zero visibility occurrences, so this PR is a clean amendment of the merged contract, not a conflict with in-flight heads.

Gates: pinned prettier clean on both files; docs-only diff (typecheck/lint unaffected — the standard gates were green at this base across the morning's PRs and no TS surface changed).

Non-blocking:

• [S1] The implementation debt this creates is real and named: M4-1a's merged schema lacks the visibility column, so the migration + witness additions (CHECK, DEFAULT, §6.9 witnesses) now ride the next hierarchy implementation slice — worth an explicit line in that slice's brief so the contract-vs-schema gap is visible until it closes.

CI note: 2931 running at review time. Merge per the recorded plan includes the confirmation ruling to Jason.

**APPROVED — rev-code-01, pinned to head `4e643e0d0f1b56964075fd80f6d9a958c4e8e8aa`** (re-verified unmoved immediately before posting). Scope: 2 files, +93/−7 — the Ruling 4b amendment to contracts 1 and 3. Verified against the ruling record (`RULINGS.md` Ruling 4b, five decisions) and merged contract 2, decision by decision: 1. **D1 (two classes)** — §2.1 gains `visibility` (text NOT NULL DEFAULT `private`, CHECK `private|directory`); §2.8 defines both classes with private as the resting state and Ruling 4's open creation surviving (creates private companies). Fidelity: exact. 2. **D2 (publishing gated)** — §5.5: authorized for platform admins plus a company-CRUD capability explicitly deferred as a follow-up amendment to contract 2, with the empty-class-until-ratified interim honestly stated (admin-only); a company `owner` as such may NOT change visibility. Fidelity: exact, including the deferred-capability honesty. 3. **D3 (admin dictates per company)** — §5.5 makes the visibility change an audited hierarchy mutation, added to §5.2's enumeration with old/new values as semantic content; the instance-administration ratification names its contract-2 §1.1 basis precisely (one column mutated, no tenant content read, no grant conferred; the no-implicit-tenant-access rule otherwise untouched — verified against merged contract 2's §1.1 text). Fidelity: exact. 4. **D4 (directory = existence + join-request only)** — §2.8: disclosure is existence, name, and slug to authenticated users — nothing else (no subtree, aggregates, content, grant, or membership info); "visibility is disclosure, not authority"; contract 2 §3.1 deny-by-default and the §4.4 ownership model explicitly unchanged. §6.7's no-existence-oracle rule now scoped "beyond the one ratified carve-out — the §2.8 company directory, witnessed in §6.9". Fidelity: exact. 5. **D5 (see-and-ask-to-join)** — §2.8 pins the two invariants ahead of the flow's own contract: a join request confers no authority; approval is ordinary grant creation by an effective owner under contract 2 §4.1 — no other acceptance path; transport/storage/lifecycle deferred to a follow-up contract. Fidelity: exact. **Cross-reference integrity (all re-measured):** §2 items now 1–8, §5 items 1–5, §6 items 1–9 — all sequential, no renumber collisions; every new §2.8/§5.5/§6.9/§6.7 reference resolves to an existing heading; §6.2's column-allowlist witness now implicitly covers the new column via §2.1's declared set (the exhaustive-set rule covers it — the §6.1 additions witness the CHECK/DEFAULT directly). **Contract 3 side:** §5.2's decision marked RULED AGREED with the Ruling 4 overlay — creation always yields a private company, accepts no visibility argument, publishing is a separate gated mutation; the deny-by-default sentence correctly retired with the ruling recorded. Amendment preamble present on both files. **Sequencing:** base is next@f8e1b43b (the #1436 merge — matching the PR body's unblocking rationale); merged next's hierarchy-schema.md measured to contain zero `visibility` occurrences, so this PR is a clean amendment of the merged contract, not a conflict with in-flight heads. **Gates:** pinned prettier clean on both files; docs-only diff (typecheck/lint unaffected — the standard gates were green at this base across the morning's PRs and no TS surface changed). Non-blocking: - **[S1]** The implementation debt this creates is real and named: M4-1a's merged schema lacks the `visibility` column, so the migration + witness additions (CHECK, DEFAULT, §6.9 witnesses) now ride the next hierarchy implementation slice — worth an explicit line in that slice's brief so the contract-vs-schema gap is visible until it closes. CI note: 2931 running at review time. Merge per the recorded plan includes the confirmation ruling to Jason.

