docs(remediation): mission-state snapshot at the RM-01 seam #1028

2026-08-01T00:51:37Z

mos-dt-0 commented

2026-08-01 00:51:37 +00:00

Docs-only snapshot of the rolling mission-state branch at a mission seam (RM-01 merged). 21 commits, 5 files, all under docs/remediation/.

Per the coordinator's cadence ruling, every board/backlog tick is pushed to remediation/state immediately (durable per-tick, no PR-per-tick), and main receives periodic snapshots at seams. KICKSTART.md's resume step points at the rolling branch HEAD, with an explicit warning that reading the board from main yields a stale tick.

What landed in this snapshot

Four first-class charter principles, each earned by a live failure on this mission's own first delivery — not written in advance:

Observe the property, not the exit code. Success output is designed to be believed; a green is engineered to be trusted, so trusting it is the default behaviour of a competent operator, not a lapse.
Pre-registration prevents retrofitting, and nothing else. A pre-registered check set can be wrong (D-8), incomplete (D-17), or internally inconsistent (D-18). It settles one question of three.
Never ship an integrity claim dressed as a property. A verification artifact writable by the actor it certifies certifies the attack.
When a property cannot exist at the layer that specified it — implement what the layer can guarantee, state the boundary in both directions, and record the real guarantee as a tracked dependency (here: RM-59), never as prose.

Reconciled 59-task backlog (P0–P5) from two independent adversarial decompositions, with disagreements adjudicated rather than averaged, and both raw decomps committed so the disagreements stay auditable.

Twenty banked findings (D-1 … D-20), every one surfaced by doing the work rather than by inspection. Four are the orchestrator's own — including D-20, where an independent reviewer empirically disproved an overclaim in this very backlog by running a same-UID rewrite that passed preflight.

Notable corrections recorded rather than quietly fixed

DECISION-1 — both planners independently rejected the charter's own choke-point wire-in target; the charter is corrected in place with rationale and provenance.
DECISION-2 — the coordinator's ruling reversed an earlier orchestrator recommendation; the reversal is marked as such.
D-18 — carries a superseded-in-part banner and quotes its own withdrawn wording beside the empirical disproof.

Restatements keep original text + restatement + reason, because a criterion that quietly changes meaning is worse than one never registered.

Verification

Docs-only; no source touched. pnpm typecheck / pnpm lint / pnpm format:check all green (pre-push hook enforced, no bypass).

**Docs-only snapshot** of the rolling mission-state branch at a mission seam (RM-01 merged). 21 commits, 5 files, all under `docs/remediation/`. Per the coordinator's cadence ruling, every board/backlog tick is pushed to `remediation/state` immediately (durable per-tick, no PR-per-tick), and `main` receives **periodic snapshots** at seams. `KICKSTART.md`'s resume step points at the rolling branch HEAD, with an explicit warning that reading the board from `main` yields a stale tick. ## What landed in this snapshot **Four first-class charter principles**, each earned by a live failure on this mission's own first delivery — not written in advance: 1. **Observe the property, not the exit code.** Success output is designed to be believed; a green is *engineered* to be trusted, so trusting it is the default behaviour of a competent operator, not a lapse. 2. **Pre-registration prevents retrofitting, and nothing else.** A pre-registered check set can be **wrong** (D-8), **incomplete** (D-17), or **internally inconsistent** (D-18). It settles one question of three. 3. **Never ship an integrity claim dressed as a property.** A verification artifact writable by the actor it certifies *certifies the attack*. 4. **When a property cannot exist at the layer that specified it** — implement what the layer can guarantee, state the boundary in **both** directions, and record the real guarantee as a **tracked dependency** (here: RM-59), never as prose. **Reconciled 59-task backlog** (P0–P5) from two independent adversarial decompositions, with disagreements adjudicated rather than averaged, and both raw decomps committed so the disagreements stay auditable. **Twenty banked findings** (D-1 … D-20), every one surfaced by doing the work rather than by inspection. Four are the orchestrator's own — including D-20, where an independent reviewer *empirically disproved* an overclaim in this very backlog by running a same-UID rewrite that passed preflight. ## Notable corrections recorded rather than quietly fixed - **DECISION-1** — both planners independently rejected the charter's own choke-point wire-in target; the charter is corrected in place with rationale and provenance. - **DECISION-2** — the coordinator's ruling *reversed* an earlier orchestrator recommendation; the reversal is marked as such. - **D-18** — carries a superseded-in-part banner and quotes its own withdrawn wording beside the empirical disproof. Restatements keep original text + restatement + reason, because a criterion that quietly changes meaning is worse than one never registered. ## Verification Docs-only; no source touched. `pnpm typecheck` / `pnpm lint` / `pnpm format:check` all green (pre-push hook enforced, no bypass).

mos-dt-0 added 21 commits 2026-08-01 00:51:38 +00:00

docs(remediation): bank D-9 — comms path shell-interprets message bodies 6a067174ed

agent-send.sh -m with backticks executes them as command substitution: the recipient
got a mangled body plus a shell error, and the send still reported success. Same class
as the known pr-create.sh backtick bug — two tools in the comms path treating a
message body as shell input.

