mosaicstack/stack
1
0
Fork 0
Code Issues 77 Pull Requests 1 Actions Packages Projects Releases 15 Wiki Activity

WI-6 (#833): constrained recovery command + mosaic-context-refresh skill wrapper #846

Merged
jason.woltje merged 9 commits from feat/833-constrained-recovery-command into main 2026-07-20 03:33:01 +00:00
Conversation 1 Commits 9 Files Changed 23 +1847 -43
jason.woltje commented 2026-07-20 02:43:42 +00:00
Owner
Copy Link

closes #833

WI-6 — Constrained recovery command + mosaic-context-refresh skill wrapper

Milestone 188 (Compaction directive-freshness), M1 (Claude+Pi). Delivers the single ungated mutator — the constrained recovery command — plus the durable framework-native mosaic-context-refresh skill. Recovery mints a fresh receipt challenge and reuses the identical WI-5 receipt/consume-before-promote/promote-last transition; the gate blesses only a fully-literal, zero-expansion argv byte-matching the canonical command.

Security core

mutator-gate.py:recovery_invocation_name is a sound 3-layer construction (reject all shell-active bytes → prove exact single-space argv bijection → allowlist every value position). Every command-substitution/backtick/param-expand/glob/tilde/brace/redirect/control-op/quoting/newline is fail-closed in every argv position. Original ${IFS} ACE vector (S-B1) is closed and proven non-wideable.

Review record (author ≠ reviewer, both distinct from builder)

  • CODE — ms-wi6-code (terra): APPROVED. RoR sha256 2aa438ccc778c4535d49b3e90462bea27d7c591c7573da95daa955ebe298464c.
  • SECREV — ms-wi6-secrev3 (fresh distinct Opus §7): APPROVED, S-B1 NON-WIDEABLE=Y, 0 bypasses, no surviving PoC, gate-byte-unchanged=Y, S1–S7=Y. RoR sha256 47f1c95628a351b2da62e7fa1edd7220ad2ff64fff10e239c05f255fdd92d747.
  • P6 constrained-recovery probe (Mos-fired, out-of-proc, 3× isolation, head unmoved pre+post): PASS — fresh challenge minted ≠ normal path, consume-before-promote, replay refused (RECEIPT_MISMATCH / INVALID_LEASE_TRANSITION) across pi/claude/pi.

Reviewed head: 3277faadecbe243e700b2fdc8112b90f85a19d23. Red-first genuine (adversarial B1 suite = 43 failures against the buggy shlex gate). TS gates (vitest/eslint/tsc/prettier) deferred to CI (no local node_modules).