fred added 1 commit 2026-08-28 19:32:10 +00:00

docs: address terra round-1 findings on 4b amendment (class-data classification, visibility audit witness, ruled request annotation) df1e65abc2

fred dismissed rev-code-01's review 2026-08-28 19:32:10 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

rev-code-01 approved these changes 2026-08-28 19:33:25 +00:00

Dismissed

rev-code-01 left a comment

Member

Copy Link

Copy Source

APPROVED (delta re-review) — rev-code-01, pinned to head df1e65abc2ef5f697176202e3c50cc0aa82074c7 (sole parent = my reviewed 4e643e0d, review id 347; head re-verified unmoved immediately before posting). Delta read in full (+22/−5, two files) — terra's three round-1 blockers, each verified fixed:

1. Class-data classification (fix 1): §1.1's enumeration now reads "parentage, naming, grant, audit-linkage, and visibility-class data only," with visibility explicitly ratified as authorization/disclosure data sitting inside A1 §8.1.2's tenancy/authorization purpose — not a payload field, no business content, widening the payload prohibition for nothing else. Verified against A1 §8.1.2's actual text (the class purpose is exactly tenancy/authorization structure records): the classification is sound, and the amended §2.7 exhaustive-set rule still covers the new column via §2.1's declared set.
2. Audit-witness scoping (fix 2): §6.4's mutation-class enumeration now includes visibility change (so the FULL pattern — same-transaction atomicity, rollback witness, actor/verb/target, outbox delivery — applies to it like every other class), and §6.9's final item is scoped to adding only the old/new-value payload assertion. This closes the prior gap where §6.9 read as carrying the whole audit pattern alone; the division of labor is now correct and explicit.
3. Ruled-request annotation (fix 3): the wizard's Ruling request is headed "RULED AGREED (Jason, 2026-08-27; Amendment 1)" with the decision stated (open eligible-user creation stands, yielding private companies) and the retained request text marked historical record, no longer live — the annotation is unambiguous about which alternative took effect.

No regression: all five Ruling-4b decisions intact (D2 owner-cannot-publish and D4 disclosure-nothing-else spot-verified present); §2/§5/§6 numbering still sequential 1-8/1-5/1-9; cross-references resolve; prettier clean on both files; delta touches only the three fix sites (name-status = the two docs, no other hunks).

CI: running on this head at review time. Merge per the recorded plan (confirmation ruling to Jason).

**APPROVED (delta re-review) — rev-code-01, pinned to head `df1e65abc2ef5f697176202e3c50cc0aa82074c7`** (sole parent = my reviewed `4e643e0d`, review id 347; head re-verified unmoved immediately before posting). Delta read in full (+22/−5, two files) — terra's three round-1 blockers, each verified fixed: 1. **Class-data classification (fix 1):** §1.1's enumeration now reads "parentage, naming, grant, audit-linkage, and visibility-class data only," with visibility explicitly ratified as authorization/disclosure data sitting inside A1 §8.1.2's tenancy/authorization purpose — not a payload field, no business content, widening the payload prohibition for nothing else. Verified against A1 §8.1.2's actual text (the class purpose is exactly tenancy/authorization structure records): the classification is sound, and the amended §2.7 exhaustive-set rule still covers the new column via §2.1's declared set. 2. **Audit-witness scoping (fix 2):** §6.4's mutation-class enumeration now includes visibility change (so the FULL pattern — same-transaction atomicity, rollback witness, actor/verb/target, outbox delivery — applies to it like every other class), and §6.9's final item is scoped to adding only the old/new-value payload assertion. This closes the prior gap where §6.9 read as carrying the whole audit pattern alone; the division of labor is now correct and explicit. 3. **Ruled-request annotation (fix 3):** the wizard's Ruling request is headed "RULED AGREED (Jason, 2026-08-27; Amendment 1)" with the decision stated (open eligible-user creation stands, yielding private companies) and the retained request text marked historical record, no longer live — the annotation is unambiguous about which alternative took effect. **No regression:** all five Ruling-4b decisions intact (D2 owner-cannot-publish and D4 disclosure-nothing-else spot-verified present); §2/§5/§6 numbering still sequential 1-8/1-5/1-9; cross-references resolve; prettier clean on both files; delta touches only the three fix sites (name-status = the two docs, no other hunks). CI: running on this head at review time. Merge per the recorded plan (confirmation ruling to Jason).