The failure mode is the mission's own pattern: silent corruption with a success
receipt.

Requirement on RM-40/RM-42: comms/v1 must carry payloads verbatim with no shell
interpretation at any hop, with a byte-identical round-trip test (backticks, command
substitution, quotes, newlines) registered under RM-02 including a must-fail control.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): rolling-branch resume pointer + D-9 interim comms rule 31c3191305

KICKSTART resume now points at origin/remediation/state for the live board, per Mos's
cadence ruling: every tick is pushed to the rolling branch immediately (durable
per-tick, no per-tick main PR); main carries periodic snapshots only. Reading the
board from main would silently yield a stale tick, so the step warns explicitly.

D-9 hardened: comms/v1 must use file/stdin transport, never argv interpolation.
Standing interim rule until then — agent-send -f for any body with special
characters, never -m. Mandatory in every worker brief alongside the D-8 clause.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-10 — the queue guard's failure modes are inverted 409bf23e6a

Same required gate, both directions wrong: fails OPEN on state=unknown (5 meaningless
greens this session, wrong branch too), and fails CLOSED on credential resolution,
hard-blocking a worker's completed work. The identical command succeeded from that
worker's own worktree in another shell, so the checkout was fine.

A gate that waves through unchecked work and blocks ready work has its failure modes
backwards. Availability failures must degrade to a loud, audited CANNOT_ASSERT;
correctness failures must block. Also the Pi-brick shape: a gate whose unavailability
prevents recovery from it.

RM-03 extended to a third requirement: distinguish CANNOT_ASSERT from
ASSERTED_NOT_READY, both registered with must-fail controls, neither exiting 0 silently.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-11 — identity drift + seat capability opacity at dispatch 75dfe2fa75

RM-01's seat was briefed to export MOSAIC_GIT_IDENTITY; its commits are authored as
the generic mosaic-coder fallback, so git history cannot say which seat did the work.
P-WRAPPER-001 reproduced on our own delivery.

Separately, nothing at dispatch time revealed the seat lacked a credential for the
target provider — discovered only when it failed mid-task after ~$9 and 69% context.
get_gitea_token behaved correctly by refusing to borrow another slot's token; the
dispatch-time information simply did not exist.

RM-50 gains per-seat capability declaration + pre-dispatch check; RM-04 gains
identity-binding verified by an exit-asserting test rather than assumed from an
export in a brief.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): correct D-11(a) mechanism — token identity and commit authorship are separate 2201c30284

Per Mos. MOSAIC_GIT_IDENTITY resolves the TOKEN; commit author comes from git config
user.name/user.email, a separate setting that fell back to the generic value. The
export could never have fixed authorship — my worker brief instructed only the export,
so the seat did what it was told and the commits were still mis-attributed. The error
was in the brief before it was in the finding.

Requirement is COHERENCE: token and authorship must agree; either half alone is drift.
Belongs in seat setup, verified by an exit-asserting test that commits and asserts the
author — not in prose a seat can follow correctly and still end up wrong.

Capability check mechanized: capability IS token-file existence. Before dispatching
seat X to provider Y, test gitea-<Y>-<X>.token exists. The token-file set is the
authoritative capability registry.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): board tick — 2 PRs merged, RM-01 on rotated seat, dispatch doctrine be10bdc828

Board now carries the pre-dispatch capability check (token-file existence), the
token/authorship coherence rule, and the accreted worker-brief doctrine, so a
compacted or fresh seat inherits them mechanically rather than by recall.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-12 — pr-create silently dropped --draft; I trusted exit 0 over observed state 0ffdcf14bd

PR #1027 was created with -d because it carries partial unproven work. tea auth was
stale, the wrapper fell back to the raw API which cannot set draft, warned on stderr,
and exited 0. The PR sat open and mergeable for ~25 minutes, protected only by the
word DRAFT in its title and body. I had reported it to the coordinator as a draft.

