framework: merge wrappers must stamp executor provenance (session/pane/PID/host) in a durable pre-merge provider receipt #855

New Issue

jason.woltje · 2026-07-20T08:47:03Z

jason.woltje commented

2026-07-20 08:47:03 +00:00

Problem

When multiple concurrent agent lanes operate against a single shared provider token, the provider's merged_by field resolves to that one shared identity for every merge, regardless of which lane actually executed it. The provider timeline exposes no client-side host / process / session, so after a merge there is no durable way to attribute the executing lane. This defeats post-hoc audit of who performed a given merge and undermines the merge-authority model (a merge is supposed to be traceable to a named executor).

This is structural, not a misconfiguration: as long as N lanes share one token, merged_by is unattributable by construction.

Proposed fix

The Mosaic merge wrappers (~/.config/mosaic/tools/git/pr-merge.sh and any sibling mutation wrappers) should emit executor provenance into a durable provider record BEFORE the mutation:

Immediately before the merge call, post a provider comment (or write a receipt) on the target PR containing the executing lane's provenance: session identifier, terminal/pane identifier, process id, and host.
Only then perform the merge.
On merge success, optionally append the resulting merge commit sha to the same receipt, closing the loop.

This makes the actual executor auditable even under a single shared token, because the pre-merge receipt is written by the same process that performs the mutation and is timestamped ahead of it.

Acceptance

A merge performed through the wrapper leaves a durable, provider-visible provenance record naming the executing session/pane/pid/host, posted before the merge mutation.
The record is present regardless of whether the shared token maps every actor to one provider identity.
No secret or token value is ever emitted in the provenance record.
Wrapper still fails closed if the provenance write fails (do not merge without the receipt).

Context

Cross-references the captured framework gap OpenBrain 7f3bbe68 (shared-token merge-attribution impossibility). Operator-agnostic framework improvement — applies to any deployment where agent lanes share a provider credential.

## Problem When multiple concurrent agent lanes operate against a single shared provider token, the provider's `merged_by` field resolves to that one shared identity for **every** merge, regardless of which lane actually executed it. The provider timeline exposes no client-side host / process / session, so after a merge there is **no durable way to attribute the executing lane**. This defeats post-hoc audit of who performed a given merge and undermines the merge-authority model (a merge is supposed to be traceable to a named executor). This is structural, not a misconfiguration: as long as N lanes share one token, `merged_by` is unattributable by construction. ## Proposed fix The Mosaic merge wrappers (`~/.config/mosaic/tools/git/pr-merge.sh` and any sibling mutation wrappers) should **emit executor provenance into a durable provider record BEFORE the mutation**: - Immediately before the merge call, post a provider comment (or write a receipt) on the target PR containing the executing lane's provenance: session identifier, terminal/pane identifier, process id, and host. - Only then perform the merge. - On merge success, optionally append the resulting merge commit sha to the same receipt, closing the loop. This makes the actual executor auditable even under a single shared token, because the pre-merge receipt is written by the same process that performs the mutation and is timestamped ahead of it. ## Acceptance - A merge performed through the wrapper leaves a durable, provider-visible provenance record naming the executing session/pane/pid/host, posted before the merge mutation. - The record is present regardless of whether the shared token maps every actor to one provider identity. - No secret or token value is ever emitted in the provenance record. - Wrapper still fails closed if the provenance write fails (do not merge without the receipt). ## Context Cross-references the captured framework gap `OpenBrain 7f3bbe68` (shared-token merge-attribution impossibility). Operator-agnostic framework improvement — applies to any deployment where agent lanes share a provider credential.

jason.woltje referenced this issue

2026-07-20 09:19:35 +00:00

fix(framework): drop unsupported --comment from tea pr approve/reject; route review body via durable comment (#835) #857

jason.woltje referenced this issue

2026-07-20 09:38:10 +00:00

fix(framework): install deps on worktree bootstrap + legible deps-preflight at gate seam (#856) #858

jason.woltje referenced this issue

2026-07-20 10:13:23 +00:00

fix(#812 follow-up): normalize detect-platform.sh host-match port comparison by scheme #859

jason.woltje referenced this issue

2026-07-20 10:32:40 +00:00

fix(mosaic): de-flake mutator-class lease gate TTL-expiry test #861