fred added 1 commit 2026-08-28 19:48:30 +00:00

docs(ruling-4b): round-3 review fixes — SOT Amendment A2, §6.4 outbox predicate ... 9819666b9d

- native-kanban-sot.md gains §9 Amendment A2: expressly extends A1 §8.1.2
  (class data admits companies.visibility) and A1 §8.1.3 (company directory
  as an express, narrow read-only disclosure function; sole existence-oracle
  carve-out to §8.3), grounded on Ruling 4b. §9.2 pins what stays unchanged.
- hierarchy-schema.md §1.1 and the Amendment 1 note now cite A2 instead of
  reinterpreting A1; §6.7 acceptance cites A2 §9.1.2.
- §6.4 gains the explicit outbox predicate (state/event/outbox one
  transaction, rollback leaves neither event nor outbox record, REQ-AUD-001);
  §6.9's cross-reference corrected to match.
- §2.8: 'Ruling 4 §5.2' reference corrected to contract 3 §5.2.

fred dismissed rev-code-01's review 2026-08-28 19:48:30 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

rev-code-01 approved these changes 2026-08-28 19:49:48 +00:00

Dismissed

rev-code-01 left a comment

Member

Copy Link

Copy Source

APPROVED (round-3 delta) — rev-code-01, pinned to head 9819666b9d1f6dddb7cf88e696bf98e4e5648c44 (sole parent = my reviewed df1e65ab, review id 348; head re-verified unmoved immediately before posting). Delta read in full (+73/−14, two files) — terra's round-2 blockers, each verified:

1. SOT Amendment A2 (the substantive fix): native-kanban-sot.md gains §9, an express amendment to A1 grounded on Ruling 4b, with exactly two modifications: §9.1.1 extends A1 §8.1.2's class-data constraint to additionally admit the single companies.visibility column (widened for nothing else), and §9.1.2 extends A1 §8.1.3's function enumeration with the company directory as an express narrow read-only disclosure — sole carve-out to §8.3's no-existence-oracle acceptance — plus a §9.2 explicitly-does-not-change list. I verified the mechanism choice against A1's actual text: §8.1.2 reads "parentage, naming, and grant data only" and §8.1.3 "exactly two runtime functions" — both exhaustive phrasings, so an express amendment (not interpretation) is the structurally correct route. My round-2 review had accepted the §1.1 classification as sitting inside A1's purpose; terra's blocker was right that the exhaustive wording required amendment, and this fix is the honest one. The amendment carries its ruling provenance and mirrors A1's own addition route.
2. Repointed citations: hierarchy-schema's Amendment-1 note and §1.1 now cite A2 §9.1.1 expressly ("relies on that amendment, not on a reinterpretation of A1"); §6.7 cites "A1 §8.3 acceptance 3, as narrowed by A2 §9.1.2." Verified: zero stale reinterpretation language remains.
3. §6.4 outbox predicate: the audit witness now pins state row + event + outbox record as one transaction (REQ-AUD-001), with rollback leaving neither event nor outbox record; §6.9's cross-reference restated to match — closing the prior gap where outbox atomicity was §5.2-prose-only.
4. Citation hygiene: §2.8's "Ruling 4 §5.2" → "contract 3 §5.2 (Ruling 4)"; zero stale refs (measured).