Three failures: a fallback silently degrading a SAFETY flag (nuisance for --labels,
dangerous for --draft); a correct warning nobody consumed; and my own failure to
verify the flag took effect — I checked the PR existed, not that it had the property
I required. That is written-unverified treated as verified, by me, on exactly the
class of tool this mission exists to distrust.

Fixed via the WIP: title prefix; draft:True verified after.

RM-02 gains a must-fail control: a wrapper that cannot honour a safety-relevant
argument must exit non-zero. RM-24 gains this as its canonical tri-state example.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): promote observe-the-property principle to charter; bank D-13 dual credential registries d1e7ba19ca

Charter gains a first-class principle per Mos: no write is done until the requested
PROPERTY is observed; a success exit code is not evidence. Success output is designed
to be believed — that is why the inert-gate class exists and why the P-WRAPPER
tri-state is not optional. Recorded with its provenance: the orchestrator committed
this exact error (D-12), and three of the session's twelve instances were its own.

D-13: diagnosing D-12 found two parallel credential registries that can disagree.
gitea-mosaicstack-mos-dt-0.token EXISTS, but tea has no mosaicstack login for that
identity — so raw-API paths work while tea-dependent wrapper paths silently degrade.
tea is not stale; the login does not exist. Capability declared authoritative by the
token-file set does not govern the tea path.

RM-04 must reconcile the registries (or assert agreement at startup, with a must-fail
control). RM-50's pre-dispatch check must verify capability for the path actually used.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): charter reflects DECISION-1 corrected wire-in target and current status f13222b76b

The charter's build-1 cell still named mosaic_orchestrator.py::run_single_task after
DECISION-1 ruled against it. Leaving the charter contradicting the ruled decision would
mislead any future reader who starts there — corrected in place with the rationale and
provenance, rather than only in TASKS.md.

Also: status PLANNING -> EXECUTING; scout TODO discharged (file is in-tree) with a note
that its findings stand but its recommended wire-in point is superseded.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-14 decision-propagation requirement; record D-13 reconciliation 7f686aaf6d

D-14: DECISION-1 was ruled and applied to TASKS.md while MISSION.md — the charter a
cold-starting seat reads first — kept the superseded wire-in target for hours, flagged
CONTESTED on the board but never corrected in the source of truth. A resuming seat
would have read the rejected target as authoritative. Caught by hand during an
unrelated edit; nothing would have caught it otherwise.

P-MISSION-001 turned on ourselves: a decision that lives in a ruling and a board note
but not in the authoritative record has been AGREED, not MADE. Requirement: rulings
must propagate mechanically — decisions as records, documents rendering rather than
restating, and a must-fail check where duplication is unavoidable. Interim rule until
the DB cutover: the same commit that records a ruling updates every document stating it.

D-13 updated with Mos's reconciliation: 5 of 6 mosaicstack-provisioned seats have no
tea login — systemic, not a one-off. Supersedes D-11(b): the token-file set is
necessary but NOT sufficient; capability is per-path.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): propagate DECISION-2 to charter — second un-propagated ruling, found by applying D-14 d0ad6e942b

Applied D-14's own interim rule immediately instead of waiting to be bitten again, and
it caught a second instance within minutes: MISSION.md's standing directives still
stated the DB hard-cutover with no mention of Mos's binding qualification that the
spine must not be a single-point hard-stop (degraded mode + rollback artifact
required). A seat reading the charter would have designed toward an availability
posture the coordinator had explicitly rejected, with the superseded 'no DB means the
fleet stops' recommendation nowhere contradicted.

Two un-propagated rulings out of two that touched charter text. Without a mechanism,
propagation failure is the default outcome, not an oversight — which is the argument
for D-14 being a requirement rather than a discipline.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-15 — token scope is not repository permission 3477e933df

f10-coder holds gitea-mosaicstack-f10-coder.token with write:repository scope and was
verified at mint by 'repo access returns 200'. It cannot push: collaborator lookup
404s and its own token reports push:false, pull:true.

Capability has three independent layers — token file (raw-API auth), tea login (tea
path), repository permission (actual write authority) — and satisfying two proves
nothing about the third. Scope bounds what a token may ATTEMPT; repository permission
decides what the user may DO.

The charter principle failing on the check meant to confirm capability: a 200 on a
READ was accepted as evidence of WRITE. written-unverified treated as verified, by
both provisioner and orchestrator, one layer above D-12.

