WI-7: T-C server-side branch-protection line + R1 honesty doc amendment #834

New Issue

jason.woltje · 2026-07-17T23:55:09Z

jason.woltje commented

2026-07-17 23:55:09 +00:00

Deliverable 7 (BUILD-BRIEF §3.7). The T-C server-side line = branch protection is the irreducible guarantee; the client gate is window-narrowing ONLY. If this is ops-config rather than code, DOCUMENT the required posture explicitly (push/merge to main protected regardless of client-gate state).

R1 doc amendment: state honestly that the receipt detects ABSENT/PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP preserving the tail is a T-C contract violation (server-side covers, receipt does not). No over-claim. Fold as a doc amendment.

Functional/doc surface — may take GPT review (NOT a peercred/gate/receipt security surface).

Authority (build AGAINST these, do not re-derive): BUILD-BRIEF 89fdbc27, SPEC-v5 a6d07ade, RATIFICATION bac58319, sol red-team 3da326a4. Coder MUST re-verify sha256 before build. Target: framework-native packages/mosaic/ in mosaicstack/stack (NOT jarvis-brain, NOT ~/.config/mosaic/ directly). M1 = Claude + Pi only.

Review discipline: red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); closes #<this>; full 40-char head; never edit tests to pass / never force-merge red / never --no-verify. Mos merges after review + green suite + (for security surfaces) Opus-SECREV.

Deliverable 7 (BUILD-BRIEF §3.7). The **T-C server-side line = branch protection** is the irreducible guarantee; the client gate is window-narrowing ONLY. If this is ops-config rather than code, DOCUMENT the required posture explicitly (push/merge to `main` protected regardless of client-gate state). **R1 doc amendment:** state honestly that the receipt detects ABSENT/PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP preserving the tail is a T-C contract violation (server-side covers, receipt does not). No over-claim. Fold as a doc amendment. Functional/doc surface — may take GPT review (NOT a peercred/gate/receipt security surface). **Authority (build AGAINST these, do not re-derive):** BUILD-BRIEF `89fdbc27`, SPEC-v5 `a6d07ade`, RATIFICATION `bac58319`, sol red-team `3da326a4`. Coder MUST re-verify sha256 before build. Target: framework-native `packages/mosaic/` in `mosaicstack/stack` (NOT jarvis-brain, NOT `~/.config/mosaic/` directly). M1 = Claude + Pi only. **Review discipline:** red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); `closes #<this>`; full 40-char head; never edit tests to pass / never force-merge red / never `--no-verify`. **Mos merges** after review + green suite + (for security surfaces) Opus-SECREV.

jason.woltje added this to the Compaction-Refresh Mechanism (M1: Claude+Pi) milestone 2026-07-17 23:55:09 +00:00

jason.woltje commented

2026-07-18 00:01:23 +00:00

Mos tripwire (ratification): GPT-OK holds ONLY while this WI stays DOCUMENTATION of the required branch-protection POSTURE + R1 honesty doc amendment (ops-config/prose). IF it grows any ENFORCEMENT CODE (a gate/hook/policy that server-side blocks a mutation), it FLIPS to a security surface = Opus-SECREV, no GPT sub. Scope-check at build; report which it turned out to be.

**Mos tripwire (ratification):** GPT-OK holds ONLY while this WI stays DOCUMENTATION of the required branch-protection POSTURE + R1 honesty doc amendment (ops-config/prose). IF it grows any ENFORCEMENT CODE (a gate/hook/policy that server-side blocks a mutation), it FLIPS to a security surface = Opus-SECREV, no GPT sub. Scope-check at build; report which it turned out to be.

jason.woltje referenced this issue from a commit

2026-07-20 03:45:12 +00:00

mos: WI-6 completion-gate converged (1929 green) + WI-7 #834 SIGN-OFF GO

jason.woltje referenced this issue from a commit

2026-07-20 03:53:01 +00:00

docs(#834): document T-C branch protection posture

jason.woltje referenced this issue from a commit

2026-07-20 04:01:40 +00:00

mos: WI-7 #834 head 3831d5e3 MOS VERIFY PASS -> GO review dispatch (terra CODE, no SECREV/P6)

jason.woltje referenced a pull request that will close this issue

2026-07-20 04:10:55 +00:00

WI-7 #834: T-C server-side branch-protection posture + R1 honesty amendment #847