2026-08-01 01:08:12 +00:00
1 changed files with 28 additions and 0 deletions
@@ -93,6 +93,34 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI.
 Three independent live instances in a single session — format gate, agent context reset, queue guard —
 is the class confirmed, not anecdote.

+### D-11 — seat identity did not survive into git, and seat capability is invisible at dispatch
+
+Two defects, one dispatch (RM-01 → `f10-coder`):
+
+**(a) Identity drift — P-WRAPPER-001, reproduced on our own delivery.** The brief instructed the seat
+to `export MOSAIC_GIT_IDENTITY=f10-coder`. Its commits are authored
+`mosaic-coder <[email protected]>` — the generic fallback. **You cannot tell from git history
+which seat did this work.** Recorded, not rewritten: the drift is the evidence.
+
+**(b) Capability opacity.** Nothing at dispatch time revealed that `f10-coder` had no credential for
+the target provider. Per-slot tokens live at `~/.config/mosaic/secrets/gitea-tokens/`; the seat holds
+`gitea-usc-f10-coder` but not `gitea-mosaicstack-f10-coder`. This surfaced only when the seat failed
+**mid-task, after ~$9 and 69% of its context.** The orchestrator (me) selected a seat without any way
+to check it could act on the target repo — and there was no way to check.
+
+`get_gitea_token` behaved **correctly**: it refused to fall through and borrow another slot's token,
+failing loud precisely to protect gate-16 attribution. The tooling was right; the _dispatch-time
+information_ did not exist.
+
+**This is P-RECOVERY-001's "honest capability labeling" applied to seats rather than services.** A seat
+should declare what it can actually do — which providers, which repos, which credentials — and that
+declaration must be **checkable before dispatch**, not discovered by failure after the budget is spent.
+
+**Requirements:** RM-50 (roster ownership) gains per-seat capability declaration and a pre-dispatch
+capability check; RM-04 (activation coherence) gains the identity-binding half — a seat's declared
+identity must provably reach its commits, verified by an exit-asserting test, not assumed from an
+`export` in a brief.
+
 ### D-10 — the queue guard's failure modes are exactly backwards

 `ci-queue-wait.sh` — a **required** pre-push/pre-merge gate — was observed this session doing both of