RM-50's pre-dispatch check must assert effective permission for the intended operation
(permissions.push == true as that seat), not token existence or a read returning 200.
A capability check that cannot fail on a seat lacking write permission is itself an
inert gate.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-16 — local and CI test gates disagree by environment e233f196b5

Ran down Mos's flag. Both hypotheses were wrong: CI runs exactly 'pnpm test' (same
command, path IS exercised) and is green, while this host exits 97 on an
environment-dependent BASH_LINENO guard (#973) that aborts on bash 5.2.15 and not in
CI's container. PR #1027 touches zero files under packages/mosaic, so the guard is
genuinely pre-existing — f10-coder's report was accurate in every particular, and main
is equally affected here.

Not 'merges step around a red' but something worse in one respect: the local gate and
the CI gate disagree about what passing means. No agent on this host can get a green
pnpm test on any branch. A gate only CI can run cannot be a pre-push gate.

Second defect found while establishing this: in the main checkout the same package
fails differently (exit 1) because a test scans the working tree and picks up
apps/coordinator/venv third-party site-packages. A test whose verdict depends on
untracked files is not hermetic — same contamination source that broke format:check,
one foreign tree breaking two independent gates.

Coordinate with #1007/#1024 rather than opening a third lane.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): D-16 ownership — #1024 is Jason-pending; CI is the authoritative gate for #1027 4512312b9f

Propagating Mos's ruling in the same commit that records it, per D-14's interim rule.

The hermeticity fix IS PR #1024, which sits in Jason's parked delivery stack, so its
disposition is his — marked SUPERSEDED-PENDING-JASON alongside #1023. D-16 strengthens
urgency without transferring ownership; we do not open a third lane on a parked PR.

Class sharpened: a pre-push gate an operator cannot run locally is a gate only CI
enforces, so pointing .husky/pre-push at it misrepresents where the gate lives.
Non-hermetic gates make every green host-dependent.

#1027 proceeds on CI-green; the local exit-97 is a host-specific guard abort and is
not a merge consideration.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-17 — pre-registration confers neither correctness nor coverage ae4baf145d

rev-974 blocked PR #1027: AC2 was pre-registered and explicitly required rejecting
symlinked generated state; the implementation accepts it (ln -s into .next, preflight
exits 0 instead of 43) while the acceptance suite ran 21/21 green throughout.

Confirmed independently: preflight.mjs:82-92 rejects symlinks on the SOURCE path,
:28 merely skips symlinked dirs, and the generated-state path :141-163 checks uid but
never isSymbolicLink(). The suite's only symlink cases cover the turbo binary and a
source file.

Sharpens D-8 rather than repeating it. D-8: pre-registration does not confer
CORRECTNESS. D-17: it does not confer COVERAGE — a suite can be green with every
criterion appearing satisfied while a criterion's actual requirement is untested.

RM-02 third clause: the registry must bind each criterion to the specific case that
exercises it and prove that case red before trusting its green. Mutation testing
pointed at the criterion-to-case mapping, not just the gate.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-18 — pre-registered criteria AC2 and AC4 were mutually unsatisfiable 85bdbe3383

Implementing D-17's fix surfaced a conflict between criteria, not within one. AC2
(reject symlinked generated state) cannot hold alongside AC4 (canonical build
succeeds): verified independently that apps/web sets output:'standalone' and the built
tree carries 42 legitimate pnpm symlinks under .next/standalone. Only building the
tree reveals it.

Completes the chain: a pre-registered check set can be WRONG (D-8), INCOMPLETE (D-17),
or INTERNALLY INCONSISTENT (D-18).

Ruling: build-certified symlink manifest — .next itself still rejected; descendants
rejected unless exactly certified. Stronger than blanket rejection because it catches
retargeting. AC2 restated and RECORDED with provenance rather than absorbed, since
silently resolving a conflict between pre-registered criteria destroys the point of
registering them.

Hardening: the manifest is generated state, so a manifest writable by whoever plants a
rogue symlink certifies the attack. Must be inside the integrity envelope, published
atomically, with negative controls observed red first including manifest-tampered.

RM-02 fourth clause: the registry must detect conflicts between criteria, and retain
original text plus restatement plus reason when a criterion changes meaning.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): promote the three-mode taxonomy and the integrity-claim corollary to the charter 3b191b6b34

Per Mos. Two first-class principles alongside observe-the-property:

1. Pre-registration prevents RETROFITTING and nothing else. A pre-registered check set
   can be WRONG (D-8), INCOMPLETE (D-17), or INTERNALLY INCONSISTENT (D-18). It confers
   neither correctness nor coverage nor consistency. All three modes were found on this
   mission's own first delivery, by the machinery applied to its own work. RM-02's four
   clauses are the enforceable form.