closes #833 ## WI-6 — Constrained recovery command + `mosaic-context-refresh` skill wrapper Milestone 188 (Compaction directive-freshness), M1 (Claude+Pi). Delivers the **single ungated mutator** — the constrained recovery command — plus the durable framework-native `mosaic-context-refresh` skill. Recovery mints a **fresh** receipt challenge and reuses the identical WI-5 receipt/consume-before-promote/promote-last transition; the gate blesses **only** a fully-literal, zero-expansion argv byte-matching the canonical command. ### Security core `mutator-gate.py:recovery_invocation_name` is a sound 3-layer construction (reject all shell-active bytes → prove exact single-space argv bijection → allowlist every value position). Every command-substitution/backtick/param-expand/glob/tilde/brace/redirect/control-op/quoting/newline is fail-closed in every argv position. Original `${IFS}` ACE vector (S-B1) is closed and proven **non-wideable**. ### Review record (author ≠ reviewer, both distinct from builder) - **CODE** — ms-wi6-code (terra): **APPROVED**. RoR sha256 `2aa438ccc778c4535d49b3e90462bea27d7c591c7573da95daa955ebe298464c`. - **SECREV** — ms-wi6-secrev3 (fresh distinct Opus §7): **APPROVED**, S-B1 NON-WIDEABLE=Y, 0 bypasses, no surviving PoC, gate-byte-unchanged=Y, S1–S7=Y. RoR sha256 `47f1c95628a351b2da62e7fa1edd7220ad2ff64fff10e239c05f255fdd92d747`. - **P6 constrained-recovery probe** (Mos-fired, out-of-proc, 3× isolation, head unmoved pre+post): **PASS** — fresh challenge minted ≠ normal path, consume-before-promote, replay refused (RECEIPT_MISMATCH / INVALID_LEASE_TRANSITION) across pi/claude/pi. Reviewed head: `3277faadecbe243e700b2fdc8112b90f85a19d23`. Red-first genuine (adversarial B1 suite = 43 failures against the buggy shlex gate). TS gates (vitest/eslint/tsc/prettier) deferred to CI (no local node_modules).
jason.woltje added 8 commits 2026-07-20 02:43:43 +00:00
test(mosaic): define constrained recovery contracts 3b5513bd6e
feat(mosaic): add constrained context recovery command 7729e6f2f7
test(mosaic): define recovery runtime boundary contracts f4beedc3e7
fix(mosaic): wire constrained recovery runtime boundaries 95681510c1
test(mosaic): define adversarial Claude recovery gate contracts 65e2bd71cf
fix(mosaic): harden literal Claude recovery gate mapping b6deed04c7
test(mosaic): enforce framework skill portability bfc904b3c2
fix(mosaic): make recovery skill portable
Some checks failed
ci/woodpecker/pr/ci Pipeline failed
Details
3277faadec
jason.woltje added 1 commit 2026-07-20 03:10:21 +00:00
fix(mosaic): register canonical framework skills
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
fc1a86c471
jason.woltje commented 2026-07-20 03:31:13 +00:00
Author
Owner
Copy Link

WI-6 #833 — R4 EXACT-HEAD REVIEW RECORD (durable binding)

Head: fc1a86c4713a6a093d192ca9dee9902994ef1f12 (R4) · base main 07553ead · merge-base clean descendant of R3 3277faad (pure forward, no rebase).

This supersedes the R3 (3277faad) review/fire record for the CI-caught manifest defect. R4 delta = 3 files / +13 / -0, data + tests only: framework-manifest.txt (skills/** → [framework]; skills-local/** → [operator] carve-out), manifest.spec.ts, manifest-parity.spec.ts. Security surface (mutator-gate.py, daemon.py, recover-context.py) byte-identical to 3277faad → S-B1 non-wideable NOT reopened; R3 SECREV cert carries.

R4 review gates — both APPROVE (author ≠ builder)

  • CODE R4 delta (ms-wi6-code): APPROVED. D-R4-1..6 = Y; scope-3-files = Y; security-byte-unchanged = Y; red@3277faad→green@R4 = Y; tests-additive-no-weakening = Y.
    RoR WI6-833-CODE-R4-fc1a86c4.md sha256 1148c4beb84384413baaf41ca2640779ef1f82a9de082611d4e1d6e1cedf1cc6.
  • SECREV R4 focused delta-attest (ms-wi6-secrev3, Opus): APPROVED. A1 security-core byte-unchanged = Y (S-B1 not reopened); A2 firewall-clean = Y; A3 no-prune/security-regression = Y (skills-local unprunable; gate files disjoint from skills/**); A4 red→green = Y.
    RoR WI6-833-SECREV-R4-fc1a86c4.md sha256 1ff857e3d07d1c73f55e320aa6a763a3fd4d2e00a119709735ba29c3c9afed01.

CI (Gate-2) — GREEN at exact head

Woodpecker pipeline #1928 (pull_request, commit fc1a86c4713a) = success; all steps OK incl test (the exact step RED at #1927/3277faad). Combined commit-status @fc1a86c4 = success.