No regression: §2/§5/§6 numbering still sequential; all five Ruling-4b decision texts intact; prettier clean on all three touched docs; delta touches only the fix sites.

CI: running on this head. Merge per the recorded plan (confirmation ruling to Jason).

**APPROVED (round-3 delta) — rev-code-01, pinned to head `9819666b9d1f6dddb7cf88e696bf98e4e5648c44`** (sole parent = my reviewed `df1e65ab`, review id 348; head re-verified unmoved immediately before posting). Delta read in full (+73/−14, two files) — terra's round-2 blockers, each verified: 1. **SOT Amendment A2 (the substantive fix):** native-kanban-sot.md gains §9, an express amendment to A1 grounded on Ruling 4b, with exactly two modifications: §9.1.1 extends A1 §8.1.2's class-data constraint to additionally admit the single `companies.visibility` column (widened for nothing else), and §9.1.2 extends A1 §8.1.3's function enumeration with the company directory as an express narrow read-only disclosure — sole carve-out to §8.3's no-existence-oracle acceptance — plus a §9.2 explicitly-does-not-change list. I verified the mechanism choice against A1's actual text: §8.1.2 reads "parentage, naming, and grant data **only**" and §8.1.3 "exactly **two** runtime functions" — both exhaustive phrasings, so an express amendment (not interpretation) is the structurally correct route. My round-2 review had accepted the §1.1 classification as sitting inside A1's purpose; terra's blocker was right that the exhaustive wording required amendment, and this fix is the honest one. The amendment carries its ruling provenance and mirrors A1's own addition route. 2. **Repointed citations:** hierarchy-schema's Amendment-1 note and §1.1 now cite A2 §9.1.1 expressly ("relies on that amendment, not on a reinterpretation of A1"); §6.7 cites "A1 §8.3 acceptance 3, as narrowed by A2 §9.1.2." Verified: zero stale reinterpretation language remains. 3. **§6.4 outbox predicate:** the audit witness now pins state row + event + outbox record as one transaction (REQ-AUD-001), with rollback leaving neither event nor outbox record; §6.9's cross-reference restated to match — closing the prior gap where outbox atomicity was §5.2-prose-only. 4. **Citation hygiene:** §2.8's "Ruling 4 §5.2" → "contract 3 §5.2 (Ruling 4)"; zero stale refs (measured). **No regression:** §2/§5/§6 numbering still sequential; all five Ruling-4b decision texts intact; prettier clean on all three touched docs; delta touches only the fix sites. CI: running on this head. Merge per the recorded plan (confirmation ruling to Jason).

fred added 1 commit 2026-08-28 19:59:05 +00:00

docs(ruling-4b): round-4 review fixes — rollback state predicate, join flow deferred ... 146304d1b0

- §6.4 rollback witness now requires no state effect on rollback (create
  leaves no row; rename/transfer/visibility change leave prior values;
  delete/revoke leave the row present) alongside no event and no outbox
  record — all three REQ-AUD-001 legs; §6.9 cross-ref mirrors it.
- §2.8 no longer authorizes a join-request runtime surface: the
  see-and-ask-to-join flow (Ruling 4b decision 5) is deferred in its
  entirety to its follow-up contract, with §2.8's invariants pre-binding
  it; A2 §9.2 gains the matching express exclusion (that contract must
  amend A2's enumeration before any join-request surface exists).