2. Never ship an integrity claim dressed as a property. A verification artifact
   writable by the actor whose behaviour it certifies certifies the attack. It must sit
   inside its integrity envelope, publish atomically, and carry a tamper negative
   control observed red. If it cannot be made tamper-evident, say so and reconsider —
   an honest 'this cannot be verified' is always available and always preferable to
   laundering foreign content as certified.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): bank D-19 — an integrity property that cannot exist at its specified layer f9435c2a03

Implementing the D-18 manifest hit CWE-345: manifest and marker share one same-UID
writable tree, so that actor can regenerate both and pass. No local construction fixes
self-authentication without a key outside its authority. The seat escalated rather than
calling it tamper-resistant — the charter corollary working on its first real test.

Ruling: Option A, scope AC2 to accidental/independent/stale mutation, retain the design.
The undefendable boundary is not the weak link (same-UID write already owns the source,
the tests, preflight.mjs and .husky); AC2 exists for the D-5 staleness class, against
which the design works; and a real anchor arrives with the choke-point executor and PG
spine, which verify outside the worktree's authority.

Acceptable only with honest labelling: threat model verbatim in code and PR, the words
tamper-proof/tamper-evident/secure barred there, scope carried in AC2's restatement,
residual risk named as backlog, all controls kept RED-first.

Generalizable: when a property cannot exist at the layer it was specified, implement
what the layer can guarantee, state the boundary precisely, and record where the real
guarantee comes from. A known gap written down is acceptable; a gap implied fixed is not.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): promote D-19 to charter; bind residual risk to RM-59 as a tracked edge 43f69bf167

Per Mos, with his two additions.

Charter gains a fourth first-class principle: when a property cannot exist at the layer
that specified it, three honest moves are mandatory — implement what the layer can
guarantee; state the boundary in BOTH directions (what it does not defend AND what it
does, since either alone misleads); and record the real guarantee as a TRACKED
DEPENDENCY, not prose. A written-down gap is acceptable engineering; an implied-fixed
gap is the mission's core failure in a new costume.

The residual risk is now RM-59 (depends_on RM-12, RM-21, RM-25) — a real backlog task
owned by the choke-point executor and spine, which verify from outside the worktree's
authority. Mos's point: 'record where the guarantee comes from' only holds if the record
is a live dependency someone must close; a documented gap with no owner becomes a
permanent gap that reads as intentional.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): fix D-18 overclaim (D-20) — reviewer empirically disproved my own documentation 1e7a0701fd

rev-974 blocked #1027 a second time, and the defect was in this file, not the code.

D-18's AC2 restatement omitted the accidental/independent scope D-19 made mandatory,
and D-18 asserted the tampered-manifest control turns integrity 'from a claim into a
property'. It does not and cannot — that sentence predated D-19 and was never revised
when D-19 landed. rev-974 disproved it by experiment: a same-UID consistent
manifest+marker rewrite passed preflight.

Two banked findings firing on the orchestrator at once: the integrity-claim corollary
(I wrote a claim in the voice of a property, in the document defining the rule against
it), and D-14 propagation — I carried D-19's consequence forward into the charter and
the delivery conditions but never back into the finding it superseded. Backwards
propagation is the same defect as forwards and I did not audit for it.

Corrected in place with the original wording quoted and the disproof recorded, not
silently rewritten.

RM-02 fifth clause: documentation asserting a security or integrity property is itself
a claim requiring a negative control observed red. Prose is not exempt from the
mission's evidentiary standard, and governing prose least of all.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs(remediation): board — RM-01 MERGED (f58b3699); RM-02 keystone is next

ci/woodpecker/pr/ci Pipeline was canceled

Details

f5a0566198

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

mos-dt-0 added 1 commit 2026-08-01 00:54:07 +00:00

docs(remediation): D-14 amended by D-20 — propagation is bidirectional

ci/woodpecker/pr/ci Pipeline was successful

Details

8a795df0ce

Both the orchestrator and the coordinator read D-14 as forward propagation only: a
ruling reaches the documents stating the new rule. D-20 proved that insufficient —
when D-19 superseded part of D-18, the consequence went forward into the charter and
the delivery conditions but never backward into D-18, which kept asserting a withdrawn
claim until a reviewer disproved it by experiment.

A supersession must update BOTH the documents rendering the new rule AND the finding it
retires, with the retired wording quoted rather than deleted. Interim rule updated
accordingly.

Applying D-14's own rule to D-14, in the same commit that records the amendment.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Mos merged commit f65e9ea656 into main

2026-08-01 01:08:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1028