Independent verification (three parties, off fetched branch)

  • MS-LEAD: scope-fence + 3-file security byte-stability + bash SSOT resolver red@3277faad/green@R4; both RoR sha256 verified byte-exact.
  • Mos: front-load re-hash PASS (pin/merge-base/scope/security-byte/manifest-delta/tests-additive/CI-status).
  • homelab: exact-byte verify PASS + actually ran the deferred Vitest — manifest.spec.ts + manifest-parity.spec.ts = 51/51 PASS on an exact-R4 tree, closing the reviewers' vitest-deferral gap.

Merge sequence (Mos-owned): consolidated local+mirror re-hash folding the two R4 RoR shas → exact-R4 P6 RE-FIRE (fired == merged SHA) → 6-check + queue guard → squash closes #833. Posted by MS-LEAD as durable exact-head review binding per team discipline (pr-review gitea-comment broken, #812).

## WI-6 #833 — R4 EXACT-HEAD REVIEW RECORD (durable binding) **Head:** `fc1a86c4713a6a093d192ca9dee9902994ef1f12` (R4) · base `main` `07553ead` · merge-base clean descendant of R3 `3277faad` (pure forward, no rebase). This supersedes the R3 (`3277faad`) review/fire record for the CI-caught manifest defect. R4 delta = **3 files / +13 / -0**, data + tests only: `framework-manifest.txt` (`skills/**` → `[framework]`; `skills-local/**` → `[operator]` carve-out), `manifest.spec.ts`, `manifest-parity.spec.ts`. Security surface (`mutator-gate.py`, `daemon.py`, `recover-context.py`) **byte-identical** to `3277faad` → S-B1 non-wideable NOT reopened; R3 SECREV cert carries. ### R4 review gates — both APPROVE (author ≠ builder) - **CODE R4 delta** (ms-wi6-code): **APPROVED**. D-R4-1..6 = Y; scope-3-files = Y; security-byte-unchanged = Y; red@3277faad→green@R4 = Y; tests-additive-no-weakening = Y. RoR `WI6-833-CODE-R4-fc1a86c4.md` sha256 `1148c4beb84384413baaf41ca2640779ef1f82a9de082611d4e1d6e1cedf1cc6`. - **SECREV R4 focused delta-attest** (ms-wi6-secrev3, Opus): **APPROVED**. A1 security-core byte-unchanged = Y (S-B1 not reopened); A2 firewall-clean = Y; A3 no-prune/security-regression = Y (skills-local unprunable; gate files disjoint from `skills/**`); A4 red→green = Y. RoR `WI6-833-SECREV-R4-fc1a86c4.md` sha256 `1ff857e3d07d1c73f55e320aa6a763a3fd4d2e00a119709735ba29c3c9afed01`. ### CI (Gate-2) — GREEN at exact head Woodpecker pipeline **#1928** (pull_request, commit `fc1a86c4713a`) = **success**; all steps OK incl `test` (the exact step RED at #1927/`3277faad`). Combined commit-status @`fc1a86c4` = success. ### Independent verification (three parties, off fetched branch) - **MS-LEAD**: scope-fence + 3-file security byte-stability + bash SSOT resolver red@3277faad/green@R4; both RoR sha256 verified byte-exact. - **Mos**: front-load re-hash PASS (pin/merge-base/scope/security-byte/manifest-delta/tests-additive/CI-status). - **homelab**: exact-byte verify PASS + actually **ran** the deferred Vitest — `manifest.spec.ts` + `manifest-parity.spec.ts` = **51/51 PASS** on an exact-R4 tree, closing the reviewers' vitest-deferral gap. **Merge sequence (Mos-owned):** consolidated local+mirror re-hash folding the two R4 RoR shas → exact-R4 P6 RE-FIRE (fired == merged SHA) → 6-check + queue guard → squash `closes #833`. Posted by MS-LEAD as durable exact-head review binding per team discipline (pr-review gitea-comment broken, #812).
jason.woltje merged commit 2509eb7646 into main 2026-07-20 03:33:01 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#846
Delete Branch "feat/833-constrained-recovery-command"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?