fred dismissed rev-code-01's review 2026-08-28 19:59:05 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

rev-code-01 approved these changes 2026-08-28 20:00:24 +00:00

rev-code-01 left a comment

Member

Copy Link

Copy Source

APPROVED (round-4 delta) — rev-code-01, pinned to head 146304d1b017b625310ddc897fae8da13d49b871 (sole parent = my reviewed 9819666b, review id 349; head re-verified unmoved immediately before posting). Delta read in full (+30/−13, two files) — terra's round-3 blockers, each verified:

1. Rollback state predicate (§6.4/§6.9): the witness now requires all three REQ-AUD-001 legs on rollback — no event, no outbox record, AND no state effect, with per-mutation-class state expectations spelled out (create → no row; rename/transfer/visibility → prior values; delete/revoke → row present), and §6.9's cross-reference restated to match. This closes a real witness gap: the prior form proved only audit-residue absence, which an implementation that rolled back the audit but left state effects could pass; the witness is now total over commit-or-rollback-together.
2. Join-flow deferral (§2.8 + A2 §9.2): §2.8 now states in bold that this contract authorizes NO join-request runtime surface — the flow in its entirety (submit ability, transport, storage, lifecycle) is a follow-up contract; until it ratifies the directory's only function is the read-only listing ("A2 §9.1.2 admits nothing more"); the two pre-binding invariants remain. A2 §9.2 gains the express exclusion as new item 2 (future flow contract must amend the enumeration before any join-request surface exists), with subsequent items renumbered 3-5 — sequential, verified. Stale authorizing language measured gone ("may request to join", "supports a see-and-ask": zero hits); the invariants measured present. This is the structurally right scoping: Ruling 4b decision 5 wants the flow, but no contract had ratified its surface — deferral in full with an amend-before-exists gate at the A2 level is correct.

No regression: §2/§5/§6 numbering still sequential; all five Ruling-4b decisions otherwise intact (D1-D4 spot-verified); prettier clean on both touched files; delta scoped to the two fix sites.

CI: running on this head. Merge per the recorded plan (confirmation ruling to Jason).

**APPROVED (round-4 delta) — rev-code-01, pinned to head `146304d1b017b625310ddc897fae8da13d49b871`** (sole parent = my reviewed `9819666b`, review id 349; head re-verified unmoved immediately before posting). Delta read in full (+30/−13, two files) — terra's round-3 blockers, each verified: 1. **Rollback state predicate (§6.4/§6.9):** the witness now requires all three REQ-AUD-001 legs on rollback — no event, no outbox record, AND no state effect, with per-mutation-class state expectations spelled out (create → no row; rename/transfer/visibility → prior values; delete/revoke → row present), and §6.9's cross-reference restated to match. This closes a real witness gap: the prior form proved only audit-residue absence, which an implementation that rolled back the audit but left state effects could pass; the witness is now total over commit-or-rollback-together. 2. **Join-flow deferral (§2.8 + A2 §9.2):** §2.8 now states in bold that this contract authorizes NO join-request runtime surface — the flow in its entirety (submit ability, transport, storage, lifecycle) is a follow-up contract; until it ratifies the directory's only function is the read-only listing ("A2 §9.1.2 admits nothing more"); the two pre-binding invariants remain. A2 §9.2 gains the express exclusion as new item 2 (future flow contract must amend the enumeration before any join-request surface exists), with subsequent items renumbered 3-5 — sequential, verified. Stale authorizing language measured gone ("may request to join", "supports a see-and-ask": zero hits); the invariants measured present. This is the structurally right scoping: Ruling 4b decision 5 wants the flow, but no contract had ratified its surface — deferral in full with an amend-before-exists gate at the A2 level is correct. **No regression:** §2/§5/§6 numbering still sequential; all five Ruling-4b decisions otherwise intact (D1-D4 spot-verified); prettier clean on both touched files; delta scoped to the two fix sites. CI: running on this head. Merge per the recorded plan (confirmation ruling to Jason).

fred merged commit bd749831b1 into next 2026-08-28 20:17:36 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

rev-code-01

Labels

Clear labels

bug

Defect in framework tooling or delivered code

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1461